theparadise.ng Open in urlscan Pro
2606:4700:e2::ac40:8a0f Public Scan

Go To Rescan
Add Verdict Report

URL:
https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
Submission: On September 12 via api (September 12th 2022, 1:04:49 am UTC) from US — Scanned from DE

Summary HTTP 404 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 56 IPs in 7 countries across 38 domains to perform 404 HTTP transactions. The main IP is 2606:4700:e2::ac40:8a0f, located in United States and belongs to CLOUDFLARENET, US. The main domain is theparadise.ng. The Cisco Umbrella rank of the primary domain is 969317.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on February 21st 2022. Valid for: a year.

This is the only time theparadise.ng was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 23	2606:4700:e2:... 2606:4700:e2::ac40:8a0f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2606:4700::68... 2606:4700::6812:189c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:440e::ac40:9c1a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	92.123.36.37 92.123.36.37	16625 (AKAMAI-AS) (AKAMAI-AS)
21	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
17	2606:4700:1::... 2606:4700:1::6813:864e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a03:2880:f01... 2a03:2880:f01c:216:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
21	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
1	142.250.186.162 142.250.186.162	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
13	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
9	2606:4700:1::... 2606:4700:1::6813:884e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	23.35.236.201 23.35.236.201	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2606:4700:10:... 2606:4700:10::6816:3556	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	23.35.237.151 23.35.237.151	16625 (AKAMAI-AS) (AKAMAI-AS)
17	2a00:1450:400... 2a00:1450:4001:80f::2001	15169 (GOOGLE) (GOOGLE)
3	2a02:2638:1::2 2a02:2638:1::2	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
6	2a02:2638::b 2a02:2638::b	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
3	2a02:2638::2 2a02:2638::2	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	2a03:90c0:41:... 2a03:90c0:41:2801::254	199524 (GCORE) (GCORE)
1 2	2a02:2638:1::13 2a02:2638:1::13	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	178.250.2.146 178.250.2.146	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2606:4700:10:... 2606:4700:10::6816:1857	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	141.95.98.69 141.95.98.69	16276 (OVH) (OVH)
1	151.101.130.132 151.101.130.132	54113 (FASTLY) (FASTLY)
1	162.19.138.116 162.19.138.116	16276 (OVH) (OVH)
44	2a02:2638:1::3 2a02:2638:1::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
6	178.250.0.160 178.250.0.160	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2a00:1450:400... 2a00:1450:4001:80f::2004	15169 (GOOGLE) (GOOGLE)
7	3.211.29.40 3.211.29.40	14618 (AMAZON-AES) (AMAZON-AES)
2	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	192.96.200.88 192.96.200.88	30633 (LEASEWEB-...) (LEASEWEB-USA-WDC)
2	151.101.128.84 151.101.128.84	54113 (FASTLY) (FASTLY)
2	151.101.129.140 151.101.129.140	54113 (FASTLY) (FASTLY)
97	178.250.0.139 178.250.0.139	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
10	178.250.0.162 178.250.0.162	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
9	23.36.163.226 23.36.163.226	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2600:9000:20e... 2600:9000:20eb:6000:1c:f793:41c0:93a1	16509 (AMAZON-02) (AMAZON-02)
9	2a00:1450:400... 2a00:1450:4001:82f::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80b::2008	15169 (GOOGLE) (GOOGLE)
2	213.19.147.42 213.19.147.42	3356 (LEVEL3) (LEVEL3)
2	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:800::2006	15169 (GOOGLE) (GOOGLE)
2	23.19.226.131 23.19.226.131	396362 (LEASEWEB-...) (LEASEWEB-USA-NYC)
7	2404:6800:400... 2404:6800:4002:81f::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400e:8::9	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80b::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:812::2016	15169 (GOOGLE) (GOOGLE)
1	209.58.147.67 209.58.147.67	394380 (LEASEWEB-...) (LEASEWEB-USA-DAL)
1	52.18.219.233 52.18.219.233	16509 (AMAZON-02) (AMAZON-02)
4	23.35.229.151 23.35.229.151	16625 (AKAMAI-AS) (AKAMAI-AS)
1	35.158.20.13 35.158.20.13	16509 (AMAZON-02) (AMAZON-02)
404	56

23 2606:4700:e2::ac40:8a0f (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

theparadise.ng	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6812:189c (United States)

ASN13335 (CLOUDFLARENET, US)

static.news.bitcoin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:440e::ac40:9c1a (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 92.123.36.37 (Vienna, Austria)

ASN16625 (AKAMAI-AS, US)
PTR: a92-123-36-37.deploy.static.akamaitechnologies.com

s7.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
v1.addthisedge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
m.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api-public.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2606:4700:1::6813:864e (United States)

ASN13335 (CLOUDFLARENET, US)

jsc.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
servicer.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:216:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:4700:1::6813:884e (United States)

ASN13335 (CLOUDFLARENET, US)

s-img.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.35.236.201 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-236-201.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::6816:3556 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 23.35.237.151 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-237-151.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
px.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2a00:1450:4001:80f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:2638:1::2 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

rtb.nl.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a02:2638::b (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

ads.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:2638::2 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

rtb.fr.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:90c0:41:2801::254 (Frankfurt am Main, Germany)

ASN199524 (GCORE, LU)

video-native.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638:1::13 (France) 1 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.2.146 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

mug.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:1857 (United States)

ASN13335 (CLOUDFLARENET, US)

content.zeotap.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.95.98.69 (France)

ASN16276 (OVH, FR)
PTR: ns3216534.ip-141-95-98.eu

lb.eu-1-id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.130.132 (United States)

ASN54113 (FASTLY, US)

player.ex.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.19.138.116 (France)

ASN16276 (OVH, FR)
PTR: ns31533567.ip-162-19-138.eu

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

44 2a02:2638:1::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 178.250.0.160 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

cat.fr.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 3.211.29.40 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-211-29-40.compute-1.amazonaws.com

prd-collector-anon.ex.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 192.96.200.88 (Ashburn, United States)

ASN30633 (LEASEWEB-USA-WDC, US)

p.channelexco.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s-10.channelexco.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.128.84 (United States)

ASN54113 (FASTLY, US)

widgets.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.129.140 (United States)

ASN54113 (FASTLY, US)

www.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

97 178.250.0.139 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
PTR: pix.par.vip.prod.criteo.com

pix.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 178.250.0.162 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

csm.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 23.36.163.226 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-36-163-226.deploy.static.akamaitechnologies.com

cdn.ex.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:20eb:6000:1c:f793:41c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

publisher-media.wibbitz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:82f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

imasdk.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 213.19.147.42 (Beverwijk, Netherlands)

ASN3356 (LEVEL3, US)

tag.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.159.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

playbuzzltd-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.19.226.131 (New York, United States)

ASN396362 (LEASEWEB-USA-NYC, US)

e.channelexco.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2404:6800:4002:81f::2003 (Australia)

ASN15169 (GOOGLE, US)

csi.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400e:8::9 (Ireland)

ASN15169 (GOOGLE, US)

rr4---sn-5hneknee.googlevideo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

yt3.ggpht.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2016 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

i.ytimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 209.58.147.67 (Dallas, United States)

ASN394380 (LEASEWEB-USA-DAL, US)

a.channelexco.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.18.219.233 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-18-219-233.eu-west-1.compute.amazonaws.com

geo.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.35.229.151 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-229-151.deploy.static.akamaitechnologies.com

cedatojsvideo958042602703.s.moatpixel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.158.20.13 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-158-20-13.eu-central-1.compute.amazonaws.com

prebid-server.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
151	criteo.net static.criteo.net — Cisco Umbrella Rank: 782 pix.eu.criteo.net — Cisco Umbrella Rank: 5551 csm.eu.criteo.net — Cisco Umbrella Rank: 5700	1 MB
32	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 129 tpc.googlesyndication.com — Cisco Umbrella Rank: 174	420 KB
29	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 73 pubads.g.doubleclick.net — Cisco Umbrella Rank: 368	93 KB
28	mgid.com jsc.mgid.com — Cisco Umbrella Rank: 6078 cdn.mgid.com — Cisco Umbrella Rank: 8110 c.mgid.com — Cisco Umbrella Rank: 4484 servicer.mgid.com — Cisco Umbrella Rank: 6104 s-img.mgid.com — Cisco Umbrella Rank: 4480 cm.mgid.com — Cisco Umbrella Rank: 2775 video-native.mgid.com — Cisco Umbrella Rank: 34261	433 KB
23	theparadise.ng 1 redirects theparadise.ng — Cisco Umbrella Rank: 969317	921 KB
22	criteo.com 1 redirects rtb.nl.eu.criteo.com — Cisco Umbrella Rank: 9447 ads.eu.criteo.com — Cisco Umbrella Rank: 5636 rtb.fr.eu.criteo.com — Cisco Umbrella Rank: 10082 gum.criteo.com — Cisco Umbrella Rank: 458 mug.criteo.com — Cisco Umbrella Rank: 1814 cat.fr.eu.criteo.com — Cisco Umbrella Rank: 7382	306 KB
17	ex.co player.ex.co — Cisco Umbrella Rank: 18571 prd-collector-anon.ex.co — Cisco Umbrella Rank: 14323 cdn.ex.co — Cisco Umbrella Rank: 19375	1 MB
11	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 120 imasdk.googleapis.com — Cisco Umbrella Rank: 456	1 MB
10	moatads.com z.moatads.com — Cisco Umbrella Rank: 592 geo.moatads.com — Cisco Umbrella Rank: 903 px.moatads.com — Cisco Umbrella Rank: 619	117 KB
9	gstatic.com fonts.gstatic.com csi.gstatic.com	32 KB
9	channelexco.com p.channelexco.com — Cisco Umbrella Rank: 21831 s-10.channelexco.com — Cisco Umbrella Rank: 135305 e.channelexco.com — Cisco Umbrella Rank: 18361 a.channelexco.com — Cisco Umbrella Rank: 19933	9 KB
7	addthis.com s7.addthis.com — Cisco Umbrella Rank: 2328 m.addthis.com — Cisco Umbrella Rank: 2330 api-public.addthis.com — Cisco Umbrella Rank: 5164	219 KB
6	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 234	263 KB
4	moatpixel.com cedatojsvideo958042602703.s.moatpixel.com — Cisco Umbrella Rank: 38571	1 KB
4	google.com adservice.google.com — Cisco Umbrella Rank: 142 www.google.com — Cisco Umbrella Rank: 19	2 KB
3	id5-sync.com cdn.id5-sync.com — Cisco Umbrella Rank: 1490 id5-sync.com — Cisco Umbrella Rank: 636	28 KB
3	google.de adservice.google.de — Cisco Umbrella Rank: 5202	1 KB
3	bitcoin.com static.news.bitcoin.com — Cisco Umbrella Rank: 197553	125 KB
2	openx.net playbuzzltd-d.openx.net — Cisco Umbrella Rank: 57005	506 B
2	1rx.io tag.1rx.io — Cisco Umbrella Rank: 2666	324 B
2	wibbitz.com publisher-media.wibbitz.com — Cisco Umbrella Rank: 64713	154 KB
2	reddit.com www.reddit.com — Cisco Umbrella Rank: 2784	1 KB
2	pinterest.com widgets.pinterest.com — Cisco Umbrella Rank: 7584	578 B
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 355	10 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 208	88 KB
1	rubiconproject.com prebid-server.rubiconproject.com — Cisco Umbrella Rank: 1415	402 B
1	ytimg.com i.ytimg.com — Cisco Umbrella Rank: 107	12 KB
1	ggpht.com yt3.ggpht.com — Cisco Umbrella Rank: 206	1 KB
1	googlevideo.com rr4---sn-5hneknee.googlevideo.com — Cisco Umbrella Rank: 40936
1	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 350	17 KB
1	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 2119	346 B
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 141	75 KB
1	eu-1-id5-sync.com lb.eu-1-id5-sync.com — Cisco Umbrella Rank: 1893	328 B
1	zeotap.com content.zeotap.com — Cisco Umbrella Rank: 7319	19 KB
1	addthisedge.com v1.addthisedge.com — Cisco Umbrella Rank: 2744	751 B
1	pubmatic.com ads.pubmatic.com — Cisco Umbrella Rank: 713	67 KB
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 972	645 B
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 1568	5 KB
404	38

	Domain	Requested by
97	pix.eu.criteo.net	ads.eu.criteo.com
44	static.criteo.net	ads.eu.criteo.com
23	theparadise.ng	1 redirects theparadise.ng static.cloudflareinsights.com
19	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net theparadise.ng
17	tpc.googlesyndication.com	googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com imasdk.googleapis.com
15	pagead2.googlesyndication.com	theparadise.ng pagead2.googlesyndication.com tpc.googlesyndication.com www.googletagservices.com
10	pubads.g.doubleclick.net	imasdk.googleapis.com
10	csm.eu.criteo.net	ads.eu.criteo.com
9	imasdk.googleapis.com	player.ex.co imasdk.googleapis.com
9	cdn.ex.co	player.ex.co cdn.ex.co
9	s-img.mgid.com	jsc.mgid.com
7	px.moatads.com
7	csi.gstatic.com	imasdk.googleapis.com
7	prd-collector-anon.ex.co	player.ex.co
7	cdn.mgid.com	jsc.mgid.com
6	cat.fr.eu.criteo.com	ads.eu.criteo.com
6	ads.eu.criteo.com	googleads.g.doubleclick.net
6	www.googletagservices.com	googleads.g.doubleclick.net
5	s7.addthis.com	theparadise.ng s7.addthis.com
4	cedatojsvideo958042602703.s.moatpixel.com
4	s-10.channelexco.com
4	jsc.mgid.com	theparadise.ng jsc.mgid.com
3	rtb.fr.eu.criteo.com	googleads.g.doubleclick.net
3	rtb.nl.eu.criteo.com	googleads.g.doubleclick.net theparadise.ng
3	adservice.google.com	pagead2.googlesyndication.com imasdk.googleapis.com
3	adservice.google.de	pagead2.googlesyndication.com imasdk.googleapis.com
3	static.news.bitcoin.com	theparadise.ng
2	e.channelexco.com	player.ex.co
2	playbuzzltd-d.openx.net	cdn.ex.co
2	tag.1rx.io	cdn.ex.co
2	publisher-media.wibbitz.com	player.ex.co
2	fonts.gstatic.com	fonts.googleapis.com
2	www.reddit.com	s7.addthis.com
2	widgets.pinterest.com	s7.addthis.com
2	p.channelexco.com	player.ex.co
2	cdnjs.cloudflare.com	ads.eu.criteo.com
2	fonts.googleapis.com	client cdnjs.cloudflare.com
2	mug.criteo.com
2	gum.criteo.com	1 redirects
2	video-native.mgid.com	jsc.mgid.com video-native.mgid.com
2	z.moatads.com	s7.addthis.com player.ex.co
2	cdn.id5-sync.com	jsc.mgid.com
2	cm.mgid.com	jsc.mgid.com
2	servicer.mgid.com	jsc.mgid.com
2	c.mgid.com	jsc.mgid.com
2	connect.facebook.net	theparadise.ng connect.facebook.net
1	prebid-server.rubiconproject.com	cdn.ex.co
1	geo.moatads.com	z.moatads.com
1	a.channelexco.com
1	i.ytimg.com
1	yt3.ggpht.com
1	rr4---sn-5hneknee.googlevideo.com
1	s0.2mdn.net	imasdk.googleapis.com
1	region1.google-analytics.com	www.googletagmanager.com
1	www.googletagmanager.com	theparadise.ng
1	api-public.addthis.com	s7.addthis.com
1	www.google.com	tpc.googlesyndication.com
1	id5-sync.com	cdn.id5-sync.com
1	player.ex.co	cdn.mgid.com
1	lb.eu-1-id5-sync.com	cdn.id5-sync.com
1	content.zeotap.com	ads.pubmatic.com
1	m.addthis.com	s7.addthis.com
1	v1.addthisedge.com	s7.addthis.com
1	ads.pubmatic.com	jsc.mgid.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	static.cloudflareinsights.com	theparadise.ng
404	66

This site contains links to these domains. Also see Links.

Domain
news.bitcoin.com
widgets.mgid.com
www.mgid.com
clck.mgid.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-02-21` - `2023-02-20`	a year	crt.sh
odc-addthis-prod-01.oracle.com DigiCert SHA2 Secure Server CA	`2022-02-27` - `2023-02-28`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-06-21` - `2022-09-19`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
*.google.de GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
*.pubmatic.com DigiCert SHA2 Secure Server CA	`2022-02-04` - `2023-02-03`	a year	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2021-11-27` - `2022-11-29`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
*.nl.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-08-02` - `2022-11-01`	3 months	crt.sh
*.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-08-03` - `2022-11-05`	3 months	crt.sh
*.fr.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-07-22` - `2022-10-19`	3 months	crt.sh
*.mgid.com Go Daddy Secure Certificate Authority - G2	`2021-09-13` - `2022-10-15`	a year	crt.sh
*.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-08-27` - `2022-11-22`	3 months	crt.sh
*.eu-1-id5-sync.com R3	`2022-08-18` - `2022-11-16`	3 months	crt.sh
*.ex.co Go Daddy Secure Certificate Authority - G2	`2022-06-06` - `2023-07-08`	a year	crt.sh
*.id5-sync.com R3	`2022-08-18` - `2022-11-16`	3 months	crt.sh
*.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-09-01` - `2022-11-30`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
*.channelexco.com R3	`2022-07-19` - `2022-10-17`	3 months	crt.sh
*.pinterest.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-28` - `2023-08-08`	a year	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-03` - `2022-12-30`	6 months	crt.sh
*.eu.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-08-21` - `2022-11-23`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
cdn.ex.co R3	`2022-08-30` - `2022-11-28`	3 months	crt.sh
*.wibbitz.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-26` - `2023-04-26`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
*.1rx.io Sectigo RSA Domain Validation Secure Server CA	`2022-06-28` - `2023-07-29`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2022-07-21` - `2023-08-21`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
*.c.docs.google.com GTS CA 1C3	`2022-08-30` - `2022-11-08`	2 months	crt.sh
*.googleusercontent.com GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
edgestatic.com GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
*.moatads.com DigiCert TLS RSA SHA256 2020 CA1	`2022-06-13` - `2023-07-05`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-08` - `2023-04-04`	a year	crt.sh

This page contains 30 frames:

Primary Page: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
Frame ID: 06A011E57A1B20848D7DDA355631D5B4
Requests: 137 HTTP requests in this frame

Frame: https://theparadise.ng/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1662940800
Frame ID: 831E4D470BD162725D428FE48D9D5233
Requests: 6 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20190131/zrt_lookup.html
Frame ID: 0741693CEDCC7FA708B2367F102A7830
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&adk=1812271804&adf=1573534164&lmt=1662944682&plat=9%3A32904%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&ea=0&pra=5&wgl=1&easpi=0&asntp=0&asntpv=0&asntpl=0&asntpm=0&asntpc=0&asna=5&asnd=5&asnp=5&asns=5&asmat=1&asptt=-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682168&bpp=4&bdt=707&idt=332&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2084311714587&frm=20&pv=2&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=345
Frame ID: 32CB910F4C6EC0C624AC0338165B0F02
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=1066855964&adk=2012113411&adf=3025194257&pi=t.ma~as.1066855964&w=1200&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682172&bpp=2&bdt=711&idt=353&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=0&ady=0&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CEe%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=szhr95JRuj&p=https%3A//theparadise.ng&dtd=357
Frame ID: 687D33D10B43E9025E7309F5002CC363
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=4144515257&adk=2663840036&adf=854766408&pi=t.ma~as.4144515257&w=1200&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682174&bpp=1&bdt=713&idt=358&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=80&ady=564&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=Deu7fp4Cwk&p=https%3A//theparadise.ng&dtd=359
Frame ID: E122C8C0CF28DC0C9D3A4542182C895E
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=4688317453&adk=887393693&adf=1069411044&pi=t.ma~as.4688317453&w=650&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=650x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682175&bpp=1&bdt=714&idt=361&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1200x280&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=475&ady=2423&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=TIYAGpXXOg&p=https%3A//theparadise.ng&dtd=363
Frame ID: F7055B63B0EB6CD1F0B42654FD5FF630
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=4535970340&adk=4184120110&adf=3764860236&pi=t.ma~as.4535970340&w=650&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=650x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682175&bpp=1&bdt=714&idt=366&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1200x280%2C650x280&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=475&ady=3689&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=0tmyR97qcn&p=https%3A//theparadise.ng&dtd=368
Frame ID: DCBC40D0FFCF958D3D4D786FA13F91BF
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=9162169542&adk=1292089542&adf=140590587&pi=t.ma~as.9162169542&w=650&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=650x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682176&bpp=2&bdt=715&idt=371&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1200x280%2C650x280%2C650x280&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=475&ady=4387&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=UuB3LJuyNN&p=https%3A//theparadise.ng&dtd=373
Frame ID: 0EACE005DEC7AF8B61648B1F94CCA5C8
Requests: 7 HTTP requests in this frame

Frame: https://cm.mgid.com/i-noref.js?cbuster=1662944682726724200446
Frame ID: 0DC46FE8328FB8926D3C62EE80705DA9
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 8206DDACC86A46EADF9DA869EBA36AD4
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 042227DD87AA290DB0829DB527C8C009
Requests: 1 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=Yx6FqgAJd8YHg4UjAAyYqLBZ0wSvcJnf-lCe_w&u=%7ClQoq1dfOb%2FRBHVekhmVLl9EHlznR4HeV5%2FVw9KVb630%3D%7C&c1=0n2XosTo5cmJbNb7DNNVBd09feAUrRU5KgFh9XNQv4JdLNIKaOnb5OzEWkIpq6r1BJdkqejnNl45Kh9Y2SghDV4OirngSybS5PVG-3CU84QQfvquVGjiF09X6ttegZ8PwIg_hBNNhyXn9zcKohx7TTyROZ3rq2yfrBf9O7e61gi_PUKfjUW9Je8AZW-oq9NTuC1FOFsyqj8Bqi8pz6XKbkRBAnwmiy5D_xYP7MSzgp2oOrlXE8moZgo_s71aNFXlxMROW8gR_SPzeAOaGvitkkknrP3RcePLEV9L2MGaELmS4CSiqdj4Bvn-AuGe82xh1fV8GRJ7pmU5FeOsKwctctN9sHW_MepoGoNcKTBTQH9-L9JkQN7xu4q_oqKIVFXMYdr2tVu-Cm8E6mYxlfKJXcm6AwIXVRaYaJKHFx6b9xXuWF7cFJdg9h-nCBJzWpPIdSR7lYiYsVBIsbZrJcmo_4DFTlAzRoNhBiRA3D_lz_FFCRVxMgWIFYrDe6vakBSxntbf7FwyMaeYWI-GbFGX5u9WzMFpXg4ztZ1URrCHfjb0dxK_BtgvDeTZJ1iFjALmDoeUxbbk5jZklG3-p1_ADNfFeR0f33NpTbyjyO-dVqPL1QEjxTna412jT41WVx3AL_SzWGlO5lRgLKhYR6mFig&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCnfwnqoUeY8bvJaOKjuwPqLGy-AnJntKxXL3plfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTExMzI1NTkzODI3NDYwNzOgAdW20uoDyAEJqQKGvsSd3diwPqgDAaoElgJP0EopSCAoaAY8hQl4ehZMQS2NaFO_nimAGWLZ_s4S5J3Qq9_m94O-5F0em8KGE314ks5sEPQ5WQcErij9kObB8ac9o-O6W8atX0BjKUNalaSwPkB4CFQppl0y0ISdAUbB9HVHTaXkMevSbQ42WmB4oGwRaphlrR8mgK5OUNWSZmBmSQlsyjoQnaO0h7VJJeesACpOSnJ1FLJFAwjCBcvdNuD2XTkAsQMK9Fy_7bS8m0OPnWpcSfHSNNSUnnLrgo5jMH7P7trl48olZiqthetIcsg0QXRTmVAeAp9OjIn1IjCIccL-vAS0ec9pfAfiSSClS3Tf0Hbjs4bSnA_ZxBWxuavC4_xnwupYGY83fkmNLRzMotScF4AG752BpNeVrZsboAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2ajRSnfs2Io_dWrCro8zXER7YEpQ%26client%3Dca-pub-1132559382746073%26adurl%3D
Frame ID: 23F97F347836D0193CFF5FB4FE9C1D2D
Requests: 15 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=Yx6FqgAJlooHg4IrAAdXxcm0octc47x47-XP5w&u=%7ClQoq1dfOb%2FRCs1WVswYoxUBBlADJJ%2BgOZ5Rsy9FtK2k%3D%7C&c1=jWCgqsKSUoV3SMf7iUfSyMCnTpn87UHNsuno7AgpGzm4RCiJiIGT5xwGwpq72AA9TknvMwYFTY9kj-FXgmUu6yTRuDX9TXkF7xlK8l4SwJBwAdk7cvCN6uUgm6-RtxofJ7QMqnNALRaxAWo43dn5JkIw1DDcM5R2yBU3-OgHxAN68VzaEp6tK68xNnqBLbKCQATBBE_K_w5blYSc2dbPyEUnvZqbUwEfQReLnH1vZI6dRgS45bD7sVytSHbShS53t5zFExQYBSHN_AQwxv7vHhc5vAwnEA_DEBRvlLokjA-FYMZYVDZ4_kiWYU_JkSP8c6IhiHIerk6t08cr9wGt8rTSjgguio1GRKAfq0sK_wzrH6Yq7annl7FZPoitpdHF5b4hMsSjX5Yjogus4fYkg4eb0Rfc_p1XTjb8j_yBZ0_j4bX7lw6kJIubtlq8Q65Ins7LjMgc9hcLuj8IoUXQGO7sSCxzk6pnx-Kn4NpzSN9MEhFfhTUFAbC-wifIwZc501a0o3gWwKEL7HodDSWGH3mppeZ6LELYk69L9hiDUEtq91kII8L3w1eRwJADNfVtjAVWNMUitZFGnP2j1zvg22bZBTVItJqejLL5JBRTg4cL2X7VhE4Bct8mxdeIzSK26Sd9NmjCG8M&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCvJO4qoUeY4qtJquEjuwPxa-dqAfJntKxXPXalvdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTExMzI1NTkzODI3NDYwNzOgAdW20uoDyAEJqQKGvsSd3diwPqgDAaoEnwJP0EfkYFbBS0_iwdqOqEBQN5H_eB-josPT3vKnkjLZa_BRbOIo6Lln6eK6AHzn8iE7T7Mgi1jHGKv5vOqLti0IFD5XedG1NKEHAGBxEVRAMY2807bqdsfC-NU5aILH1cOAezwKefZgfb8IogKgfTPgKH6NfwajXJUGxAPlG9z6M6Xd5t3Rm8X2w1zrJKVRSO8VOwbkcG4nwl801H4vkm19bNyEX-cPU8SZWscUhb9opuP5XSlGfEyBE0nyQj_aPLByJ9V9DySYT7p6I2S6mdamscK7Nrc6WRG_Ra267c8MMjB4-Wmn5OERW19EiLRfC0FBvZF2HMbZ7Fg7QrsCcHj9xuG15P_MTWRqdY9la_sUMsVrlFNFcgOvYgzLmgf7FYAGir7AjffhgIVuoAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3Dk1Y6wjBjLP_k6LhlUh1x6iecWQ%26client%3Dca-pub-1132559382746073%26adurl%3D
Frame ID: FD365B01979AB8471BFD40974597DE4E
Requests: 22 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=Yx6FqgAJc4AKd_XLAAYWf8V7S2BflfCnd62xdQ&u=%7ClQoq1dfOb%2FR6cb5dTHBQrYlqAVoXdVeb%2Bpw2gYvJQXA%3D%7C&c1=jWCgqsKSUoV3SMf7iUfSyMCnTpn87UHNsuno7AgpGzm4RCiJiIGT5xwGwpq72AA9TknvMwYFTY9kj-FXgmUu6yTRuDX9TXkF7xlK8l4SwJADIg6J8HrXqKu0cqHZbt0UVCydP7DYuzEoQizD-uf2F_MvT0z4aep-lGFMMZgkQ15cyymSejypOk2aMS2-rDZz2a3GhKe-CpGwkIyuxKi5hjXM4i3cuKYikjnz1nrf-KkwNvPhJ9T9qPlWZMQOIQdwbY-bAz21cNBCf5wl-ifG285-nNIvGdQxhJEcDYXrhhO4t6DEfMZX0WhYvGrVWTZNfCA1sWWU4XftEmgBbhEXUARNfcLqZzw6wmp4SB8lLFi3cE6q6YK0JicpwBMNp_pDfl3tRfAl7ghw0L2u6wB0Qt6NEaAdGcgPl6fxGOnfA4Bs6u4Fzj49C2VKuF4PeBG0qDJO267OjiUhQ7Fwygo0zpNXXLniuBWT-jY8tC6SuKrlOTlNnsw5g1-ZxjYZlWXoKVvs_NfgOzCUm4hvJm7ASe60i6Ds5zkJ1VmMZm98xzf5nXAdkaaT2XP3ZmVilpWfeOJCn4BhdJO-GCRj4xvELb7QltVbk09pPcwDxfjMaO0ri6-5wxs9JBUleFnPDIziGMU5vkv9j8o&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC4QaeqoUeY4DnJcvr3wP_rJgoyZ7SsVz16qGGiAHAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItMTEzMjU1OTM4Mjc0NjA3M6AB1bbS6gPIAQmpAoa-xJ3d2LA-qAMBqgSfAk_QRzcgwrtLKk93AMY1cCm20XkSwG6SbR1__lY5Vrah88-UvZDdu8eYR4FZAW1CX7Pw0YQSINA6Qg3eR5-giKbuRvDBng7XmDnz7Kppqp38ii_ivYNfmsEvTmTZWOO2yz_j30AUMIpRsgi-RAUUzqtM5SPRtBddTYbfCzrXIlTBqNcNCluDA5dosv1txD8YpXmmmMhwSxWFhEgLYb3PYJlYSCu3Cmn8x_S8rW1NjBkdzqUdgXAOuMP8a2H8oOCVWaHXAWjMx0WJTJQ51RiKxDmGfZWXZZCgQprx5D-wKW_xQrUZWWCz8lfd7qXaB5-XsOEH0sdSqaKzb1oZ207VmtZh65IKTIhvqgs5UmRgDPXN6y4t9cylCYBQLDe-MghRgAaKvsCN9-GAhW6gBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_1VtjZgS0cUtKOPhbNhu_ppVuaTiA%26client%3Dca-pub-1132559382746073%26adurl%3D
Frame ID: 00506D32C7AE19ABF80BEA6E7FF6911A
Requests: 21 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=Yx6FqgAJeXcKd9IQAAUieeyV3z_nEpTR6LjqAw&u=%7ClQoq1dfOb%2FSGbo238V3dN5wf6glk15D32YOjkWDAOeo%3D%7C&c1=jWCgqsKSUoV3SMf7iUfSyMCnTpn87UHNsuno7AgpGzm4RCiJiIGT5xwGwpq72AA9TknvMwYFTY9kj-FXgmUu6wLDmMWCWg46JM3QschmqKwtptxxWmqKb6qzTMCljyuZ2GgUOH89Ov3375v197aC-_Tb6YxHrCHXHp_JSKgmZXy4TYMmgBV1lm9qfAHpb_taT7ghwV2jRMykP5-1nIn-cLwr_QlCB3eJwTtIT1_tPBuP3R6e-RA82BXzzNtSy-IMm_L2Jo5i8lpDNFvAMApYGfZhN435ptgfg68WuFvy9hIVuOGvb63sYVwPbxV9tWFh4mcAUHP8fjD-Qgaph4xZGYzHg3BJw3ED0HTYBSdKGH-rtyeeiRcYFbMfNDfxTEEAaSAEJr-WPElsYfQrkVrOtrSmwgwBgoyEL1vVYTV4G-dV0k81MbndDJhk0iQPP-8hIPQWm36OBFMrxEPlBSArkeXSRMrhA4kSwme29oQg1zlqIM9ppeQAceV_a1NJaXsjh9p2P26V9u_8jBfy0oUJenudd9miZ9W_pt97glt0XVU3u9IwPkzCac8MYqE-cJ8gifBanmvuP-KcauaGuXoc2NdkceCLIDW0GDafjHRyC7_wzvl1yyx8eQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCnHI4qoUeY_fyJZCk3wP5xJTgDMme0rFc9dqW93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItMTEzMjU1OTM4Mjc0NjA3M6AB1bbS6gPIAQmpAoa-xJ3d2LA-qAMBqgSWAk_QoCa7HSUM0TCjsi1YuZUYBBJ7X2dm0TmSHOY2BAVmGfkX7HMB_Dz7LFDhGDOmA6H54OSA3lx5nTItHqzIs1zMw8Xs-WH0Nrwy5lXdKAVEFs7FLxI0JxR5z38VfRFIdQARAN0T6JKdgNKlhlvCitZ8GospKpOxWfNL6oblccQ0en9_HDr03lsnqpiTWI4A1dgxxLz75UAHS6YA47QggT9EaV2URJ4BGMkfXNUhE4oMI1w1ksL-gLrXwUD7Gy1JPWUlmJN-WDlytv1zk5qmac0LcgErGGmweGah0pEKlDGNEMTwhgO9d8uzay_WW71VCaDtp9sNBoUWFxG75u5Y2vuqOzFzD9jzEiquDn3RHbYktcfle-PsgAbxlqCd9Kjn6TSgBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_0Ox3oAzlwOKJH1YRKQ21DRM5veyQ%26client%3Dca-pub-1132559382746073%26adurl%3D
Frame ID: 1FE86C615908126C2338FA85E1FE453C
Requests: 16 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=Yx6FqgAJn14KixWxAAYTnTk0O1lWlwtwFD_9pw&u=%7ClQoq1dfOb%2FRmY7%2FwFstOHLUeshX1gquhmxorUjqiIkw%3D%7C&c1=0n2XosTo5clc2Y5hvSIf5u071KZSs7iZMd5UVLGq2ZmvHbRs4Z3fqc0q3y5txx2nB_DZC3x01MZ9GaKTJrvjFcrd6uXD2MTWH9FfRIatEpvUzsA7XUvHCd-F0f76Hqc6IrmAtIYYPNRp_HsJLu9B2h_YEMJDX6LWeEMLL8RGK0xtdlcDFr2Y1_Rgr160Jzz4155C7QUgSxlx2e397ncTddZQnjbMlAItp7DWI4HghANnsuLjFVLS7LitUiqRxuqtQA3htIjosMMsJ2UK5TL2CZINLzPOUk-TgNCmL6-CtlTXTQlUU-wrDfa4_g-BnHyn3vWpO7o37uR9tYL_KVxxm29Dq0IQ74cyEknU9FYg9_AJq3g9zFoBFmfxNmlBhUIig1Z7sva5VTmDKY7NAqp5BZlg51_33hF7fbSl32TY8yerPG94w_ixKUIOAcq4dp_y38Ka9jW2jUsrBo9QufXm1s6jxnkABJMdUh7M_08yVIQBJEO_3r2WwHW1npX_gwkL8ZNmBMvbgycEImvwHPuEPiHV7j6EAdpJ3BY75Lo8fWFkVgZQVlc9Rf_NJNgbDS_x_ON6oq9WR8oCuRntvaGmiE0VrMiOAxOiugGpWF__rOnbW0u9XMnzqg&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCSPIgqoUeY96-JrGrrASdp5joCMme0rFcxbKY93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItMTEzMjU1OTM4Mjc0NjA3M6AB1bbS6gPIAQmpAoa-xJ3d2LA-qAMBqgSfAk_QPkfae1V-iDRdBnl8Y-ZDlFNAjdJMEnO3Lpk1PftnOOTL5GGjb62BWJb0dplmkNmzwulXQg05EQLLuJd4Q2bgT0jATrr78nFKikguFHnzRwj27Cq2oKQh5tFnQ9vS4ExgLUSwEgW29EvwM06pqT4v7Ib69ljKPQQ_7hKWWhLBEh57musRi7Vg3we951qfytHKWSZJNE0Ewsx3TJLOYBHiBP3cjSsVqZ8PhuJP8CepEvkTBjLQGoBbLvzuGOs5sLM6zLFYSuLpIWO1_z28uueR35O2VAnMd0O6Yf5LVH6f_xizcnrTvCjOr4gnEdbz1m8gBxS9mApGhePpEuDB7ZHvMhsILzCZRVmJxKAVJfJa09nhJmduiuE4JIICwkDtgAaKvsCN9-GAhW6gBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2tDyvU5wm0FBbe4VLb66pP6PhV0g%26client%3Dca-pub-1132559382746073%26adurl%3D
Frame ID: C4E7B3918F3A5F61B31E1174ED330BC4
Requests: 57 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1
Frame ID: 3C15FB533AA4D3E848844A0BF1092100
Requests: 8 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=Yx6FqgAJdd4Kd_kRAAwBcxLF10f87qKGAJBh_Q&u=%7ClQoq1dfOb%2FQOJQekhhTtJ3Bm4LScJaSSPv1sYuHVSQI%3D%7C&c1=0n2XosTo5clc2Y5hvSIf5j5HfVfFTixGa4yOK3LEx5zye4g5UWBXMcRJXio_xXJwHeKNhiRq3gWBCYy6L4bsHSjdNaU_P4YXfBgQCPQ3ykUSXZ0tOhbUjOmd0zatywb2yEEYKRnqEnBXFMUny7jgeMyK1AnEOzbAgT6_1zeLLqzLkitiyhZhsTQUtLFiIGt2BlLpFXULF1ibbyZRzYM-QRvxuBV2jr2D6BeC2qfcozZdI8YTlwmO6FgUZNDuqpoq4hr3pq6pnwA_fHV-3AIAa7WM_jM6LAF3xPmI-Hv5-AYgubf8FnrFr3SzrBP_rYc88LiewN3PAGVSau2p79ZYeoiM9tlkEci0WEEueFIEJVRxyr93-bQ6qvJnZoXb-oMRz17_vRS388cNhWO_L_Y-U1ixSZi8d6o8JjItz_LZNJzKRCSHStFwr59VMlQp4lxB6YUQrQxINLP2-haWSXwGt2KZMuxBL2A_vEBQ4IObTEvdX30npAal1FN2st3z_TqmCnUj1dkPSVNV19OIi2diC9IbXFyUfmnWnWDZo8JLW8rk8Gp3G41JeDIESkVH-u_tRBwjuhuNmfE8LNawACtwVgggyNNnytEhZlogzWr5P6DrPT4gvfdkgtIZzHEqXJYVVSCvtuqJgwg&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DChaYvqoUeY97rJZHy3wPzgrDABMme0rFcpfyT93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItMTEzMjU1OTM4Mjc0NjA3M6AB1bbS6gPIAQmpAoa-xJ3d2LA-qAMBqgSaAk_QQ4kpVF0hBVuC44l4mDtrT_hB0TF1QrbYbpEtHt15wUs68ReYAtDzLT0a-q0kiEGgN6xHuRupQs8uy4tSrfSs4iaZ1PCT0nfrDWG781FVE_jU45X9BmbCj-Z2lbubZhFvTAkFVKdKqd3k7GIqxT95OkPFTT-8ujEshX19auU-tUN5BTZTzdSFjjcxMvW4NhyhDZ9Rw8ibVlKzLZctIxYpBXa7XR2Mu4T-a6Zg6mRFHGdKc1ZvMkuZ5v5buEFTvgNtaGG0W0Ell2HuMGdQVJtZPpRChC8DDtTTlZC84QH0MN1wILAnEH1_mEvTgQJjTBAqWaPL1lJllejbtNbWO69Z2spQSfrTubigL_qzS-Dwg9CeCdf-ybyUxYAGir7AjffhgIVuoAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1OfnW7yNrYnxhjEf3nXs9iPQiFdA%26client%3Dca-pub-1132559382746073%26adurl%3D
Frame ID: E2992DC26EF900718B123AA0E6D20090
Requests: 36 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: FEF9EA7D15988B8EFE3C8A288A67B817
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 0AD51CD3622A976B695E9A50AF6E499A
Requests: 2 HTTP requests in this frame

Frame: https://cdn.ex.co/player/prebid/pb-7.2.11.js
Frame ID: 0A4624A0E85604B7BA8028530AA17703
Requests: 6 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.529.2_en.html
Frame ID: ECD0F6227EAB88A806D34E518CB0A14A
Requests: 3 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.529.2_en.html
Frame ID: 3AD5749B519FABE473098A4FE9C2B6E1
Requests: 16 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.529.2_en.html
Frame ID: 10411FAD133C281AC1F0E264AC59E10E
Requests: 2 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.529.2_en.html
Frame ID: 865AF612E7C203D84532C8639AD605E4
Requests: 2 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.529.2_en.html
Frame ID: C52022C9CB019ED6ED11AB39D3FFEB48
Requests: 2 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.529.2_en.html
Frame ID: D93EB3228F737800612747B93EDFE9D3
Requests: 2 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/simid/simid_trueview_en.html
Frame ID: B35D5E216EC075580B2A0E45CE39A07E
Requests: 7 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/hhrtBw21.html
Frame ID: 22118171EEDF0B1EFECF54D939107775
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Pakistani Politician Imran Khan’s Instagram Account Used to Promote Crypto Giveaway Scam | The Paradise NewsFacebookTwitterWhatsAppTelegramPinterestLinkedInRedditCopy LinkEmail

Page URL History Show full URLs

https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-gi... HTTP 301
https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-gi... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

AddThis (Widgets) Expand

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Moat (Analytics) Expand

Overall confidence: 100%
Detected patterns

moatads\.com

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

404
Requests

98 %
HTTPS

58 %
IPv6

38
Domains

66
Subdomains

56
IPs

7
Countries

7637 kB
Transfer

19997 kB
Size

17
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://news.bitcoin.com/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
Title: Bitcoin News

Search URL Search Domain Scan URL

URL: https://widgets.mgid.com/?utm_source=theparadise.ng&utm_medium=referral&utm_campaign=widgets&utm_content=1149345

Search URL Search Domain Scan URL

URL: https://www.mgid.com/services/privacy-policy

Search URL Search Domain Scan URL

URL: https://clck.mgid.com/ghits/13801725/i/57482800/0/pp/1/1?h=3hJknWoXpGweR3ILKpsSvxMW55k-MxvZjagBhmf9Q9guQpmCF3Co8LdTP-Q29JNXsgAKWO3Va-OB4FTEe0s23A**&rid=e26ddee8-3236-11ed-9feb-e43d1a2a53a0&tt=Direct&att=3&cpm=1&gbpp=1&abd=1&iv=11&ct=1&gdpr=1&st=120&mp4=1

Search URL Search Domain Scan URL

URL: https://clck.mgid.com/ghits/13480121/i/57482800/0/pp/2/1?h=3hJknWoXpGweR3ILKpsSv5UArztsekGc6gGFh70zWbNHHQyVHmC_OgbN6gO_kyym4dpcxB_14atjGoXcqKNbCA**&rid=e26ddee8-3236-11ed-9feb-e43d1a2a53a0&tt=Direct&att=3&cpm=1&gbpp=1&abd=1&iv=11&ct=1&gdpr=1&st=120&mp4=1

Search URL Search Domain Scan URL

URL: https://clck.mgid.com/ghits/13879884/i/57482800/0/pp/3/1?h=3hJknWoXpGweR3ILKpsSvwi6VZ7ZbSSlMaS4N3jtydMSRS5avzYfRJRvCpGQ1IbmK3CIh-5UAjgIz9DQCRh4Wg**&rid=e26ddee8-3236-11ed-9feb-e43d1a2a53a0&tt=Direct&att=3&cpm=1&gbpp=1&abd=1&iv=11&ct=1&gdpr=1&st=120&mp4=1

Search URL Search Domain Scan URL

URL: https://clck.mgid.com/ghits/13417165/i/57482800/0/pp/4/1?h=3hJknWoXpGweR3ILKpsSv_W3wlSib84R7FXEJX7r73RC0yT2LtiXAk_cLDW1xUEHSAQOm_pSGEt_S_chk_JqqQ**&rid=e26ddee8-3236-11ed-9feb-e43d1a2a53a0&tt=Direct&att=3&cpm=1&gbpp=1&abd=1&iv=11&ct=1&gdpr=1&st=120&mp4=1

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam HTTP 301
https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 112

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Ftheparadise.ng%2F&domain=theparadise.ng&cw=1&lsw=1 HTTP 302
https://mug.criteo.com/sid?cpp=12qKtHxGRitjSGFJeW1iWnpkODBvM1FDK3ZlckNLaUdKNGZPS3FMYTBML1BiT2dDOSszRTJBWjJNQlF3S3R1aEZZbzBmOExZSUN5L1hGMTNwUFdha1c0c3dESnI3WG9VVDJTdS83ek0yYXNFVHhydjNUdTVwa2JxQmhWSTNsYVdtSk93cDNxdndPWEtsUE1EL2orYSs4akZyM2NhaTRyTGpMWHNqeTJmWXlRSWQ1QTVWbHAzTTlnZllRaTQybmhMU1ZnVjVNbkZCeEk4a292UlF1LzlhTU5sTlJUU0xaMHZuVEVRQjdPVTNmNzN6OWs0PXw&cppv=2

404 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
Redirect Chain

https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam
https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/

85 KB
17 KB

1015ms
1014ms

Document
text/html

2606:4700:e2::ac40:8a0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8a0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 38a3fb17959e93e1bb04c3b6242c7fa9ff246d6b5c3aeade07018d4766739ef4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=28800
cf-cache-status: DYNAMIC
cf-ray: 7494bafccde9bb80-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 12 Sep 2022 01:04:41 GMT
expires: Mon, 12 Sep 2022 09:04:40 GMT
link: <https://theparadise.ng/wp-json/>; rel="https://api.w.org/", <https://theparadise.ng/wp-json/wp/v2/posts/566242>; rel="alternate"; type="application/json", <https://theparadise.ng/?p=566242>; rel=shortlink
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T6n02yo3XVP9Zm9nSmaNdTPaDFZLYuTF7wyFHRbdsfTELdNNBW1Yt9B4f4OnD1dzAakLzoSy0YHvFgIgXT76JTjc%2F3ehwRO4b%2FZWwC7fwZ2XTLQsI4WozQoQe2YMiF7Mw1FZ%2Bdl6reRMpLenSw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-endurance-cache-level: 3
x-nginx-cache: WordPress

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=28800
cf-cache-status: DYNAMIC
cf-ray: 7494baf0cd54bb80-FRA
content-type: text/html; charset=UTF-8
date: Mon, 12 Sep 2022 01:04:39 GMT
expires: Mon, 12 Sep 2022 09:04:38 GMT
location: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B7RUdFIYSAiOCUBbpTqGB8WvW7Ai9FwMoTiAPDgUAoSAK2STRkaSS8RmUdTiv2%2F5%2BVMSeur3peBK2iUOF7I8YGnjXhjT4uJZRON0lHL2NYtWfOGB%2B86MlOaKKhw5fy9V%2B7N1EwzCOjKWaP4hZw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-endurance-cache-level: 3
x-nginx-cache: WordPress
x-redirect-by: WordPress

GET
H2 200 style.min.css
theparadise.ng/wp-includes/blocks/navigation/ 14 KB
2 KB 178ms
178ms Stylesheet
text/css 2606:4700:e2::ac40:8a0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://theparadise.ng/wp-includes/blocks/navigation/style.min.css?ver=6.0.2
Requested by: Host: theparadise.ng
URL: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8a0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c98b8bea34034f401295c19aa5ff1cef6b37651837a553f968097e6b9677e0e1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:41 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 12 Jul 2022 18:51:47 GMT
server: cloudflare
vary: Accept-Encoding
x-endurance-cache-level: 1
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sZ8GQudGk22pHOCJerLscHNZ6apqrnxRRPRRHDET60LUJgoh2CiHu5gPRfDogMA6uwA%2BcAnmCF9wt%2FMdQq%2FWhCd%2F%2B%2BFouJFzr7eLzVz3%2Fx3ZgFHPyBfGrUk68joTxbA40nXS5jdW1z%2B7YmP%2Brw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: Wed, 14 Sep 2022 13:28:29 GMT
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 7494bb041a85bb80-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-nginx-cache: WordPress

GET
H2 200 wp-automatic.css
theparadise.ng/wp-content/plugins/wp-automatic/css/ 2 KB
902 B 181ms
181ms Stylesheet
text/css 2606:4700:e2::ac40:8a0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://theparadise.ng/wp-content/plugins/wp-automatic/css/wp-automatic.css?ver=1.0.0
Requested by: Host: theparadise.ng
URL: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8a0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: da26f75773d686f672adddeabc4378a593a11845f01c01dbd2c941744d2ff96a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:41 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-polished: origSize=2713
cf-bgj: minify
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-endurance-cache-level: 1
x-nginx-cache: WordPress
last-modified: Tue, 06 Sep 2022 18:55:38 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W8EZB188CrQAZ1dCV%2BmjTh5pDp3pjBRbO56vE4DOJVW%2FYenW7ZKwr5JdR54wAhVARci9RZeccotAx3SyRJZkQX%2BItaSQ51caRY0caaY3IszsPEPENY6Fc8uoX0CxxPpF2A5%2FtS5dtSuncp3JEw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 7494bb041a87bb80-FRA
expires: Wed, 14 Sep 2022 13:24:22 GMT

GET
H2 200 style.css
theparadise.ng/wp-content/themes/twentytwentytwo/ 2 KB
969 B 184ms
183ms Stylesheet
text/css 2606:4700:e2::ac40:8a0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://theparadise.ng/wp-content/themes/twentytwentytwo/style.css?ver=1.2
Requested by: Host: theparadise.ng
URL: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8a0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 603bc04288269bc556451d7121922b0fe3e069cc02f2b5225f44d42a7116aaa0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:41 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-polished: origSize=5602
cf-bgj: minify
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-endurance-cache-level: 1
x-nginx-cache: WordPress
last-modified: Sun, 29 May 2022 21:52:34 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pbDSojNufvDXhCgWn77Xxq6ImabkqnNEDbwr5QPYYR83GULyv03hdJOBJbA3e4eIRgoIipuW12GG9Rsy8kCHOudP%2Fz5%2BNLoPWv17sHEB5P0DZUXxbDag7oiMOGhbpoKYNh3UMWy3tgZ1rcRgdw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 7494bb041a88bb80-FRA
expires: Wed, 14 Sep 2022 13:28:30 GMT

GET
H2 200 Kevin-200x200-closeup-150x150.png
static.news.bitcoin.com/wp-content/uploads/2016/12/ 28 KB
29 KB 66ms
40ms Image
image/webp 2606:4700::6812:189c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.news.bitcoin.com/wp-content/uploads/2016/12/Kevin-200x200-closeup-150x150.png

Requested by

Host: theparadise.ng
URL: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:189c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a9956b3cf88b957e5d80efac5128ebbe8d6d8919091968f2a337d8a6e73bfaf6

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:41 GMT
via: 1.1 82514a5a8cf35fb3132b0b5ab9cb724c.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-amz-cf-pop: FRA56-P3
cf-polished: origFmt=png, origSize=42385
x-cache: Hit from cloudfront
content-disposition: inline; filename="Kevin-200x200-closeup-150x150.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 28626
last-modified: Fri, 23 Apr 2021 12:06:23 GMT
server: cloudflare
etag: "eccd64e90d7d665d71eceb2827b7d11e"
strict-transport-security: max-age=2592000; includeSubDomains
content-type: image/webp
vary: Accept
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7494bb052ada9a0c-FRA
x-amz-cf-id: j6SokksdwdWfPipb6uxdNPSC1NGzrD9er6YSFXQU0xOh7nlf0fIj6g==
cf-bgj: imgq:100,h2pri

GET
H2 200 rocket-loader.min.js Show response
theparadise.ng/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 12 KB
4 KB 9ms
9ms Script
application/javascript 2606:4700:e2::ac40:8a0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://theparadise.ng/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: theparadise.ng
URL: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:e2::ac40:8a0f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 06 Sep 2022 17:30:56 GMT
server: cloudflare
etag: W/"631783d0-302c"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bxJoby36XaBTEH4W3g2NPvevgHj3OR52MXBVpGOoMprnMscdXrwnLhMtmmSDcSpF9sFIsvf1gvjrckcKuExiZRNysygxAszBmNVZ6y7lb9Ip7uDmY9tITOZF6hnzSg51%2Fd8%2FadxkN6WQr6qXIA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 7494bb050b21bb80-FRA
vary: Accept-Encoding
expires: Wed, 14 Sep 2022 01:04:41 GMT

GET
H2 200 v652eace1692a40cfa3763df669d7439c1639079717194 Show response
static.cloudflareinsights.com/beacon.min.js/ 14 KB
5 KB 83ms
51ms Script
text/javascript 2606:4700:440e::ac40:9c1a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194
Requested by: Host: theparadise.ng
URL: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:440e::ac40:9c1a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505

Request headers

Referer: https://theparadise.ng/
Origin: https://theparadise.ng
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:41 GMT
content-encoding: gzip
last-modified: Thu, 09 Dec 2021 19:55:17 GMT
server: cloudflare
etag: W/2021.12.0
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 7494bb053b2abb91-FRA

GET
H2 200 SourceSerif4Variable-Roman.ttf.woff2
theparadise.ng/wp-content/themes/twentytwentytwo/assets/fonts/source-serif-pro/ 418 KB
419 KB 12ms
12ms Font
font/woff2 2606:4700:e2::ac40:8a0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://theparadise.ng/wp-content/themes/twentytwentytwo/assets/fonts/source-serif-pro/SourceSerif4Variable-Roman.ttf.woff2
Requested by: Host: theparadise.ng
URL: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8a0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bb8c4212414ce2a7887636e1c6eb1fd3ab46e4391226fd39653a2c2abbb17697

Request headers

Referer: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
Origin: https://theparadise.ng
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:41 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 215468
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 428448
x-endurance-cache-level: 1
x-nginx-cache: WordPress
last-modified: Sun, 29 May 2022 21:52:34 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e0UcdqaG4UTMUd%2BrAUxiR4rr1UsPT8Zj%2BH%2Fpu0NaDW5UfS6EwTz5j2hflef0Bvqty35Q3T23C5vaUx6WZwFOSV4OfcHrpnxzOn6A5dlJvyUa22KS4E%2FuQhaYSq%2BqzXI00MiXSyz2opgjScfQhQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 7494bb057bcebb80-FRA
expires: Fri, 16 Sep 2022 12:58:46 GMT

GET
H2 200 SourceSerif4Variable-Italic.ttf.woff2
theparadise.ng/wp-content/themes/twentytwentytwo/assets/fonts/source-serif-pro/ 339 KB
339 KB 178ms
178ms Font
font/woff2 2606:4700:e2::ac40:8a0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://theparadise.ng/wp-content/themes/twentytwentytwo/assets/fonts/source-serif-pro/SourceSerif4Variable-Italic.ttf.woff2
Requested by: Host: theparadise.ng
URL: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8a0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 679552970b131f8ab2f7f5d6202ad8cce0b63b89e110fdb6fa65fb1283fa399b

Request headers

Referer: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
Origin: https://theparadise.ng
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 346840
x-endurance-cache-level: 1
x-nginx-cache: WordPress
last-modified: Sun, 29 May 2022 21:52:34 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h7iKJ3HnHap5S7S3Oo%2Fo4d9uCpG%2B7QdVuG4n1Mj4lijgvZo3UZ8sTDa2lZ11gTVkaBELrKcvtDqjOD4XS%2FB%2BtxD%2FzL9hqVdNVCThxLMf%2BxDTkV9D%2B5oEqLBCyw8R4RbxsU%2BXvoAC7HDUavudrQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 7494bb057bcfbb80-FRA
expires: Wed, 14 Sep 2022 12:55:10 GMT

GET
H2 200 The-Paradise-Logo-370x84-WB-265x60.png
theparadise.ng/wp-content/uploads/ 8 KB
9 KB 195ms
194ms Image
image/png 2606:4700:e2::ac40:8a0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://theparadise.ng/wp-content/uploads/The-Paradise-Logo-370x84-WB-265x60.png
Requested by: Host: theparadise.ng
URL: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8a0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e2f0066effe5a27b9c10762d3e9e7676d20fe1b233807edfe57cbfe1cf234f7e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 8607
x-endurance-cache-level: 1
x-nginx-cache: WordPress
last-modified: Fri, 09 Jul 2021 00:26:25 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Flcc%2BWmwWCsqh4hXrSfi2Qs1Avki5XRmn0A9jyME9YS2KccfYG88nuNjYT8dO5%2F07H3KdMd3ktEwNUOp5ZOwe%2ByE00baYCBC5sMv0fVuVKudVrUqi6pGhMQxxfpcf%2FzP%2BSCYdloPaXHuc8ihCg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 7494bb059becbb80-FRA
expires: Wed, 14 Sep 2022 13:24:23 GMT

GET
H2 200 imran-khan.jpg
static.news.bitcoin.com/wp-content/uploads/2022/08/ 44 KB
44 KB 549ms
548ms Image
image/jpeg 2606:4700::6812:189c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.news.bitcoin.com/wp-content/uploads/2022/08/imran-khan.jpg

Requested by

Host: theparadise.ng
URL: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:189c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a04f3de9dc4c5f5c2c15f8d0c53ddbf00e4457cb2284b4eba082750021818ba8

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
via: 1.1 c3b74c81fdcb7942211a6c721efa13fc.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: MISS
x-amz-cf-pop: FRA2-C1
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 45106
last-modified: Mon, 01 Aug 2022 15:15:56 GMT
server: cloudflare
etag: "af81af513ccd22b7c49b4d083d17e9be"
strict-transport-security: max-age=2592000; includeSubDomains
content-type: image/jpeg
vary: Accept-Encoding
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7494bb059b359a0c-FRA
x-amz-cf-id: UM3jHrv4n0g06rxk4O08_5BQyqtxm4xg6Wwy0tyIYCYtJplSwoeafw==

GET
H2 200 crypto-giveaway-scam-1024x484.jpg
static.news.bitcoin.com/wp-content/uploads/2022/08/ 52 KB
52 KB 34ms
33ms Image
image/jpeg 2606:4700::6812:189c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.news.bitcoin.com/wp-content/uploads/2022/08/crypto-giveaway-scam-1024x484.jpg

Requested by

Host: theparadise.ng
URL: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:189c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

50eb69eb0b73e947ec9408e5a26db2c44af66735117de6d988272e040a952ae7

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:41 GMT
via: 1.1 b6d1611761652d7a383651f2bf480596.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: MISS
x-amz-cf-pop: FRA2-C1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 53260
last-modified: Mon, 01 Aug 2022 15:21:17 GMT
server: cloudflare
etag: "4c155e507faf5c6ef71e714f1beb2847"
strict-transport-security: max-age=2592000; includeSubDomains
content-type: image/jpeg
vary: Accept-Encoding
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7494bb059b389a0c-FRA
x-amz-cf-id: c3tNbbouGHmpbyQP9n8BROWrU_HnBUHj-0wG-iqATnwGF_U9DqcCUQ==

GET
H2 200 image.js Show response
theparadise.ng/wp-content/plugins/featured-image-from-url/includes/html/js/ 2 KB
1 KB 16ms
14ms Script
application/javascript 2606:4700:e2::ac40:8a0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://theparadise.ng/wp-content/plugins/featured-image-from-url/includes/html/js/image.js?ver=4.1.1
Requested by: Host: theparadise.ng
URL: https://theparadise.ng/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8a0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 997b71421e0756e47b32ce8081e9d01ce020361b342900990964262815f889cf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:41 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 108421
cf-polished: origSize=3826
cf-bgj: minify
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-endurance-cache-level: 3
x-nginx-cache: WordPress
last-modified: Sat, 10 Sep 2022 18:52:05 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PhQiB1RN8NiwTp9IvVyaKzzftUnjRlID4if3ZxIPWjgou%2F9XTp25irD0tYOAxY%2FJ3FXvN8hTZGsrYN8W9ak1pQ4JkI42SlQikwNQ8FkVoV2HpA7osDgipGiSt0icbACKjvHB9iLaYCk3O7zO1w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=604800
cf-ray: 7494bb05abf1bb80-FRA
expires: Sat, 17 Sep 2022 18:52:15 GMT

GET
H2 200 addthis_widget.js Show response
s7.addthis.com/js/300/ 353 KB
114 KB 810ms
27ms Script
application/javascript 92.123.36.37
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/js/300/addthis_widget.js

Requested by

Host: theparadise.ng
URL: https://theparadise.ng/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.36.37 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-36-37.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Mon, 26 Oct 2020 18:11:48 GMT
server: nginx/1.15.8
etag: W/"5f971164-5834c"
vary: Accept-Encoding
x-distribution: 99
content-type: application/javascript
cache-control: public, max-age=600
date: Mon, 12 Sep 2022 01:04:42 GMT
x-host: s7.addthis.com
content-length: 116325

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 167 KB
57 KB 171ms
58ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1132559382746073

Requested by

Host: theparadise.ng
URL: https://theparadise.ng/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0eb10d7730724bcef9a3108b0c087ba94e32141e642f05fd7cdc2812ef915fcd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://theparadise.ng/
Origin: https://theparadise.ng
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57945
x-xss-protection: 0
server: cafe
etag: 5473007344932233722
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 12 Sep 2022 01:04:41 GMT

GET
H2 200 theparadise.ng.1149345.js Show response
jsc.mgid.com/t/h/ 2 KB
2 KB 214ms
181ms Script
text/javascript 2606:4700:1::6813:864e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jsc.mgid.com/t/h/theparadise.ng.1149345.js
Requested by: Host: theparadise.ng
URL: https://theparadise.ng/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:1::6813:864e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5b9aecebf9fa8f2edec31f129ab05d66bf08d8a999e72737f9bdbf9eb70fedc1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: BWJMS6VPG42WZPFF
cf-polished: origSize=2496
cf-ray: 7494bb05dbeb9061-FRA
last-modified: Fri, 09 Sep 2022 18:39:39 GMT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: a+YmogqGmou/4ElOUIbYvexPc0zZCUb4f7x89wvfP/UlDISFLWHhJfz/vpa0qfq57EnEg1Q4z9I=
cf-bgj: minify
server: cloudflare
etag: W/"40458c0a121357eab37e82e04d7d2640"
vary: Accept-Encoding
x-amz-version-id: AV.0JHXDwwfeCw4I6yt.N91zgnJezix0
cache-control: public, max-age=10800
content-type: text/javascript
expires: Mon, 12 Sep 2022 04:04:42 GMT

GET
H2 200 theparadise.ng.1319656.js Show response
jsc.mgid.com/t/h/ 2 KB
1 KB 215ms
182ms Script
text/javascript 2606:4700:1::6813:864e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jsc.mgid.com/t/h/theparadise.ng.1319656.js
Requested by: Host: theparadise.ng
URL: https://theparadise.ng/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:1::6813:864e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 394ddb1c211e4f30e56a293bedea06f20f658a8b15a3041d1c48beef3cd55e1e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: 9BWS8SV7800MX94G
cf-polished: origSize=2322
cf-ray: 7494bb05dbec9061-FRA
last-modified: Mon, 06 Jun 2022 19:56:41 GMT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: JpEiUqXwQ6VLNZMUB+srDNQckwAUfJgEVpiyS6gudsZHMKDJ3otK2W9CNNDuyl6mh0kw2Eak1+E=
cf-bgj: minify
server: cloudflare
etag: W/"3674f06292f7d46b54495551edd6b34c"
vary: Accept-Encoding
x-amz-version-id: ztFSMVZIm58HA52LyA5WEsJnwmlx_wAV
cache-control: public, max-age=10800
content-type: text/javascript
expires: Mon, 12 Sep 2022 04:04:42 GMT

GET
H2 200 / Show response
theparadise.ng/ 89 KB
36 KB 1668ms
1666ms Script
application/javascript 2606:4700:e2::ac40:8a0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://theparadise.ng/?local_ga_js=62d7c677a953ca4046de79d7beb2b44c
Requested by: Host: theparadise.ng
URL: https://theparadise.ng/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8a0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c59ff71a892295f7eee9d91a2bc50552a15c7055318535c51ac70231a8c7f57

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-endurance-cache-level: 3
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eM1R6CrE6RjA9QYN%2Br0ObPwT7OHvB4Ofthd4PVr1bGZc%2FRkErIV7knynaKopPwpZEjbu%2BNhNE0MyKxCCbsqhxXCrxEyrzysnyl%2BrAgAlVrKcRMz%2FJAiLTPBRWyUug9C7ssOso1m%2FfuK3OvbzkQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=604800, public, max-age=604800
cf-ray: 7494bb05abfdbb80-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-nginx-cache: WordPress
expires: Mon, 19 Sep 2022 01:04:41 GMT

GET
H2 200 main-front.js Show response
theparadise.ng/wp-content/plugins/wp-automatic/js/ 930 B
664 B 290ms
288ms Script
application/javascript 2606:4700:e2::ac40:8a0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://theparadise.ng/wp-content/plugins/wp-automatic/js/main-front.js?ver=6.0.2
Requested by: Host: theparadise.ng
URL: https://theparadise.ng/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8a0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 73e19401707d030422213eacea81ed13ef140752da1382a534e2e52385425e02

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-polished: origSize=1017
cf-bgj: minify
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-endurance-cache-level: 1
x-nginx-cache: WordPress
last-modified: Tue, 06 Sep 2022 18:55:38 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Pcz8KC3CgZevR1HBjLUf89m41bPbDZYxelrF1GZNQAYPWLMwyXUSvlNvPNmA1EdA9ZeQpRBHZHXLAzuGYHxXSBGtAYZ2pcdjZiioSUtJCLMC7x%2FKM0FVL5z%2B5cCTyk6htrJkwjLig7NGHY2DuA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 7494bb05ac00bb80-FRA
expires: Wed, 14 Sep 2022 12:49:57 GMT

GET
H2 200 jquery-migrate.min.js Show response
theparadise.ng/wp-includes/js/jquery/ 11 KB
5 KB 15ms
14ms Script
application/javascript 2606:4700:e2::ac40:8a0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://theparadise.ng/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by: Host: theparadise.ng
URL: https://theparadise.ng/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8a0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:41 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4516691
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-endurance-cache-level: 1
x-nginx-cache: WordPress
last-modified: Wed, 18 Nov 2020 09:06:06 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tP2MdQiovnGMcjJKN0A5oSS%2BdBr%2Bkd%2FOJuNwPxwLpJ4DK4Lzf37YC%2FWYKgjKVpsiiHO%2BA6%2Bqo%2BwewRPHGetB1Ums%2FLU%2Fw1UYWmaYHYq0EZ2yUBBSShZBC2bgU7WUI1CeCckd8S0g91zgK6xTtg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 7494bb05ac02bb80-FRA
expires: Thu, 06 Apr 2023 07:13:58 GMT

GET
H2 200 jquery.min.js Show response
theparadise.ng/wp-includes/js/jquery/ 87 KB
32 KB 17ms
16ms Script
application/javascript 2606:4700:e2::ac40:8a0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://theparadise.ng/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Requested by: Host: theparadise.ng
URL: https://theparadise.ng/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8a0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:41 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4516691
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-endurance-cache-level: 1
x-nginx-cache: WordPress
last-modified: Wed, 10 Mar 2021 15:07:24 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=93jExLvjjOW1Rz6pf2OBuiG8806LHYaLqiWYuNjRxuE100kgXweOLSoLWUxQKXXdLM1QebYIEacHLHqMFSerm0r0HS%2BF%2Bi5lBAeB8KCYX%2BQz0YZpLi9FWJJkft0y968UCTKdqQZbtdsutZv2FQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 7494bb05ac04bb80-FRA
expires: Thu, 06 Apr 2023 07:13:58 GMT

GET
H2 200 view.min.js Show response
theparadise.ng/wp-includes/blocks/navigation/ 8 KB
3 KB 182ms
181ms Script
application/javascript 2606:4700:e2::ac40:8a0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://theparadise.ng/wp-includes/blocks/navigation/view.min.js?ver=009e29110e016c14bac4ba0ecc809fcd
Requested by: Host: theparadise.ng
URL: https://theparadise.ng/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8a0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 43605db4453aed3c966dda36f501cd25d35d7790e34f4c395c5259e69d89bc19

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 25 May 2022 06:52:10 GMT
server: cloudflare
vary: Accept-Encoding
x-endurance-cache-level: 1
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BIYO0X752P36ZqVeUgjoDZxtz6SpftV4O%2BwfMN04LIjn1RAck2tl7uMNMYJQGPB9%2BTh9fDMSYlPQF58I0EvnaUeaFsmmDW9RkAEg%2Bsnyb5d7d9R03dmP39BXqeMOZ%2Bu87rKHeQ%2BJK3L%2FLoghWA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: Wed, 14 Sep 2022 12:48:19 GMT
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 7494bb05ac06bb80-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-nginx-cache: WordPress

GET
H2 200 invisible.js Show response
theparadise.ng/cdn-cgi/challenge-platform/h/g/scripts/alpha/ Frame 831E 43 KB
15 KB 12ms
12ms Script
application/javascript 2606:4700:e2::ac40:8a0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://theparadise.ng/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1662940800
Requested by: Host: theparadise.ng
URL: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8a0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6b2bb68f2d5799229c28c537ed8df8e997241fcad3e41fb324bfa3bec1fd627f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:41 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c%2B9pgUCOmKGS2rt3eJMqBKTf3m%2BN1QyqXa%2BouR%2BZ7uqiopDC%2BCbe1Ayekpko3sL9VQ9gNDEymnvq4KHoYd6HmH3%2Ff8AC19oA4fPTaX3YLJdGYE5Hyf8VriOpEf%2FaVGkV4JH53yVnbjS9MwUPSA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
x-control-type-options: nosniff
cf-ray: 7494bb05ac07bb80-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 pica.js
theparadise.ng/cdn-cgi/challenge-platform/h/g/scripts/ Frame 831E 18 KB
7 KB 311ms
11ms Other
application/javascript 2606:4700:e2::ac40:8a0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://theparadise.ng/cdn-cgi/challenge-platform/h/g/scripts/pica.js
Requested by: Host: theparadise.ng
URL: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8a0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2318175e8dc599c091942c24bf1464ea62902eb79628cc156dae9865181c2ee0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Vex0Ljub7KNflS%2FdrHfeQSb0KjrXBPuQcGQAPgsfim4powvi3ZsETgTtVv9GqATrBeVGoRP1jPKE0Tv4Hi9TE5fnVpD106PrBmRX9XUPqcjqd0DsnVGPhcT0ceEB9VEnVAp76x437JZY%2FZD07A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
x-control-type-options: nosniff
cf-ray: 7494bb07ad9ebb80-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 wp-emoji-release.min.js Show response
theparadise.ng/wp-includes/js/ 18 KB
5 KB 313ms
13ms Script
application/javascript 2606:4700:e2::ac40:8a0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://theparadise.ng/wp-includes/js/wp-emoji-release.min.js?ver=6.0.2
Requested by: Host: theparadise.ng
URL: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8a0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 142947
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-endurance-cache-level: 1
x-nginx-cache: WordPress
last-modified: Wed, 25 May 2022 06:52:10 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=et%2BOegEAzwKrGpTT85Z7g2As6pxys%2FAYV27k%2B0WApzMxKx2SiOCS3%2Bx2ErJleyd1GF45XyeQs5WSxkCd5lr9NYTWKf75f8We7V0ZThKzznE1%2BTDQfGjok2v%2FARVrVClDoBB86lYASUAT%2FmOLkw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 7494bb08aeadbb80-FRA
expires: Sat, 17 Sep 2022 09:15:16 GMT

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 168 KB
57 KB 137ms
55ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1132559382746073

Requested by

Host: theparadise.ng
URL: https://theparadise.ng/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6a836e4caa35c5fbfb5c9df2eba59dc576ea7a0f8b61fef392379afb4515091d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://theparadise.ng/
Origin: https://theparadise.ng
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57979
x-xss-protection: 0
server: cafe
etag: 15687963367213152449
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 12 Sep 2022 01:04:42 GMT

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 41ms
10ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: theparadise.ng
URL: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

38522a752476d909d673c77f8f7032f870cccd105805c6912cb64e8d7adabc32

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: r1OU50k3JFri3ocTif/k7g==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 1687
x-fb-rlafr: 0
x-fb-debug: stdR3bCsGpcfIcgJn+GWF+UH2f+M6iCdJhfLSPShqfSu5xqh49wVsShLg6ZPfTAYd2pAR6dQHulH+8sPZK5U0Q==
x-fb-trip-id: 686109401
x-fb-content-md5: 7086f8db3b13ca481d5e3433193c256b
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Mon, 12 Sep 2022 01:04:42 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "7a767958892baabeea59ce2e70ae9041"
timing-allow-origin: *
expires: Mon, 12 Sep 2022 01:05:10 GMT

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209080101/ 346 KB
122 KB 135ms
62ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209080101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-1132559382746073&plah=theparadise.ng&bust=31069448

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1132559382746073

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ac0db7e1be7391b35b0b76446bd2382e587554532fabccc9013c3b628002aa38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 124742
x-xss-protection: 0
server: cafe
etag: 14941914626092665458
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 12 Sep 2022 01:04:42 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220907/r20190131/ Frame 0741 10 KB
5 KB 128ms
38ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220907/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1132559382746073

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

de317176fa6b64a8e89bbd45d20b6be2560bbfa96e7e53e63eb754e18bfe6c1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://theparadise.ng/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 34214
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4412
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 11 Sep 2022 15:34:28 GMT
etag: 8616628553774171045
expires: Sun, 25 Sep 2022 15:34:28 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 theparadise.ng.1319656.es6.js Show response
jsc.mgid.com/t/h/ 269 KB
78 KB 57ms
41ms Script
text/javascript 2606:4700:1::6813:864e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jsc.mgid.com/t/h/theparadise.ng.1319656.es6.js
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/t/h/theparadise.ng.1319656.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:1::6813:864e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d29d233f76ff579d16fac45983df41c9050bf997fd0363df821bf3c359d6e999

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: br
cf-cache-status: HIT
age: 3390
cf-polished: origSize=275587
last-modified: Wed, 24 Aug 2022 10:26:04 GMT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: HH2NX88AKV2GAQ46
x-amz-id-2: M8N9W3CIf0d636QHTLFgCLYb6ksux691lD0B5r01c6vka4B2snTRgUDj27V7Pdur3s9bIb3+MS4=
cf-bgj: minify
server: cloudflare
etag: W/"1db627ee674c3f30e4c5e758b802e1fb"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=10800
x-amz-version-id: _ryUEPwELQiK0xEI8XBLXkVOt8yl6h9L
cf-ray: 7494bb07d8919b3d-FRA
expires: Mon, 12 Sep 2022 04:04:42 GMT

GET
H3 200 theparadise.ng.1149345.es6.js Show response
jsc.mgid.com/t/h/ 271 KB
77 KB 43ms
28ms Script
text/javascript 2606:4700:1::6813:864e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jsc.mgid.com/t/h/theparadise.ng.1149345.es6.js
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/t/h/theparadise.ng.1149345.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:1::6813:864e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2fd437b321115eecbf421233c7505e810936746a5ad5684cf233915b1c2f2c5b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: br
cf-cache-status: HIT
age: 4765
cf-polished: origSize=277796
last-modified: Fri, 09 Sep 2022 18:39:39 GMT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: 5C7JKWAJ7GWWM44A
x-amz-id-2: WJBAJzcp1kSYMUuATY0iJOgZqwl0rkdDr+nNYABPofxynx70XkVwPjEVv/STWUTt51zQ0CbyuW0=
cf-bgj: minify
server: cloudflare
etag: W/"c9e53232b3268865b67e1d654a74dad7"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=10800
x-amz-version-id: KEI0O.REoeqV1v_w5AN_KZwoeZeH3Cbc
cf-ray: 7494bb07d8909b3d-FRA
expires: Mon, 12 Sep 2022 04:04:42 GMT

GET
H2 200 mgWidget_1.11.129.es6.js Show response
cdn.mgid.com/js/wglibs/ 342 KB
67 KB 39ms
24ms Script
text/javascript 2606:4700:1::6813:864e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mgid.com/js/wglibs/mgWidget_1.11.129.es6.js
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/t/h/theparadise.ng.1149345.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:1::6813:864e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9a0334d7207042feed4558b710fa3d8e1ede1f47053d01705672807220087c25

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: br
cf-cache-status: HIT
age: 5305
last-modified: Thu, 08 Sep 2022 11:30:19 GMT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: CHYJ4EZPF34PAP4B
x-amz-id-2: YJjiGvPEk52fep1Vy7CyTlb6ehPpMc8uWZyK3Imv2uWKlzQPgwdPWWqMC2W2Xmv6DTbkxAI6mLs=
cf-bgj: minify
server: cloudflare
etag: W/"6bdc208598ba13cfa418af7fef22913a"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-version-id: IUyL9NnciZ891awK4yheI2jBn_EkFENE
cf-ray: 7494bb07dd499061-FRA
expires: Tue, 13 Sep 2022 01:04:42 GMT

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ 303 KB
86 KB 17ms
7ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=b66a83306708d224fec75406ded17087

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

8fdd77e7c517b8587115bfa3cfab2144a0d95b19fc79558864ef11ac935295af

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://theparadise.ng/
Origin: https://theparadise.ng
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: gMXWTduFY8N1HWx6GTN9Yg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 87984
x-fb-rlafr: 0
x-fb-debug: l43MDD37VryHfmjvOLS0H0BkvQOa09QcfYJwk4zVvrmMyqaq57Q4kue974m3vG3y9U6AEKreQghorTxuspwwDQ==
x-fb-content-md5: 06ae73ee282fcfc3f8fc7f332ab64812
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Mon, 12 Sep 2022 01:04:42 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "b42b3ed830b10cde72e3e636674cb93f"
timing-allow-origin: *
priority: u=3,i
expires: Mon, 11 Sep 2023 23:45:22 GMT

POST
H2 200 7494bafccde9bb80 Show response
theparadise.ng/cdn-cgi/challenge-platform/h/g/cv/result/ Frame 831E 2 B
570 B 333ms
33ms XHR
text/plain 2606:4700:e2::ac40:8a0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://theparadise.ng/cdn-cgi/challenge-platform/h/g/cv/result/7494bafccde9bb80
Requested by: Host: theparadise.ng
URL: https://theparadise.ng/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1662940800
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8a0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YCBxLaQ4ik8TzAALaZj9xmy3PSX%2F%2FuWyJsO4GEjIgx%2BwA9%2FDH5zuQu9t%2BkWBKnUKfsje77jxJMzVcSZuQRziwq2v%2BhLzK8QzH9ykfgrav8rH2jGhBBNvm7Wdq6LaLvAH%2FPCdUzp5lXmsZFLc%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 7494bb0b28a0bb80-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
BLOB 200
OK 5b2887fb-1c9c-4459-97c3-5c2d8d74a097
https://theparadise.ng/ 0
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://theparadise.ng/5b2887fb-1c9c-4459-97c3-5c2d8d74a097
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Length: 0
Content-Type: text/javascript

GET
BLOB 200
OK 50a073fd-b73d-45f2-8b63-d0e492c7c170
https://theparadise.ng/ 250 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://theparadise.ng/50a073fd-b73d-45f2-8b63-d0e492c7c170
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e37071398d21f18dff2370ee0885f38811bb69bb465b398100ab3101fc521d6b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Length: 250
Content-Type: text/javascript

GET
BLOB 200
OK 80b8598b-c358-4d8b-9a30-675b975a77db
https://theparadise.ng/ 0
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://theparadise.ng/80b8598b-c358-4d8b-9a30-675b975a77db
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Length: 0
Content-Type: text/javascript

GET
BLOB 200
OK 8cf58df8-0a25-4ba0-9bfc-290d3ee627aa
https://theparadise.ng/ 245 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://theparadise.ng/8cf58df8-0a25-4ba0-9bfc-290d3ee627aa
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d68edf3c87c6a6d87223649e8162ef1584ea6faad6f20e80fdd5f72c21b16a17

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Length: 245
Content-Type: text/javascript

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 218 B
645 B 119ms
38ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=theparadise.ng&callback=_gfp_s_&client=ca-pub-1132559382746073

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209080101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-1132559382746073&plah=theparadise.ng&bust=31069448

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

c5a03868219d7a6ac1f4c3259879f0c2443406c8343eaadf6fd25aa0d23649f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 201
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 133ms
45ms Script
application/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=theparadise.ng

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 128ms
45ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=theparadise.ng

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 32CB 81 KB
15 KB 259ms
180ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&adk=1812271804&adf=1573534164&lmt=1662944682&plat=9%3A32904%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&ea=0&pra=5&wgl=1&easpi=0&asntp=0&asntpv=0&asntpl=0&asntpm=0&asntpc=0&asna=5&asnd=5&asnp=5&asns=5&asmat=1&asptt=-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682168&bpp=4&bdt=707&idt=332&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2084311714587&frm=20&pv=2&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=345

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ebfe24e2e6c120f0298d23124af1da2ab0553d8867c9d19a92fc2fbd371bfea6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://theparadise.ng/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 15259
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 01:04:42 GMT
expires: Mon, 12 Sep 2022 01:04:42 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 687D 23 KB
10 KB 258ms
194ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=1066855964&adk=2012113411&adf=3025194257&pi=t.ma~as.1066855964&w=1200&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682172&bpp=2&bdt=711&idt=353&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=0&ady=0&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CEe%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=szhr95JRuj&p=https%3A//theparadise.ng&dtd=357

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed487cd99bbeef30c3dc7815053457f6c8e843a28e93a5fab274fd53f8a02492

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://theparadise.ng/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 9878
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 01:04:42 GMT
expires: Mon, 12 Sep 2022 01:04:42 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame E122 23 KB
10 KB 227ms
168ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=4144515257&adk=2663840036&adf=854766408&pi=t.ma~as.4144515257&w=1200&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682174&bpp=1&bdt=713&idt=358&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=80&ady=564&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=Deu7fp4Cwk&p=https%3A//theparadise.ng&dtd=359

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

98162403ac312e5006a12e036206eb457cad7908c0cbf999500a6c1af1a1592a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://theparadise.ng/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 9914
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 01:04:42 GMT
expires: Mon, 12 Sep 2022 01:04:42 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame F705 23 KB
10 KB 233ms
178ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=4688317453&adk=887393693&adf=1069411044&pi=t.ma~as.4688317453&w=650&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=650x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682175&bpp=1&bdt=714&idt=361&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1200x280&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=475&ady=2423&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=TIYAGpXXOg&p=https%3A//theparadise.ng&dtd=363

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e8dc228fc68ad646f19ff9bcdd50c6fdb64b14b1daa92fc90e088cb723800a97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://theparadise.ng/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 9898
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 01:04:42 GMT
expires: Mon, 12 Sep 2022 01:04:42 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame DCBC 23 KB
10 KB 219ms
170ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=4535970340&adk=4184120110&adf=3764860236&pi=t.ma~as.4535970340&w=650&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=650x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682175&bpp=1&bdt=714&idt=366&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1200x280%2C650x280&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=475&ady=3689&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=0tmyR97qcn&p=https%3A//theparadise.ng&dtd=368

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bcd70cc8ed4a9eaca7ba3e55009b16fe08c00b13b0fc05a5b661ddddcf596817

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://theparadise.ng/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 9898
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 01:04:42 GMT
expires: Mon, 12 Sep 2022 01:04:42 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 0EAC 23 KB
10 KB 253ms
209ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=9162169542&adk=1292089542&adf=140590587&pi=t.ma~as.9162169542&w=650&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=650x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682176&bpp=2&bdt=715&idt=371&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1200x280%2C650x280%2C650x280&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=475&ady=4387&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=UuB3LJuyNN&p=https%3A//theparadise.ng&dtd=373

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

08506e42ddc6e70f65fd376f6e427a795b7ed072f4ed8c12e120be7dac942313

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://theparadise.ng/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 9872
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 01:04:42 GMT
expires: Mon, 12 Sep 2022 01:04:42 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 / Show response
c.mgid.com/pv/ 0
35 B 122ms
109ms Script
text/plain 2606:4700:1::6813:864e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.mgid.com/pv/?pv=5&cbuster=1662944682593211780290&uniqId=1016c&lct=1661299200&niet=4g&nisd=false&jsv=es6&ref=&cxurl=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&lu=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&sessionId=631e85ab-0918e&pageView=1&pvid=1832f3a2262b44cf367&site=713861&implVersion=11&dpr=1
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/t/h/theparadise.ng.1319656.es6.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:1::6813:864e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7494bb0a5eef9061-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0

GET
BLOB 206
Partial Content 73454e69-916c-4c0a-9738-e552cc8811ef
https://theparadise.ng/ 1 KB
0 Media
video/mp4

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://theparadise.ng/73454e69-916c-4c0a-9738-e552cc8811ef
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 60ddc774c7b5fd0c01d169321a444da403d60c0042f6bee01b0c96f6e1535fda

Request headers

Referer
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Range: bytes=0-

Response headers

Content-Range: bytes 0-1492/1493
Content-Length: 1493
Content-Type: video/mp4

GET
BLOB 206
Partial Content 38f07804-6d55-47da-8858-4034744d7921
https://theparadise.ng/ 1 KB
0 Media
video/mp4

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://theparadise.ng/38f07804-6d55-47da-8858-4034744d7921
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 60ddc774c7b5fd0c01d169321a444da403d60c0042f6bee01b0c96f6e1535fda

Request headers

Referer
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Range: bytes=0-

Response headers

Content-Range: bytes 0-1492/1493
Content-Length: 1493
Content-Type: video/mp4

GET
H3 200 mgid_ua.svg
cdn.mgid.com/images/mgid/ 2 KB
1 KB 22ms
21ms Image
image/svg+xml 2606:4700:1::6813:864e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mgid.com/images/mgid/mgid_ua.svg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:1::6813:864e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 70d5c4de881e718d0b7638959680ba86722d44eecbe4058d20dd77b8d0d97155

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: br
cf-cache-status: HIT
age: 3982
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: 31SG1V0WFRNKXC6R
x-amz-id-2: 2ywp9fgknp8c4HO0Z1cJ5C+4aMUUPCMjGdBA1cI/wAWAxrlaPAi52xxpkj8rcWWqMPvoQLnyl6w=
last-modified: Tue, 08 Mar 2022 17:05:01 GMT
server: cloudflare
x-amz-meta-s3cmd-attrs: atime:1646759091/ctime:1646759091/gid:0/gname:root/md5:617c205137825561208ef7c1a2d8f319/mode:33206/mtime:1646759091/uid:0/uname:root
etag: W/"617c205137825561208ef7c1a2d8f319"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
x-amz-version-id: null
cf-ray: 7494bb0a5abe9b3d-FRA
expires: Tue, 13 Sep 2022 01:04:42 GMT

GET
H3 200 Adchoices.svg
cdn.mgid.com/images/logos/ 836 B
1008 B 21ms
20ms Image
image/svg+xml 2606:4700:1::6813:864e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mgid.com/images/logos/Adchoices.svg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:1::6813:864e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7992a4430843ef8b4bbae534358be3193aa1ae9c78f273e8e8a70b6af1244ac5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: br
cf-cache-status: HIT
age: 1228
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: 31SYWNNYNESPJ6F1
x-amz-id-2: 3myD4nXSsv4qiYMx2Hi56efn2ys0sdKXq9O5ZJG39ML6YXsxmNdK6iip2d5CSfCah3Py/VE8AbU=
last-modified: Wed, 17 Feb 2021 18:15:53 GMT
server: cloudflare
x-amz-meta-s3cmd-attrs: atime:1613585745/ctime:1613585745/gid:0/gname:root/md5:7d59364b7ed2df3f02507c9f92560df9/mode:33206/mtime:1613585745/uid:0/uname:root
etag: W/"7d59364b7ed2df3f02507c9f92560df9"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
x-amz-version-id: null
cf-ray: 7494bb0a5ac09b3d-FRA
expires: Tue, 13 Sep 2022 01:04:42 GMT

GET
H2 200 1 Show response
servicer.mgid.com/1149345/ 9 KB
4 KB 147ms
138ms Script
application/x-javascript 2606:4700:1::6813:864e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://servicer.mgid.com/1149345/1?mp4=1&ap=1&w=1440&h=752&maxw_3=465&maxh_3=343&ident_p=true&cols=3&pv=5&cbuster=1662944682663927646758&uniqId=0b77c&lct=1662681600&niet=4g&nisd=false&jsv=es6&ref=&cxurl=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&lu=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&sessionId=631e85ab-0918e&pageView=1&pvid=1832f3a2262b44cf367&implVersion=11&dpr=1&tfre=909
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/t/h/theparadise.ng.1149345.es6.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:1::6813:864e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 542e163c6693c24ec159bcdcdbe8324ddf224acf5c57d0e6b289c179acc4ce6e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cf-ray: 7494bb0abf219061-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 1 Show response
servicer.mgid.com/1319656/ 4 KB
2 KB 40ms
33ms Script
application/x-javascript 2606:4700:1::6813:864e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://servicer.mgid.com/1319656/1?pv=5&cbuster=1662944682667745932859&uniqId=1016c&lct=1661299200&niet=4g&nisd=false&jsv=es6&mp4=1&ap=1&w=650&h=261&cols=2&ref=&cxurl=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&lu=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&sessionId=631e85ab-0918e&pageView=0&pvid=1832f3a2262b44cf367&implVersion=11&dpr=1
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/t/h/theparadise.ng.1319656.es6.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:1::6813:864e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b0250d69d8fd2f4000885ae9b5d6d9414dfe6b53a1874bf095ef136dd73b2d2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cf-ray: 7494bb0abf209061-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 mgid_ua.svg
cdn.mgid.com/images/mgid/ 2 KB
1 KB 25ms
24ms Image
image/svg+xml 2606:4700:1::6813:864e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mgid.com/images/mgid/mgid_ua.svg
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/t/h/theparadise.ng.1319656.es6.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:1::6813:864e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 70d5c4de881e718d0b7638959680ba86722d44eecbe4058d20dd77b8d0d97155

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: br
cf-cache-status: HIT
age: 3982
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: 31SG1V0WFRNKXC6R
x-amz-id-2: 2ywp9fgknp8c4HO0Z1cJ5C+4aMUUPCMjGdBA1cI/wAWAxrlaPAi52xxpkj8rcWWqMPvoQLnyl6w=
last-modified: Tue, 08 Mar 2022 17:05:01 GMT
server: cloudflare
x-amz-meta-s3cmd-attrs: atime:1646759091/ctime:1646759091/gid:0/gname:root/md5:617c205137825561208ef7c1a2d8f319/mode:33206/mtime:1646759091/uid:0/uname:root
etag: W/"617c205137825561208ef7c1a2d8f319"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
x-amz-version-id: null
cf-ray: 7494bb0afb359b3d-FRA
expires: Tue, 13 Sep 2022 01:04:42 GMT

GET
H3 200 Adchoices.svg
cdn.mgid.com/images/logos/ 836 B
1008 B 23ms
23ms Image
image/svg+xml 2606:4700:1::6813:864e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mgid.com/images/logos/Adchoices.svg
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/t/h/theparadise.ng.1319656.es6.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:1::6813:864e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7992a4430843ef8b4bbae534358be3193aa1ae9c78f273e8e8a70b6af1244ac5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: br
cf-cache-status: HIT
age: 1228
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: 31SYWNNYNESPJ6F1
x-amz-id-2: 3myD4nXSsv4qiYMx2Hi56efn2ys0sdKXq9O5ZJG39ML6YXsxmNdK6iip2d5CSfCah3Py/VE8AbU=
last-modified: Wed, 17 Feb 2021 18:15:53 GMT
server: cloudflare
x-amz-meta-s3cmd-attrs: atime:1613585745/ctime:1613585745/gid:0/gname:root/md5:7d59364b7ed2df3f02507c9f92560df9/mode:33206/mtime:1613585745/uid:0/uname:root
etag: W/"7d59364b7ed2df3f02507c9f92560df9"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
x-amz-version-id: null
cf-ray: 7494bb0afb379b3d-FRA
expires: Tue, 13 Sep 2022 01:04:42 GMT

GET
H2 200 aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHFfYXV0bzpnb29kLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMi0wOS80NDU0NDQvZjhmN...
s-img.mgid.com/g/14044007/492x277/-/ 18 KB
18 KB 39ms
14ms Image
image/webp 2606:4700:1::6813:884e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.mgid.com/g/14044007/492x277/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHFfYXV0bzpnb29kLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMi0wOS80NDU0NDQvZjhmN2JiOTQ2ZjFlMDA4MjQ0NzM4M2Q1ZDU3ZmQzZjcuanBlZw.webp?v=1662944682-kmNUmobFTjXptiwdsAwaAowV23l8nphtUGmRoY_tFpI
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:1::6813:884e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2af72af6936f6950777735f6032cb81720da21f45c75f4b3a08ade2d90750392

Request headers

Referer: https://theparadise.ng/
Origin: https://theparadise.ng
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
cf-cache-status: HIT
last-modified: Sun, 11 Sep 2022 06:27:53 GMT
x-mg-request-uuid: 3b66f0d3-512e-475d-a114-3b00e0a6fa73
age: 66990
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 7494bb0b2c66918f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 18200
server: cloudflare

GET
H2 200 aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHFfYXV0bzpnb29kLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMi0wOC80NjY0ODAvZTAwY...
s-img.mgid.com/g/13879884/492x277/-/ 32 KB
32 KB 45ms
20ms Image
image/webp 2606:4700:1::6813:884e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.mgid.com/g/13879884/492x277/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHFfYXV0bzpnb29kLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMi0wOC80NjY0ODAvZTAwYjFmNWE0ZDA2NDNhZTMyOGQ0ZmQyNWQ4MDQxZDUuanBn.webp?v=1662944682-LFDRxws5PEo3fHyxV4OXu5yeo_HSYJZ61pTrariK7Co
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:1::6813:884e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9b6112851e9cc4d63f1815ff104cbf1fc4bb5bed0d9bddce1638ce9698dc3187

Request headers

Referer: https://theparadise.ng/
Origin: https://theparadise.ng
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
cf-cache-status: HIT
last-modified: Tue, 23 Aug 2022 10:47:32 GMT
x-mg-request-uuid: 33533069-a159-44b5-bdcc-3bb147275b8c
age: 1693030
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 7494bb0b2c68918f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 32256
server: cloudflare

GET
H2 200 aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMi0wMS8zMTAxNDEvM2VlMjMxYTljYTEwYjg5N...
s-img.mgid.com/g/12016681/492x277/-/ 27 KB
28 KB 39ms
15ms Image
image/webp 2606:4700:1::6813:884e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.mgid.com/g/12016681/492x277/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMi0wMS8zMTAxNDEvM2VlMjMxYTljYTEwYjg5N2MxN2Q5MmRkMzhkNDNhODQuanBlZw.webp?v=1662944682-e3fI4XAwzTkVMiZR34K8hl2wxV1ZwHJsJNXPDYSoO-g
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:1::6813:884e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 87464dc935d6ae5d89e78c390a2c0fa004597815ff0debeeeae507e7e8ea652a

Request headers

Referer: https://theparadise.ng/
Origin: https://theparadise.ng
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
cf-cache-status: HIT
last-modified: Wed, 19 Jan 2022 13:52:38 GMT
x-mg-request-uuid: 35f984b0-a55f-44e2-8ec4-4a717296ff93
age: 10773437
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 7494bb0b2c69918f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 27862
server: cloudflare

GET
H2 200 aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHFfYXV0bzpnb29kLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMi0wNC8zNjk0MDMvMWNkY...
s-img.mgid.com/g/12658876/492x277/-/ 5 KB
5 KB 45ms
21ms Image
image/webp 2606:4700:1::6813:884e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.mgid.com/g/12658876/492x277/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHFfYXV0bzpnb29kLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMi0wNC8zNjk0MDMvMWNkYTYzMWQ2MDBlN2M4MGFmZGI2YjU3ODBhODE1NDUuanBn.webp?v=1662944682-R3GuRb_j5dzJgNgTKZJkub3DEIZ_9JKvcsVuWLicOAU
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:1::6813:884e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e96308985f29bbf9d5449c17ccd051289b6bc187015e5a8bbb7aa08ffdf41568

Request headers

Referer: https://theparadise.ng/
Origin: https://theparadise.ng
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
cf-cache-status: HIT
last-modified: Fri, 08 Apr 2022 22:23:57 GMT
x-mg-request-uuid: 3cad7d22-afd4-4a89-9f18-0a56d8358fa3
age: 10773421
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 7494bb0b2c6a918f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 5064
server: cloudflare

GET
H2 200 i.js Show response
cm.mgid.com/ 0
101 B 210ms
201ms Script
application/javascript 2606:4700:1::6813:864e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cm.mgid.com/i.js?&cbuster=1662944682720174188852
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/t/h/theparadise.ng.1319656.es6.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:1::6813:864e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:42 GMT
cf-cache-status: DYNAMIC
server: cloudflare
content-type: application/javascript
cache-control: no-store, no-cache, must-revalidate, max-age=0
cf-ray: 7494bb0b1f539061-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0

GET
H2 200 i-noref.js Show response
cm.mgid.com/ Frame 0DC4 0
37 B 212ms
209ms Script
application/javascript 2606:4700:1::6813:864e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cm.mgid.com/i-noref.js?cbuster=1662944682726724200446
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/t/h/theparadise.ng.1319656.es6.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:1::6813:864e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:42 GMT
cf-cache-status: DYNAMIC
server: cloudflare
content-type: application/javascript
cache-control: no-store, no-cache, must-revalidate, max-age=0
cf-ray: 7494bb0b1f549061-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0

GET
H2 200 pwt.js Show response
ads.pubmatic.com/AdServer/js/pwt/161673/7165/ 209 KB
67 KB 170ms
7ms Script
application/javascript 23.35.236.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/pwt/161673/7165/pwt.js
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/t/h/theparadise.ng.1319656.es6.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-201.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e44c56414d6d7edd75f68e972b2c7161626f82d4d3df26d8b76c237a223c090a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: gzip
last-modified: Tue, 30 Aug 2022 10:48:20 GMT
server: Apache
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=18009
accept-ranges: bytes
content-type: application/javascript
content-length: 68097
expires: Mon, 12 Sep 2022 06:04:51 GMT

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 48 KB
14 KB 52ms
17ms Script
text/javascript 2606:4700:10::6816:3556
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: jsc.mgid.com
URL: https://jsc.mgid.com/t/h/theparadise.ng.1319656.es6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3556 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e85815908064ec7977f13468af609ac980317a21b5b519cfa107948cf76b8ce9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 31 Aug 2022 11:00:45 GMT
server: cloudflare
age: 935
etag: W/"b17c28d6fd88a6b12feea5c52e9a7485"
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-ray: 7494bb0b49a991ef-FRA
x-amz-request-id: QDJ9R5CVV2749CKB
x-amz-id-2: uVNmhB5CKjvW2kk6nRvAAf2zFKzUZJGA7DDEuDmwhdWc2UFdhoWIxBcT17B4tBgSKZtq5vmjCwU=

GET
H2 200 moatframe.js Show response
z.moatads.com/addthismoatframe568911941483/ 2 KB
1 KB 29ms
6ms Script
application/x-javascript 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

unused62: 8096267
date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: gzip
last-modified: Fri, 08 Nov 2019 20:13:52 GMT
server: AmazonS3
x-amz-request-id: D5503D14AA2F06AA
etag: "f14b4e1f799b14f798a195f43cf58376"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=40366
accept-ranges: bytes
content-length: 948
x-amz-id-2: JgalEtxvSAtZmM7+naGfrhsdf0JFS0gJW8lypWF8Tp90EkcPp4c3eAnpK+RDOIL1ltWgpx8wc3s=

GET
H2 200 invisible.js Show response
theparadise.ng/cdn-cgi/challenge-platform/h/g/scripts/alpha/ Frame 831E 38 KB
14 KB 311ms
11ms Script
application/javascript 2606:4700:e2::ac40:8a0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://theparadise.ng/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1662940800
Requested by: Host: theparadise.ng
URL: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8a0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fe9da4900c1a085cf9348e3ca01284c80ecd9306354a5de7945e8cddf6a363a3

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CCpMP8tyORxpjYQRHpD3num7N24obP3T4lcB96Sf5tLzM8W714osoqyGohpPrL8wVd%2FZBlx0DwgBkDdL%2BVzULko%2BFl2lut0KEKYeozdgK%2FPphBPa2r%2Fvh3przoTOw6kuny2V8CbwLcmy96jjqA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
x-control-type-options: nosniff
cf-ray: 7494bb0d4aa7bb80-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 _ate.track.config_resp Show response
v1.addthisedge.com/live/boost/ra-6145be8779bd6091/ 2 KB
751 B 204ms
203ms Script
application/javascript 92.123.36.37
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.addthisedge.com/live/boost/ra-6145be8779bd6091/_ate.track.config_resp
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.36.37 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-36-37.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: ff5e68cab2e192f6e08426122bf74b29b6630e063b6a4034bf44bd8eeeaad69a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: gzip
etag: 957071812--gzip
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: public, max-age=60, s-maxage=86400
content-disposition: attachment; filename=1.txt
content-length: 576

GET
H2 200 300lo.json Show response
m.addthis.com/live/red_lojson/ 89 B
249 B 222ms
197ms Script
application/javascript 92.123.36.37
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://m.addthis.com/live/red_lojson/300lo.json?si=631e85aad6e6cffb&bkl=0&bl=1&pdt=3371&sid=631e85aad6e6cffb&pub=ra-6145be8779bd6091&rev=v8.28.8-wp&ln=en&pc=men&cb=0&ab=-&dp=theparadise.ng&fp=pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fr=&of=0&pd=0&irt=0&vcl=0&md=0&ct=1&tct=0&abt=0&cdn=0&pi=1&rb=0&gen=100&chr=UTF-8&colc=1662944682798&jsl=129&uvs=631e85aa3eb8447b000&skipb=1&callback=addthis.cbs.jsonp__99616002465304270
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.36.37 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-36-37.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6248200e6d69af4443f83d29cb46c1122a1396f1c439c20c4529985d77b9ab26

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:43 GMT
cache-control: max-age=0, no-cache, no-store, no-transform
content-disposition: attachment; filename=1.txt
content-length: 89
content-type: application/javascript;charset=utf-8

GET sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 8206 0
0

GET
H2 200 sh.f48a1a04fe8dbf021b4cda1d.html Show response
s7.addthis.com/static/ Frame 0422 71 KB
26 KB 29ms
28ms Document
text/html 92.123.36.37
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.36.37 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-36-37.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

7b6bfa13f0778c40bb2a00af9819bea2f07afcb4d071e7e4f436196953a5db4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://theparadise.ng/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: public, max-age=86313600
content-encoding: gzip
content-length: 26421
content-type: text/html
date: Mon, 12 Sep 2022 01:04:42 GMT
etag: W/"5f971164-11adc"
last-modified: Mon, 26 Oct 2020 18:11:48 GMT
p3p: CP="NON ADM OUR DEV IND COM STA"
server: nginx/1.15.8
strict-transport-security: max-age=15724800; includeSubDomains
timing-allow-origin: *
vary: Accept-Encoding
x-host: s7.addthis.com

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 52ms
52ms XHR
application/json 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220907&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d17f13b6b582a3ffefd2f20b70f7a913acd78d53f35aa52ecad415f824c195b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11035
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame E122 3 KB
1 KB 178ms
90ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=4144515257&adk=2663840036&adf=854766408&pi=t.ma~as.4144515257&w=1200&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682174&bpp=1&bdt=713&idt=358&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=80&ady=564&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=Deu7fp4Cwk&p=https%3A//theparadise.ng&dtd=359

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 00:38:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1561
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 00:38:41 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E122 141 KB
44 KB 141ms
53ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50f77fa9d32c1323f7e50da8d807f556cdddaea2161de6cf84a0c8b4c1dd6f79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44740
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1662550240112033"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 12 Sep 2022 01:04:42 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame E122 17 KB
8 KB 128ms
40ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e368951bc5918b3d9fbc8205bfdf0d8be8b79da09b457bb113307063f3b1bc89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 00:50:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 875
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7592
x-xss-protection: 0
server: cafe
etag: 7248493764890666469
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 00:50:07 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame DCBC 3 KB
1 KB 175ms
88ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=4535970340&adk=4184120110&adf=3764860236&pi=t.ma~as.4535970340&w=650&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=650x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682175&bpp=1&bdt=714&idt=366&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1200x280%2C650x280&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=475&ady=3689&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=0tmyR97qcn&p=https%3A//theparadise.ng&dtd=368

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 00:38:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1561
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 00:38:41 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame DCBC 141 KB
44 KB 192ms
105ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=4535970340&adk=4184120110&adf=3764860236&pi=t.ma~as.4535970340&w=650&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=650x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682175&bpp=1&bdt=714&idt=366&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1200x280%2C650x280&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=475&ady=3689&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=0tmyR97qcn&p=https%3A//theparadise.ng&dtd=368

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50f77fa9d32c1323f7e50da8d807f556cdddaea2161de6cf84a0c8b4c1dd6f79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44740
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1662550240112033"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 12 Sep 2022 01:04:42 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame DCBC 17 KB
7 KB 132ms
45ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=4535970340&adk=4184120110&adf=3764860236&pi=t.ma~as.4535970340&w=650&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=650x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682175&bpp=1&bdt=714&idt=366&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1200x280%2C650x280&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=475&ady=3689&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=0tmyR97qcn&p=https%3A//theparadise.ng&dtd=368

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e368951bc5918b3d9fbc8205bfdf0d8be8b79da09b457bb113307063f3b1bc89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 00:50:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 875
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7592
x-xss-protection: 0
server: cafe
etag: 7248493764890666469
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 00:50:07 GMT

POST
H2 200 rum Show response
theparadise.ng/cdn-cgi/ 0
233 B 310ms
9ms XHR
text/plain 2606:4700:e2::ac40:8a0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://theparadise.ng/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:e2::ac40:8a0f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
content-type: application/json

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
x-frame-options: DENY
access-control-allow-methods: POST,OPTIONS
content-type: text/plain
access-control-allow-origin: https://theparadise.ng
access-control-max-age: 86400
access-control-allow-credentials: true
cf-ray: 7494bb0d8ad7bb80-FRA
vary: Origin

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame F705 3 KB
1 KB 160ms
89ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=4688317453&adk=887393693&adf=1069411044&pi=t.ma~as.4688317453&w=650&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=650x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682175&bpp=1&bdt=714&idt=361&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1200x280&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=475&ady=2423&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=TIYAGpXXOg&p=https%3A//theparadise.ng&dtd=363

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 00:38:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1561
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 00:38:41 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame F705 17 KB
7 KB 122ms
50ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=4688317453&adk=887393693&adf=1069411044&pi=t.ma~as.4688317453&w=650&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=650x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682175&bpp=1&bdt=714&idt=361&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1200x280&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=475&ady=2423&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=TIYAGpXXOg&p=https%3A//theparadise.ng&dtd=363

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e368951bc5918b3d9fbc8205bfdf0d8be8b79da09b457bb113307063f3b1bc89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 00:50:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 875
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7592
x-xss-protection: 0
server: cafe
etag: 7248493764890666469
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 00:50:07 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F705 141 KB
44 KB 225ms
154ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=4688317453&adk=887393693&adf=1069411044&pi=t.ma~as.4688317453&w=650&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=650x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682175&bpp=1&bdt=714&idt=361&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1200x280&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=475&ady=2423&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=TIYAGpXXOg&p=https%3A//theparadise.ng&dtd=363

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50f77fa9d32c1323f7e50da8d807f556cdddaea2161de6cf84a0c8b4c1dd6f79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44740
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1662550240112033"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 12 Sep 2022 01:04:42 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame E122 0
0 83ms
82ms Fetch
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CCBpjqoUeY8bvJaOKjuwPqLGy-AnJntKxXL3plfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTExMzI1NTkzODI3NDYwNzOgAdW20uoDyAEJqQKGvsSd3diwPqgDAaoEkwJP0EopSCAoaAY8hQl4ehZMQS2NaFO_nimAGWLZ_s4S5J3Qq9_m94O-5F0em8KGE314ks5sEPQ5WQcErij9kObB8ac9o-O6W8atX0BjKUNalaSwPkB4CFQppl0y0ISdAUbB9HVHTaXkMevSbQ42WmB4oGwRaphlrR8mgK5OUNWSZmBmSQlsyjoQnaO0h7VJJeesACpOSnJ1FLJFAwjCBcvdNuD2XTkAsQMK9Fy_7bS8m0OPnWpcSfHSNNSUnnLrgo5jMH7P7trl48olZiqthetIcsg0QXRTmVAeAp9OjIn1IjCIccL-vAS0ec9pfAegSwE3zPtDw8l_pyUCoakhzQG7D6Hs-37TCtf-6zApUlEIh5jfHYAG752BpNeVrZsboAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQIAKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi0xMTMyNTU5MzgyNzQ2MDczGAA&sigh=LyAnYnHMItI&uach_m=[UACH]&cid=CAQSGwCsnQUxnwAuaZQAcnOLe1ITi9lSgVX6XmGulBgB

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=4144515257&adk=2663840036&adf=854766408&pi=t.ma~as.4144515257&w=1200&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682174&bpp=1&bdt=713&idt=358&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=80&ady=564&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=Deu7fp4Cwk&p=https%3A//theparadise.ng&dtd=359
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 12 Sep 2022 01:04:42 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Mon, 12 Sep 2022 01:04:42 GMT

GET
H2 200 notify
rtb.nl.eu.criteo.com/google/auction/ Frame E122 0
0 142ms
15ms Fetch 2a02:2638:1::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.nl.eu.criteo.com/google/auction/notify?profile=14&payload=kPi0Ecz6RLAJmAKdg2ICAgAAAFkdiQ2GuOG3EKmFHmM6KBRbYEwYxSEjIAASAAA&wp=Yx6FqgAJd8YHg4UjAAyYqLBZ0wSvcJnf-lCe_w

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
server: Kestrel
server-processing-duration-in-ticks: 330181
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 23F9 172 KB
53 KB 231ms
88ms Document
text/html 2a02:2638::b
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=Yx6FqgAJd8YHg4UjAAyYqLBZ0wSvcJnf-lCe_w&u=%7ClQoq1dfOb%2FRBHVekhmVLl9EHlznR4HeV5%2FVw9KVb630%3D%7C&c1=0n2XosTo5cmJbNb7DNNVBd09feAUrRU5KgFh9XNQv4JdLNIKaOnb5OzEWkIpq6r1BJdkqejnNl45Kh9Y2SghDV4OirngSybS5PVG-3CU84QQfvquVGjiF09X6ttegZ8PwIg_hBNNhyXn9zcKohx7TTyROZ3rq2yfrBf9O7e61gi_PUKfjUW9Je8AZW-oq9NTuC1FOFsyqj8Bqi8pz6XKbkRBAnwmiy5D_xYP7MSzgp2oOrlXE8moZgo_s71aNFXlxMROW8gR_SPzeAOaGvitkkknrP3RcePLEV9L2MGaELmS4CSiqdj4Bvn-AuGe82xh1fV8GRJ7pmU5FeOsKwctctN9sHW_MepoGoNcKTBTQH9-L9JkQN7xu4q_oqKIVFXMYdr2tVu-Cm8E6mYxlfKJXcm6AwIXVRaYaJKHFx6b9xXuWF7cFJdg9h-nCBJzWpPIdSR7lYiYsVBIsbZrJcmo_4DFTlAzRoNhBiRA3D_lz_FFCRVxMgWIFYrDe6vakBSxntbf7FwyMaeYWI-GbFGX5u9WzMFpXg4ztZ1URrCHfjb0dxK_BtgvDeTZJ1iFjALmDoeUxbbk5jZklG3-p1_ADNfFeR0f33NpTbyjyO-dVqPL1QEjxTna412jT41WVx3AL_SzWGlO5lRgLKhYR6mFig&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCnfwnqoUeY8bvJaOKjuwPqLGy-AnJntKxXL3plfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTExMzI1NTkzODI3NDYwNzOgAdW20uoDyAEJqQKGvsSd3diwPqgDAaoElgJP0EopSCAoaAY8hQl4ehZMQS2NaFO_nimAGWLZ_s4S5J3Qq9_m94O-5F0em8KGE314ks5sEPQ5WQcErij9kObB8ac9o-O6W8atX0BjKUNalaSwPkB4CFQppl0y0ISdAUbB9HVHTaXkMevSbQ42WmB4oGwRaphlrR8mgK5OUNWSZmBmSQlsyjoQnaO0h7VJJeesACpOSnJ1FLJFAwjCBcvdNuD2XTkAsQMK9Fy_7bS8m0OPnWpcSfHSNNSUnnLrgo5jMH7P7trl48olZiqthetIcsg0QXRTmVAeAp9OjIn1IjCIccL-vAS0ec9pfAfiSSClS3Tf0Hbjs4bSnA_ZxBWxuavC4_xnwupYGY83fkmNLRzMotScF4AG752BpNeVrZsboAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2ajRSnfs2Io_dWrCro8zXER7YEpQ%26client%3Dca-pub-1132559382746073%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::b , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

a9ad4f943406d3c79601f097c245a0be9b65b3518335679b6a82f942b92f9884

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 01:04:42 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=X_M6wXpgPkQJ1wHpL8lHPEjeVJMIDemhdlcrUCGIJref3EMO62ZbaMlosECbBurg_OA4gYkFh_VOmCZdMjsOPzy_Gaja78glZGqE1GRQjbMNrg6bs9VmCRARXyemNicxkzsJU_YqdVDmjP_lmqL6b2VwgeKX9W-nm7lUepgpYROdFvEHWCUVHUqNC9tABwrwlHn61-DwL2oHrackamnThiMYVVegiKe5QTiNdRb9w__hry9GYwSnSjL-6jdjSt_Tv_0fkg"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 72430715
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame DCBC 0
0 88ms
88ms Fetch
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C5uDiqoUeY4qtJquEjuwPxa-dqAfJntKxXPXalvdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTExMzI1NTkzODI3NDYwNzOgAdW20uoDyAEJqQKGvsSd3diwPqgDAaoEnAJP0EfkYFbBS0_iwdqOqEBQN5H_eB-josPT3vKnkjLZa_BRbOIo6Lln6eK6AHzn8iE7T7Mgi1jHGKv5vOqLti0IFD5XedG1NKEHAGBxEVRAMY2807bqdsfC-NU5aILH1cOAezwKefZgfb8IogKgfTPgKH6NfwajXJUGxAPlG9z6M6Xd5t3Rm8X2w1zrJKVRSO8VOwbkcG4nwl801H4vkm19bNyEX-cPU8SZWscUhb9opuP5XSlGfEyBE0nyQj_aPLByJ9V9DySYT7p6I2S6mdamscK7Nrc6WRG_Ra267c8MMjB4-Wmn5OERW19EiLRfC0FBvZF2HMab7nmpxTSeY8dh0kJl2Vk0RHBgw4VLc3mg-vjNZuxbXhsqyIjYJYAGir7AjffhgIVuoAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQIAKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi0xMTMyNTU5MzgyNzQ2MDczGAA&sigh=W-7PgGcIKEs&uach_m=[UACH]&cid=CAQSGwCsnQUx8cwHz3hXR0L_Q9W4virJxDpBxbvuixgB

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=4535970340&adk=4184120110&adf=3764860236&pi=t.ma~as.4535970340&w=650&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=650x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682175&bpp=1&bdt=714&idt=366&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1200x280%2C650x280&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=475&ady=3689&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=0tmyR97qcn&p=https%3A//theparadise.ng&dtd=368

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=4535970340&adk=4184120110&adf=3764860236&pi=t.ma~as.4535970340&w=650&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=650x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682175&bpp=1&bdt=714&idt=366&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1200x280%2C650x280&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=475&ady=3689&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=0tmyR97qcn&p=https%3A//theparadise.ng&dtd=368
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 12 Sep 2022 01:04:42 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Mon, 12 Sep 2022 01:04:42 GMT

GET
H2 200 notify
rtb.nl.eu.criteo.com/google/auction/ Frame DCBC 0
0 139ms
15ms Fetch 2a02:2638:1::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.nl.eu.criteo.com/google/auction/notify?profile=14&payload=kJq8Esz6RIoFmAKdg2ICAgAAAC63M6eDZ0j7EKqFHmNHohpsJJo_ZcRH3gASAAA&wp=Yx6FqgAJlooHg4IrAAdXxcm0octc47x47-XP5w

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=4535970340&adk=4184120110&adf=3764860236&pi=t.ma~as.4535970340&w=650&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=650x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682175&bpp=1&bdt=714&idt=366&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1200x280%2C650x280&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=475&ady=3689&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=0tmyR97qcn&p=https%3A//theparadise.ng&dtd=368

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
server: Kestrel
server-processing-duration-in-ticks: 252204
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame FD36 175 KB
50 KB 277ms
137ms Document
text/html 2a02:2638::b
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=Yx6FqgAJlooHg4IrAAdXxcm0octc47x47-XP5w&u=%7ClQoq1dfOb%2FRCs1WVswYoxUBBlADJJ%2BgOZ5Rsy9FtK2k%3D%7C&c1=jWCgqsKSUoV3SMf7iUfSyMCnTpn87UHNsuno7AgpGzm4RCiJiIGT5xwGwpq72AA9TknvMwYFTY9kj-FXgmUu6yTRuDX9TXkF7xlK8l4SwJBwAdk7cvCN6uUgm6-RtxofJ7QMqnNALRaxAWo43dn5JkIw1DDcM5R2yBU3-OgHxAN68VzaEp6tK68xNnqBLbKCQATBBE_K_w5blYSc2dbPyEUnvZqbUwEfQReLnH1vZI6dRgS45bD7sVytSHbShS53t5zFExQYBSHN_AQwxv7vHhc5vAwnEA_DEBRvlLokjA-FYMZYVDZ4_kiWYU_JkSP8c6IhiHIerk6t08cr9wGt8rTSjgguio1GRKAfq0sK_wzrH6Yq7annl7FZPoitpdHF5b4hMsSjX5Yjogus4fYkg4eb0Rfc_p1XTjb8j_yBZ0_j4bX7lw6kJIubtlq8Q65Ins7LjMgc9hcLuj8IoUXQGO7sSCxzk6pnx-Kn4NpzSN9MEhFfhTUFAbC-wifIwZc501a0o3gWwKEL7HodDSWGH3mppeZ6LELYk69L9hiDUEtq91kII8L3w1eRwJADNfVtjAVWNMUitZFGnP2j1zvg22bZBTVItJqejLL5JBRTg4cL2X7VhE4Bct8mxdeIzSK26Sd9NmjCG8M&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCvJO4qoUeY4qtJquEjuwPxa-dqAfJntKxXPXalvdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTExMzI1NTkzODI3NDYwNzOgAdW20uoDyAEJqQKGvsSd3diwPqgDAaoEnwJP0EfkYFbBS0_iwdqOqEBQN5H_eB-josPT3vKnkjLZa_BRbOIo6Lln6eK6AHzn8iE7T7Mgi1jHGKv5vOqLti0IFD5XedG1NKEHAGBxEVRAMY2807bqdsfC-NU5aILH1cOAezwKefZgfb8IogKgfTPgKH6NfwajXJUGxAPlG9z6M6Xd5t3Rm8X2w1zrJKVRSO8VOwbkcG4nwl801H4vkm19bNyEX-cPU8SZWscUhb9opuP5XSlGfEyBE0nyQj_aPLByJ9V9DySYT7p6I2S6mdamscK7Nrc6WRG_Ra267c8MMjB4-Wmn5OERW19EiLRfC0FBvZF2HMbZ7Fg7QrsCcHj9xuG15P_MTWRqdY9la_sUMsVrlFNFcgOvYgzLmgf7FYAGir7AjffhgIVuoAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3Dk1Y6wjBjLP_k6LhlUh1x6iecWQ%26client%3Dca-pub-1132559382746073%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=4535970340&adk=4184120110&adf=3764860236&pi=t.ma~as.4535970340&w=650&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=650x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682175&bpp=1&bdt=714&idt=366&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1200x280%2C650x280&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=475&ady=3689&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=0tmyR97qcn&p=https%3A//theparadise.ng&dtd=368

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::b , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

5f5762b48eeca0a2107c93ea0d7337c9a2d5a27d1d8f8d768b608b7a5be78340

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 01:04:43 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=aA7OunpgPkQJ1wHpv8F9BRTocEzuCIoHsZji5rS0fPnvR2BhXLnq7TqC7KWZyADhdLrJoNtHz4PEUeK4RF3rBP4wvlQdc7aQzNLb89q04IAWsDnzXTG3wQTHCjmwKxyrHL1sNi9W0w3M7kTPMwZkXFuMZWTLEKJaildCjOM1Eh-sjNhWggVYWN6fQ4yEeTnAScMjV0LZA8Nj0Ir95azePxjBdgqTs38WdmgwniARks_85PrT_hBxacPAPQ8"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 116474045
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame 687D 3 KB
1 KB 154ms
92ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=1066855964&adk=2012113411&adf=3025194257&pi=t.ma~as.1066855964&w=1200&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682172&bpp=2&bdt=711&idt=353&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=0&ady=0&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CEe%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=szhr95JRuj&p=https%3A//theparadise.ng&dtd=357

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 00:38:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1561
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 00:38:41 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 687D 141 KB
44 KB 195ms
133ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50f77fa9d32c1323f7e50da8d807f556cdddaea2161de6cf84a0c8b4c1dd6f79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44740
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1662550240112033"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 12 Sep 2022 01:04:42 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame 687D 17 KB
7 KB 138ms
76ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e368951bc5918b3d9fbc8205bfdf0d8be8b79da09b457bb113307063f3b1bc89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 00:50:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 875
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7592
x-xss-protection: 0
server: cafe
etag: 7248493764890666469
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 00:50:07 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame 0EAC 3 KB
1 KB 152ms
90ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=9162169542&adk=1292089542&adf=140590587&pi=t.ma~as.9162169542&w=650&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=650x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682176&bpp=2&bdt=715&idt=371&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1200x280%2C650x280%2C650x280&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=475&ady=4387&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=UuB3LJuyNN&p=https%3A//theparadise.ng&dtd=373

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 00:38:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1561
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 00:38:41 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame 0EAC 17 KB
7 KB 143ms
81ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e368951bc5918b3d9fbc8205bfdf0d8be8b79da09b457bb113307063f3b1bc89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 00:50:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 875
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7592
x-xss-protection: 0
server: cafe
etag: 7248493764890666469
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 00:50:07 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0EAC 141 KB
44 KB 222ms
160ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50f77fa9d32c1323f7e50da8d807f556cdddaea2161de6cf84a0c8b4c1dd6f79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44740
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1662550240112033"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 12 Sep 2022 01:04:42 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame F705 0
0 85ms
84ms Fetch
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=ChWVeqoUeY4DnJcvr3wP_rJgoyZ7SsVz16qGGiAHAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItMTEzMjU1OTM4Mjc0NjA3M6AB1bbS6gPIAQmpAoa-xJ3d2LA-qAMBqgScAk_QRzcgwrtLKk93AMY1cCm20XkSwG6SbR1__lY5Vrah88-UvZDdu8eYR4FZAW1CX7Pw0YQSINA6Qg3eR5-giKbuRvDBng7XmDnz7Kppqp38ii_ivYNfmsEvTmTZWOO2yz_j30AUMIpRsgi-RAUUzqtM5SPRtBddTYbfCzrXIlTBqNcNCluDA5dosv1txD8YpXmmmMhwSxWFhEgLYb3PYJlYSCu3Cmn8x_S8rW1NjBkdzqUdgXAOuMP8a2H8oOCVWaHXAWjMx0WJTJQ51RiKxDmGfZWXZZCgQprx5D-wKW_xQrUZWWCz8lfd7qXaB5-XsOEH0sdSqeCxTsieVNLGJUp1SEI36nBmvgGPWEp4jkEF1ojfStKJEQX6qCQBgAaKvsCN9-GAhW6gBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBAgAoB-gsCCAGADAHQFQGAFwGyFxoKGBIUcHViLTExMzI1NTkzODI3NDYwNzMYAA&sigh=zLhkcgvGLcU&uach_m=[UACH]&cid=CAQSGwCsnQUxXHGXarud7AfzUh7vg5dzk0noP3f1lhgB

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=4688317453&adk=887393693&adf=1069411044&pi=t.ma~as.4688317453&w=650&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=650x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682175&bpp=1&bdt=714&idt=361&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1200x280&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=475&ady=2423&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=TIYAGpXXOg&p=https%3A//theparadise.ng&dtd=363

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=4688317453&adk=887393693&adf=1069411044&pi=t.ma~as.4688317453&w=650&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=650x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682175&bpp=1&bdt=714&idt=361&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1200x280&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=475&ady=2423&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=TIYAGpXXOg&p=https%3A//theparadise.ng&dtd=363
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 12 Sep 2022 01:04:42 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Mon, 12 Sep 2022 01:04:42 GMT

GET
H2 200 notify
rtb.fr.eu.criteo.com/google/auction/ Frame F705 0
0 200ms
15ms Fetch 2a02:2638::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.fr.eu.criteo.com/google/auction/notify?profile=14&payload=kJq8Esz6RIoFmAKdg2ICAgAAALuSuRAspeFlEKqFHmO5aPRUb5PItuZ6XQASAAA&wp=Yx6FqgAJc4AKd_XLAAYWf8V7S2BflfCnd62xdQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=4688317453&adk=887393693&adf=1069411044&pi=t.ma~as.4688317453&w=650&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=650x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682175&bpp=1&bdt=714&idt=361&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1200x280&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=475&ady=2423&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=TIYAGpXXOg&p=https%3A//theparadise.ng&dtd=363

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
server: Kestrel
server-processing-duration-in-ticks: 235593
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 0050 172 KB
49 KB 264ms
129ms Document
text/html 2a02:2638::b
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=Yx6FqgAJc4AKd_XLAAYWf8V7S2BflfCnd62xdQ&u=%7ClQoq1dfOb%2FR6cb5dTHBQrYlqAVoXdVeb%2Bpw2gYvJQXA%3D%7C&c1=jWCgqsKSUoV3SMf7iUfSyMCnTpn87UHNsuno7AgpGzm4RCiJiIGT5xwGwpq72AA9TknvMwYFTY9kj-FXgmUu6yTRuDX9TXkF7xlK8l4SwJADIg6J8HrXqKu0cqHZbt0UVCydP7DYuzEoQizD-uf2F_MvT0z4aep-lGFMMZgkQ15cyymSejypOk2aMS2-rDZz2a3GhKe-CpGwkIyuxKi5hjXM4i3cuKYikjnz1nrf-KkwNvPhJ9T9qPlWZMQOIQdwbY-bAz21cNBCf5wl-ifG285-nNIvGdQxhJEcDYXrhhO4t6DEfMZX0WhYvGrVWTZNfCA1sWWU4XftEmgBbhEXUARNfcLqZzw6wmp4SB8lLFi3cE6q6YK0JicpwBMNp_pDfl3tRfAl7ghw0L2u6wB0Qt6NEaAdGcgPl6fxGOnfA4Bs6u4Fzj49C2VKuF4PeBG0qDJO267OjiUhQ7Fwygo0zpNXXLniuBWT-jY8tC6SuKrlOTlNnsw5g1-ZxjYZlWXoKVvs_NfgOzCUm4hvJm7ASe60i6Ds5zkJ1VmMZm98xzf5nXAdkaaT2XP3ZmVilpWfeOJCn4BhdJO-GCRj4xvELb7QltVbk09pPcwDxfjMaO0ri6-5wxs9JBUleFnPDIziGMU5vkv9j8o&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC4QaeqoUeY4DnJcvr3wP_rJgoyZ7SsVz16qGGiAHAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItMTEzMjU1OTM4Mjc0NjA3M6AB1bbS6gPIAQmpAoa-xJ3d2LA-qAMBqgSfAk_QRzcgwrtLKk93AMY1cCm20XkSwG6SbR1__lY5Vrah88-UvZDdu8eYR4FZAW1CX7Pw0YQSINA6Qg3eR5-giKbuRvDBng7XmDnz7Kppqp38ii_ivYNfmsEvTmTZWOO2yz_j30AUMIpRsgi-RAUUzqtM5SPRtBddTYbfCzrXIlTBqNcNCluDA5dosv1txD8YpXmmmMhwSxWFhEgLYb3PYJlYSCu3Cmn8x_S8rW1NjBkdzqUdgXAOuMP8a2H8oOCVWaHXAWjMx0WJTJQ51RiKxDmGfZWXZZCgQprx5D-wKW_xQrUZWWCz8lfd7qXaB5-XsOEH0sdSqaKzb1oZ207VmtZh65IKTIhvqgs5UmRgDPXN6y4t9cylCYBQLDe-MghRgAaKvsCN9-GAhW6gBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_1VtjZgS0cUtKOPhbNhu_ppVuaTiA%26client%3Dca-pub-1132559382746073%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=4688317453&adk=887393693&adf=1069411044&pi=t.ma~as.4688317453&w=650&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=650x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682175&bpp=1&bdt=714&idt=361&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1200x280&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=475&ady=2423&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=TIYAGpXXOg&p=https%3A//theparadise.ng&dtd=363

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::b , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

f90a15e43e6aeef1a63d364e23c81c24868e3866212bfd743ff4338cb25c3e21

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 01:04:42 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=cRwlzXpgPkQJ1wHpxir6UmFlN9ZuW9LyWoX4NocbhddO01aC1U_qW6NofFQ-pmF6BHQZOuQeeOQ-0e0Sbk0iqcY2FFzLc8JJ-F-42cQ6HEdkn0k1qBf63HNZltHrGB9EuCdi2CaqMLuzi_NQFHZ0UPhkzkBvTMw_wLA5EWLf7mfMI1Q14SDBUAjD5Hg7TP4MZ0_jV5dDC-gcyQwr_UDx98s1D0zoLtmM72QBxm-RsVaV1xQDfwZ8PiBT_Ik"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 96630278
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 687D 0
0 89ms
89ms Fetch
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CvaeyqoUeY_fyJZCk3wP5xJTgDMme0rFc9dqW93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItMTEzMjU1OTM4Mjc0NjA3M6AB1bbS6gPIAQmpAoa-xJ3d2LA-qAMBqgSTAk_QoCa7HSUM0TCjsi1YuZUYBBJ7X2dm0TmSHOY2BAVmGfkX7HMB_Dz7LFDhGDOmA6H54OSA3lx5nTItHqzIs1zMw8Xs-WH0Nrwy5lXdKAVEFs7FLxI0JxR5z38VfRFIdQARAN0T6JKdgNKlhlvCitZ8GospKpOxWfNL6oblccQ0en9_HDr03lsnqpiTWI4A1dgxxLz75UAHS6YA47QggT9EaV2URJ4BGMkfXNUhE4oMI1w1ksL-gLrXwUD7Gy1JPWUlmJN-WDlytv1zk5qmac0LcgErGGmweGah0pEKlDGNEMTwhgO9d8uzay_WW_9XKDJqKEceuRkCtMGGQBZRzvEcMR9rjWw7L4xcsWP9BTOOMdRagAbxlqCd9Kjn6TSgBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBAgAoB-gsCCAGADAHQFQGAFwGyFxoKGBIUcHViLTExMzI1NTkzODI3NDYwNzMYAA&sigh=pdNhj9n3118&uach_m=[UACH]&cid=CAQSGwCsnQUxIBm1nmiwOfmvvCs3am3StTid9UaFZhgB

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=1066855964&adk=2012113411&adf=3025194257&pi=t.ma~as.1066855964&w=1200&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682172&bpp=2&bdt=711&idt=353&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=0&ady=0&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CEe%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=szhr95JRuj&p=https%3A//theparadise.ng&dtd=357
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 12 Sep 2022 01:04:42 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Mon, 12 Sep 2022 01:04:42 GMT

GET
H2 200 notify
rtb.fr.eu.criteo.com/google/auction/ Frame 687D 0
0 187ms
16ms Fetch 2a02:2638::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.fr.eu.criteo.com/google/auction/notify?profile=14&payload=kIDhCcz6RLAJmAKdg2ICAgAAAI_cZ6TdIzqREKqFHmPWqVWszLr4DOTYxwASAAA&wp=Yx6FqgAJeXcKd9IQAAUieeyV3z_nEpTR6LjqAw

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
server: Kestrel
server-processing-duration-in-ticks: 400820
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 1FE8 119 KB
43 KB 236ms
115ms Document
text/html 2a02:2638::b
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=Yx6FqgAJeXcKd9IQAAUieeyV3z_nEpTR6LjqAw&u=%7ClQoq1dfOb%2FSGbo238V3dN5wf6glk15D32YOjkWDAOeo%3D%7C&c1=jWCgqsKSUoV3SMf7iUfSyMCnTpn87UHNsuno7AgpGzm4RCiJiIGT5xwGwpq72AA9TknvMwYFTY9kj-FXgmUu6wLDmMWCWg46JM3QschmqKwtptxxWmqKb6qzTMCljyuZ2GgUOH89Ov3375v197aC-_Tb6YxHrCHXHp_JSKgmZXy4TYMmgBV1lm9qfAHpb_taT7ghwV2jRMykP5-1nIn-cLwr_QlCB3eJwTtIT1_tPBuP3R6e-RA82BXzzNtSy-IMm_L2Jo5i8lpDNFvAMApYGfZhN435ptgfg68WuFvy9hIVuOGvb63sYVwPbxV9tWFh4mcAUHP8fjD-Qgaph4xZGYzHg3BJw3ED0HTYBSdKGH-rtyeeiRcYFbMfNDfxTEEAaSAEJr-WPElsYfQrkVrOtrSmwgwBgoyEL1vVYTV4G-dV0k81MbndDJhk0iQPP-8hIPQWm36OBFMrxEPlBSArkeXSRMrhA4kSwme29oQg1zlqIM9ppeQAceV_a1NJaXsjh9p2P26V9u_8jBfy0oUJenudd9miZ9W_pt97glt0XVU3u9IwPkzCac8MYqE-cJ8gifBanmvuP-KcauaGuXoc2NdkceCLIDW0GDafjHRyC7_wzvl1yyx8eQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCnHI4qoUeY_fyJZCk3wP5xJTgDMme0rFc9dqW93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItMTEzMjU1OTM4Mjc0NjA3M6AB1bbS6gPIAQmpAoa-xJ3d2LA-qAMBqgSWAk_QoCa7HSUM0TCjsi1YuZUYBBJ7X2dm0TmSHOY2BAVmGfkX7HMB_Dz7LFDhGDOmA6H54OSA3lx5nTItHqzIs1zMw8Xs-WH0Nrwy5lXdKAVEFs7FLxI0JxR5z38VfRFIdQARAN0T6JKdgNKlhlvCitZ8GospKpOxWfNL6oblccQ0en9_HDr03lsnqpiTWI4A1dgxxLz75UAHS6YA47QggT9EaV2URJ4BGMkfXNUhE4oMI1w1ksL-gLrXwUD7Gy1JPWUlmJN-WDlytv1zk5qmac0LcgErGGmweGah0pEKlDGNEMTwhgO9d8uzay_WW71VCaDtp9sNBoUWFxG75u5Y2vuqOzFzD9jzEiquDn3RHbYktcfle-PsgAbxlqCd9Kjn6TSgBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_0Ox3oAzlwOKJH1YRKQ21DRM5veyQ%26client%3Dca-pub-1132559382746073%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::b , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

6c0166d05b31e52fac21f8f56c009640f561ded3f56543c9825a149e9ab570ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 01:04:42 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=p9Eyp3pgPkQJ1wHp9TRCKjlD3xxFA1P_TIFw83NFM3S5M0J-G8hryFivMgCaJy1sVLxOUbfDSncdXAy-o3K4NlCSS-CVfKtZf-S_ty4uo4Y2nRJeh-XeozMVbAZd4Pqw-LFokamZPCg-6v1VzS4CntMjNXCWaUWc6BEMtx3C814q_jgonVl_tQyXL-KzhEWNfwiUw402RtzF-3O7KCSA47NcWCQZYQSkHbzZQptPGwhpkCrxMxmpTHwbIAkxYxUMskPMPA"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 91247394
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 0EAC 0
0 89ms
88ms Fetch
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CjFN9qoUeY96-JrGrrASdp5joCMme0rFcxbKY93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItMTEzMjU1OTM4Mjc0NjA3M6AB1bbS6gPIAQmpAoa-xJ3d2LA-qAMBqgScAk_QPkfae1V-iDRdBnl8Y-ZDlFNAjdJMEnO3Lpk1PftnOOTL5GGjb62BWJb0dplmkNmzwulXQg05EQLLuJd4Q2bgT0jATrr78nFKikguFHnzRwj27Cq2oKQh5tFnQ9vS4ExgLUSwEgW29EvwM06pqT4v7Ib69ljKPQQ_7hKWWhLBEh57musRi7Vg3we951qfytHKWSZJNE0Ewsx3TJLOYBHiBP3cjSsVqZ8PhuJP8CepEvkTBjLQGoBbLvzuGOs5sLM6zLFYSuLpIWO1_z28uueR35O2VAnMd0O6Yf5LVH6f_xizcnrTvCjOr4gnEdbz1m8gBxS9mEhEpHFunXzSUg37kcs1iciQUVM_zo4Np0aS7n8TmXlCkmSSoJG9gAaKvsCN9-GAhW6gBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBAgAoB-gsCCAGADAHQFQGAFwGyFxoKGBIUcHViLTExMzI1NTkzODI3NDYwNzMYAA&sigh=uc2aPmewg48&uach_m=[UACH]&cid=CAQSGwCsnQUxw6o0M5xbBeyBCJLCtUzDPvIpeTvmkhgB

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=9162169542&adk=1292089542&adf=140590587&pi=t.ma~as.9162169542&w=650&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=650x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682176&bpp=2&bdt=715&idt=371&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1200x280%2C650x280%2C650x280&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=475&ady=4387&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=UuB3LJuyNN&p=https%3A//theparadise.ng&dtd=373
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 12 Sep 2022 01:04:42 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Mon, 12 Sep 2022 01:04:42 GMT

GET
H2 200 notify
rtb.fr.eu.criteo.com/google/auction/ Frame 0EAC 0
0 182ms
16ms Fetch 2a02:2638::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.fr.eu.criteo.com/google/auction/notify?profile=14&payload=kJq8Esz6RIoFmAKdg2ICAgAAALSZNUn6CpcdEKqFHmO05Uz9JWz7_vBixgASAAA&wp=Yx6FqgAJn14KixWxAAYTnTk0O1lWlwtwFD_9pw

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
server: Kestrel
server-processing-duration-in-ticks: 313323
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame C4E7 198 KB
55 KB 262ms
146ms Document
text/html 2a02:2638::b
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=Yx6FqgAJn14KixWxAAYTnTk0O1lWlwtwFD_9pw&u=%7ClQoq1dfOb%2FRmY7%2FwFstOHLUeshX1gquhmxorUjqiIkw%3D%7C&c1=0n2XosTo5clc2Y5hvSIf5u071KZSs7iZMd5UVLGq2ZmvHbRs4Z3fqc0q3y5txx2nB_DZC3x01MZ9GaKTJrvjFcrd6uXD2MTWH9FfRIatEpvUzsA7XUvHCd-F0f76Hqc6IrmAtIYYPNRp_HsJLu9B2h_YEMJDX6LWeEMLL8RGK0xtdlcDFr2Y1_Rgr160Jzz4155C7QUgSxlx2e397ncTddZQnjbMlAItp7DWI4HghANnsuLjFVLS7LitUiqRxuqtQA3htIjosMMsJ2UK5TL2CZINLzPOUk-TgNCmL6-CtlTXTQlUU-wrDfa4_g-BnHyn3vWpO7o37uR9tYL_KVxxm29Dq0IQ74cyEknU9FYg9_AJq3g9zFoBFmfxNmlBhUIig1Z7sva5VTmDKY7NAqp5BZlg51_33hF7fbSl32TY8yerPG94w_ixKUIOAcq4dp_y38Ka9jW2jUsrBo9QufXm1s6jxnkABJMdUh7M_08yVIQBJEO_3r2WwHW1npX_gwkL8ZNmBMvbgycEImvwHPuEPiHV7j6EAdpJ3BY75Lo8fWFkVgZQVlc9Rf_NJNgbDS_x_ON6oq9WR8oCuRntvaGmiE0VrMiOAxOiugGpWF__rOnbW0u9XMnzqg&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCSPIgqoUeY96-JrGrrASdp5joCMme0rFcxbKY93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItMTEzMjU1OTM4Mjc0NjA3M6AB1bbS6gPIAQmpAoa-xJ3d2LA-qAMBqgSfAk_QPkfae1V-iDRdBnl8Y-ZDlFNAjdJMEnO3Lpk1PftnOOTL5GGjb62BWJb0dplmkNmzwulXQg05EQLLuJd4Q2bgT0jATrr78nFKikguFHnzRwj27Cq2oKQh5tFnQ9vS4ExgLUSwEgW29EvwM06pqT4v7Ib69ljKPQQ_7hKWWhLBEh57musRi7Vg3we951qfytHKWSZJNE0Ewsx3TJLOYBHiBP3cjSsVqZ8PhuJP8CepEvkTBjLQGoBbLvzuGOs5sLM6zLFYSuLpIWO1_z28uueR35O2VAnMd0O6Yf5LVH6f_xizcnrTvCjOr4gnEdbz1m8gBxS9mApGhePpEuDB7ZHvMhsILzCZRVmJxKAVJfJa09nhJmduiuE4JIICwkDtgAaKvsCN9-GAhW6gBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2tDyvU5wm0FBbe4VLb66pP6PhV0g%26client%3Dca-pub-1132559382746073%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::b , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

8a74c30a88646490e535001de72cb793563fef52b94c748adb90f03aa219201c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 01:04:43 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=sf5Av3pgPkQJ1wHpJSBG6SRCu48VrtS_szLR1RAoPvrFzUnKay7MRizEKYvvQBBupLRZNJ_EMODqYZ4hsLUKLPIdmsY2BWZRolm_cD1JOKv3Kg-4rk6Kad879uxykEWQUiU4TSKnMD3ycLNWJP0kis85XRI3NCi127c_M0Yer4kd7eSFOU5mjw3IhrKAAtIlsWfi1hmRJITs-G6l99M4WzQxv1-GzA2y5GtlVG4MzqndqPNDQ3yxgJWXgpg"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 130110373
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209080101/ 149 KB
53 KB 54ms
53ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209080101/reactive_library_fy2021.js?bust=31069448

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e497f0ccb9e91a1500b607768344319dd1bfc6b88295e0fc44eeb9c4baf50e22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54572
x-xss-protection: 0
server: cafe
etag: 15470186838307401923
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 12 Sep 2022 01:04:42 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 191ms
175ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 12 Sep 2022 01:04:43 GMT

GET
H2 200 performance.css
video-native.mgid.com/mgPlayer/css/1.11/ 40 KB
7 KB 51ms
10ms Stylesheet
text/css 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to

Full URL: https://video-native.mgid.com/mgPlayer/css/1.11/performance.css
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/t/h/theparadise.ng.1149345.es6.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: cc206c514253113c307b4357e5e97a8d6e1c025d523476cf1ebe625dd8dc7bb0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-id: fr5-up-gc32
date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: gzip
last-modified: Fri, 12 Aug 2022 07:23:04 GMT
server: nginx
etag: "a1b7-5e6062726e7db-gzip"
vary: Accept-Encoding
x-cached-since: 2022-09-01T09:47:40+00:00
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=290304000, public
cache: HIT
accept-ranges: bytes
content-length: 6929
expires: Fri, 01 Sep 2023 09:47:40 GMT

GET
H3 200 mgid_ua.svg
cdn.mgid.com/images/mgid/ 2 KB
1 KB 30ms
29ms Image
image/svg+xml 2606:4700:1::6813:864e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mgid.com/images/mgid/mgid_ua.svg
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/t/h/theparadise.ng.1149345.es6.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:1::6813:864e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 70d5c4de881e718d0b7638959680ba86722d44eecbe4058d20dd77b8d0d97155

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: br
cf-cache-status: HIT
age: 3982
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: 31SG1V0WFRNKXC6R
x-amz-id-2: 2ywp9fgknp8c4HO0Z1cJ5C+4aMUUPCMjGdBA1cI/wAWAxrlaPAi52xxpkj8rcWWqMPvoQLnyl6w=
last-modified: Tue, 08 Mar 2022 17:05:01 GMT
server: cloudflare
x-amz-meta-s3cmd-attrs: atime:1646759091/ctime:1646759091/gid:0/gname:root/md5:617c205137825561208ef7c1a2d8f319/mode:33206/mtime:1646759091/uid:0/uname:root
etag: W/"617c205137825561208ef7c1a2d8f319"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
x-amz-version-id: null
cf-ray: 7494bb0c3c2a9b3d-FRA
expires: Tue, 13 Sep 2022 01:04:42 GMT

GET
H3 200 Adchoices.svg
cdn.mgid.com/images/logos/ 836 B
1008 B 28ms
28ms Image
image/svg+xml 2606:4700:1::6813:864e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mgid.com/images/logos/Adchoices.svg
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/t/h/theparadise.ng.1149345.es6.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:1::6813:864e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7992a4430843ef8b4bbae534358be3193aa1ae9c78f273e8e8a70b6af1244ac5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: br
cf-cache-status: HIT
age: 1228
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: 31SYWNNYNESPJ6F1
x-amz-id-2: 3myD4nXSsv4qiYMx2Hi56efn2ys0sdKXq9O5ZJG39ML6YXsxmNdK6iip2d5CSfCah3Py/VE8AbU=
last-modified: Wed, 17 Feb 2021 18:15:53 GMT
server: cloudflare
x-amz-meta-s3cmd-attrs: atime:1613585745/ctime:1613585745/gid:0/gname:root/md5:7d59364b7ed2df3f02507c9f92560df9/mode:33206/mtime:1613585745/uid:0/uname:root
etag: W/"7d59364b7ed2df3f02507c9f92560df9"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
x-amz-version-id: null
cf-ray: 7494bb0c3c2e9b3d-FRA
expires: Tue, 13 Sep 2022 01:04:42 GMT

GET
H3 200 aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHFfYXV0bzpnb29kLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMi0wOC80NjY0ODAvZTAwY...
s-img.mgid.com/g/13879884/492x277/-/ 32 KB
32 KB 30ms
22ms Image
image/webp 2606:4700:1::6813:884e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.mgid.com/g/13879884/492x277/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHFfYXV0bzpnb29kLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMi0wOC80NjY0ODAvZTAwYjFmNWE0ZDA2NDNhZTMyOGQ0ZmQyNWQ4MDQxZDUuanBn.webp?v=1662944682-LFDRxws5PEo3fHyxV4OXu5yeo_HSYJZ61pTrariK7Co
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/t/h/theparadise.ng.1149345.es6.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:1::6813:884e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9b6112851e9cc4d63f1815ff104cbf1fc4bb5bed0d9bddce1638ce9698dc3187

Request headers

Referer: https://theparadise.ng/
Origin: https://theparadise.ng
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
cf-cache-status: HIT
last-modified: Tue, 23 Aug 2022 10:47:32 GMT
x-mg-request-uuid: 1fc80b6a-2180-488e-8694-62c6d53c50e7
age: 221478
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 7494bb0c4914903a-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 32256
server: cloudflare

GET
H3 200 aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ194eV9jZW50ZXIscV9hdXRvOmdvb2Qsd18xMDIwLHhfNTIyLHlfMzUxL2h0dHA6Ly9pbWdob3N0cy5jb20vdC8yMDIyLTA4L...
s-img.mgid.com/g/13801725/492x277/-/ 15 KB
16 KB 40ms
32ms Image
image/webp 2606:4700:1::6813:884e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.mgid.com/g/13801725/492x277/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ194eV9jZW50ZXIscV9hdXRvOmdvb2Qsd18xMDIwLHhfNTIyLHlfMzUxL2h0dHA6Ly9pbWdob3N0cy5jb20vdC8yMDIyLTA4LzEyNTMwOC83ZmQ3MjExMTYxZGUwZjFkOTc2ZDQ5MTdiNzU3Yjg1MC5wbmc.webp?v=1662944682-FgwfJc1Tv-7B7nKVzIaAYyk7Z7xH2oas9A6Iv9RbNzE
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:1::6813:884e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d30610506b0b83a1f0973705ecfb1b81726971f3f6270aad605aa515b20b56e2

Request headers

Referer: https://theparadise.ng/
Origin: https://theparadise.ng
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
cf-cache-status: HIT
last-modified: Thu, 18 Aug 2022 09:37:38 GMT
x-mg-request-uuid: a49778dd-c6b8-41b2-861a-0de53ff4e98a
age: 2129223
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 7494bb0c4915903a-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 15556
server: cloudflare

GET
H3 200 aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHFfYXV0bzpnb29kLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMi0wNy8zNDQ1MzgvZGE5Y...
s-img.mgid.com/g/13480121/492x277/-/ 8 KB
8 KB 47ms
39ms Image
image/webp 2606:4700:1::6813:884e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.mgid.com/g/13480121/492x277/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHFfYXV0bzpnb29kLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMi0wNy8zNDQ1MzgvZGE5Yzk0YjYzNDdiMzg2NTQ5NmQ1YTAyYmU0NzlkMGMuanBlZw.webp?v=1662944682-AvqCt0iPkhRmOR0hyI0gGNLfawRewrc_ogndNAlYhuM
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:1::6813:884e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e4f422812c20d1d2f9271caea88e4d805fafad5048044d89a73dab51eb49a95d

Request headers

Referer: https://theparadise.ng/
Origin: https://theparadise.ng
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
cf-cache-status: HIT
last-modified: Fri, 08 Jul 2022 23:23:36 GMT
x-mg-request-uuid: adda9be2-e77a-4c49-a99d-4c1869212307
age: 5059781
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 7494bb0c4918903a-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 7846
server: cloudflare

GET
H3 200 aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHFfYXV0bzpnb29kLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMi0wNi8zNjk0MDMvYTc0N...
s-img.mgid.com/g/13417165/492x277/-/ 13 KB
14 KB 41ms
34ms Image
image/webp 2606:4700:1::6813:884e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.mgid.com/g/13417165/492x277/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHFfYXV0bzpnb29kLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMi0wNi8zNjk0MDMvYTc0NDJhZTFiYjgzMmFiZjlhYmIyZTZiNTM5ZjM5NmQucG5n.webp?v=1662944682--jSKruAWCovIzl6fM6gYkT-K9Wl5D6O5e9mDdrkX7jE
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:1::6813:884e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8fd4f43efe1b8f70b8fb3daa6dc09cb6418aca68b99d8076d0cb57445f379d2

Request headers

Referer: https://theparadise.ng/
Origin: https://theparadise.ng
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
cf-cache-status: HIT
last-modified: Mon, 04 Jul 2022 11:05:17 GMT
x-mg-request-uuid: 3ee7e78d-f368-480b-8d68-6bffad205fc7
age: 6011947
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 7494bb0c4916903a-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 13528
server: cloudflare

GET
H3 200 aHR0cDovL2ltYWdlcy11cy1zb3VyY2VzLnMzLnVzLWVhc3QtMS5hbWF6b25hd3MuY29tL3RlbXAvLy81YjNiMzUxNDhiZGU1LmpwZWc.jpg
s-img.mgid.com/l/-/492x277/-/ 34 KB
34 KB 33ms
26ms Image
image/jpeg 2606:4700:1::6813:884e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.mgid.com/l/-/492x277/-/aHR0cDovL2ltYWdlcy11cy1zb3VyY2VzLnMzLnVzLWVhc3QtMS5hbWF6b25hd3MuY29tL3RlbXAvLy81YjNiMzUxNDhiZGU1LmpwZWc.jpg?v=1662944682-I3spVqptPFKk7FrhPhIiQsbwi738jpsis4SljiwnavU
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:1::6813:884e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 46ef4a81846fe13676f8b10625dbf9da789b293aafba254b31a3f60ab4833e93

Request headers

Referer: https://theparadise.ng/
Origin: https://theparadise.ng
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
cf-cache-status: HIT
x-mg-request-uuid: 3c4bea5b-2f19-463e-b28c-24ab45691d9c
age: 5407768
cf-polished: origSize=36510, status=webp_bigger
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 34354
last-modified: Sun, 05 Jun 2022 08:13:47 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 7494bb0c4917903a-FRA
cf-bgj: imgq:100,h2pri

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 298ms
15ms Preflight
application/json 2a02:2638:1::13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Ftheparadise.ng%2F&domain=theparadise.ng&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://theparadise.ng
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://theparadise.ng
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Mon, 12 Sep 2022 01:04:42 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 588658
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Ftheparadise.ng%2F&domain=theparadise.ng&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=12qKtHxGRitjSGFJeW1iWnpkODBvM1FDK3ZlckNLaUdKNGZPS3FMYTBML1BiT2dDOSszRTJBWjJNQlF3S3R1aEZZbzBmOExZSUN5L1hGMTNwUFdha1c0c3dESnI3WG9VVDJTdS83ek0yYXNFVHhydjNUdTVwa2JxQmhWST...

358 B
641 B

46ms
16ms

XHR
application/json

178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=12qKtHxGRitjSGFJeW1iWnpkODBvM1FDK3ZlckNLaUdKNGZPS3FMYTBML1BiT2dDOSszRTJBWjJNQlF3S3R1aEZZbzBmOExZSUN5L1hGMTNwUFdha1c0c3dESnI3WG9VVDJTdS83ek0yYXNFVHhydjNUdTVwa2JxQmhWSTNsYVdtSk93cDNxdndPWEtsUE1EL2orYSs4akZyM2NhaTRyTGpMWHNqeTJmWXlRSWQ1QTVWbHAzTTlnZllRaTQybmhMU1ZnVjVNbkZCeEk4a292UlF1LzlhTU5sTlJUU0xaMHZuVEVRQjdPVTNmNzN6OWs0PXw&cppv=2

Protocol

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

30041fa0f06fc8cffe503a865dd7a5e1c2c620e7ce1277fc76a8fd1cc58701b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1505942
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:42 GMT
server: Kestrel
location: https://mug.criteo.com/sid?cpp=12qKtHxGRitjSGFJeW1iWnpkODBvM1FDK3ZlckNLaUdKNGZPS3FMYTBML1BiT2dDOSszRTJBWjJNQlF3S3R1aEZZbzBmOExZSUN5L1hGMTNwUFdha1c0c3dESnI3WG9VVDJTdS83ek0yYXNFVHhydjNUdTVwa2JxQmhWSTNsYVdtSk93cDNxdndPWEtsUE1EL2orYSs4akZyM2NhaTRyTGpMWHNqeTJmWXlRSWQ1QTVWbHAzTTlnZllRaTQybmhMU1ZnVjVNbkZCeEk4a292UlF1LzlhTU5sTlJUU0xaMHZuVEVRQjdPVTNmNzN6OWs0PXw&cppv=2
strict-transport-security: max-age=31536000; preload;
access-control-allow-methods: GET
access-control-allow-origin: https://theparadise.ng
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 687047
content-length: 0
expires: 0

GET
H2 200 idp.min.js Show response
content.zeotap.com/sdk/ 55 KB
19 KB 56ms
23ms Script
application/javascript 2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://content.zeotap.com/sdk/idp.min.js
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/161673/7165/pwt.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: feb4fc467795a580abc9ca8be5f38bbec4cb85b1a5cd9c40743052acf912cf47

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
content-encoding: br
cf-cache-status: HIT
age: 128
x-guploader-uploadid: ADPycdtuBOxAaznoZbk4uFZvHzVmBs7jk4zvHv40Xsw5wwCuAHHuNdvC8P-KEWO9LRXc0Hek_pEG8dArFk-cFEfYZo63tA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: application/javascript
last-modified: Wed, 16 Feb 2022 08:59:03 GMT
server: cloudflare
etag: W/"ab1a346bb1160bca58c151a07ab8582b"
vary: Accept-Encoding
x-goog-hash: crc32c=ezzPYw==, md5=qxo0a7EWC8pYwVGgerhYKw==
x-goog-generation: 1645001943546675
cache-control: public,max-age=3600
x-goog-stored-content-length: 56329
cf-ray: 7494bb0c9ab79036-FRA

GET
H/1.1 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
328 B 39ms
7ms XHR
application/json 141.95.98.69
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://lb.eu-1-id5-sync.com/lb/v1
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 141.95.98.69 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3216534.ip-141-95-98.eu
Software: /
Resource Hash: a13b8edf519611379569011dc81fd20613ad68500e67f98f74ee0df28527aea6

Request headers

Referer: https://theparadise.ng/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://theparadise.ng
date: Mon, 12 Sep 2022 01:04:42 GMT
transfer-encoding: chunked
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 127ms
48ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=theparadise.ng

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 120ms
47ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=theparadise.ng

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/ Frame 3C15 10 KB
4 KB 39ms
39ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

de317176fa6b64a8e89bbd45d20b6be2560bbfa96e7e53e63eb754e18bfe6c1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://theparadise.ng/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 27282
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4412
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 11 Sep 2022 17:30:00 GMT
etag: 8616628553774171045
expires: Sun, 25 Sep 2022 17:30:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 949f6068-329e-4344-84e7-de26e7f62396 Show response
player.ex.co/player/ 983 KB
312 KB 64ms
8ms Script
application/javascript 151.101.130.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://player.ex.co/player/949f6068-329e-4344-84e7-de26e7f62396
Requested by: Host: cdn.mgid.com
URL: https://cdn.mgid.com/js/wglibs/mgWidget_1.11.129.es6.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.130.132 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 9d5f5e189fe8e863fe1ec57c027dcf75e00294f104f8daa487061094639150a8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
age: 9740
x-cache: MISS, HIT
access-control-max-age: 600
content-length: 319061
x-served-by: cache-iad-kjyo7100100-IAD, cache-hhn4029-HHN
access-control-allow-origin: *
server: nginx
x-timer: S1662944683.053147,VS0,VE2
etag: W/"f5c84-+0rXwKhkXV3np7tRJ3UcNjhOuNQ"
vary: Accept-Encoding, x-pb-country, x-pb-connection, x-pb-embedid, x-pb-itemid, x-pb-videoid, x-pb-player, x-pb-bot-name, x-pb-is-bot, x-pb-country, x-pb-connection, x-pb-embedid, x-pb-itemid, x-pb-videoid, x-pb-player, x-pb-bot-name, x-pb-is-bot
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/javascript; charset=utf-8
via: 1.1 varnish, 1.1 varnish
cache-control: no-cache
accept-ranges: bytes
access-control-allow-headers: Accept, Authorization, Content-Type
x-cache-hits: 0, 1

POST
H/1.1 200 231.json Show response
id5-sync.com/g/v2/ 216 B
624 B 37ms
7ms XHR
application/json 162.19.138.116
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/231.json

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 , France, ASN16276 (OVH, FR),

Reverse DNS

ns31533567.ip-162-19-138.eu

Software

Resource Hash

4aa3f5a05efab5542bd21fffb6bed9bd2391dfdd5eb4bbdac20fd9dcbff29908

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://theparadise.ng/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://theparadise.ng
date: Mon, 12 Sep 2022 01:04:42 GMT
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/json;charset=UTF-8

GET
DATA 200
OK truncated
/ Frame F705 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c7b2bf7a43072b220492af01bef5358c77cf701e5f72f499680368c8af934ef2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 0EAC 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c43166d8a985f9b54a791e457134ae182e52bd69af7117d7b8d2d01c18b36440

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 layers.fa6cd1947ce26e890d3d.js Show response
s7.addthis.com/static/ 263 KB
76 KB 31ms
30ms Script
application/javascript 92.123.36.37
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/layers.fa6cd1947ce26e890d3d.js

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.36.37 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-36-37.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Mon, 26 Oct 2020 18:11:48 GMT
server: nginx/1.15.8
etag: W/"5f971164-41cf5"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=86313600
date: Mon, 12 Sep 2022 01:04:43 GMT
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 77617

GET
DATA 200
OK truncated
/ Frame E122 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 389432c022a4c46442a2140186aef7d773997b2a1ab4a1081b875c87003c9d97

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 3C15 0
0 83ms
83ms Fetch
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Ce3e8qoUeY97rJZHy3wPzgrDABMme0rFcpfyT93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItMTEzMjU1OTM4Mjc0NjA3M6AB1bbS6gPIAQmpAoa-xJ3d2LA-qAMBqgSXAk_QQ4kpVF0hBVuC44l4mDtrT_hB0TF1QrbYbpEtHt15wUs68ReYAtDzLT0a-q0kiEGgN6xHuRupQs8uy4tSrfSs4iaZ1PCT0nfrDWG781FVE_jU45X9BmbCj-Z2lbubZhFvTAkFVKdKqd3k7GIqxT95OkPFTT-8ujEshX19auU-tUN5BTZTzdSFjjcxMvW4NhyhDZ9Rw8ibVlKzLZctIxYpBXa7XR2Mu4T-a6Zg6mRFHGdKc1ZvMkuZ5v5buEFTvgNtaGG0W0Ell2HuMGdQVJtZPpRChC8DDtTTlZC84QH0MN1wILAnEH1_mEvTgQJjTBBoW4JZUd35hldHoHUGBgmh095a__D9oToU58cVuV_ur8gbo1PtdoAGir7AjffhgIVuoAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQIAKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi0xMTMyNTU5MzgyNzQ2MDczGAA&sigh=6BR5rHaPnZw&uach_m=[UACH]&cid=CAQSGwCsnQUxmMUlcjfTSg_nQ4L5EJr_-Mgo2u-MpxgB

Requested by

Host: theparadise.ng
URL: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 12 Sep 2022 01:04:43 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.nl.eu.criteo.com/google/auction/ Frame 3C15 0
0 15ms
14ms Fetch 2a02:2638:1::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.nl.eu.criteo.com/google/auction/notify?profile=14&payload=kJq8Esz6RO0HfJ2DYgICAAAAnuEgqOdxwlUQqYUeY4tRWsMSayeS3_wDABIAAA&wp=Yx6FqgAJdd4Kd_kRAAwBcxLF10f87qKGAJBh_Q

Requested by

Host: theparadise.ng
URL: https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
server: Kestrel
server-processing-duration-in-ticks: 299923
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame E299 169 KB
51 KB 126ms
124ms Document
text/html 2a02:2638::b
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=Yx6FqgAJdd4Kd_kRAAwBcxLF10f87qKGAJBh_Q&u=%7ClQoq1dfOb%2FQOJQekhhTtJ3Bm4LScJaSSPv1sYuHVSQI%3D%7C&c1=0n2XosTo5clc2Y5hvSIf5j5HfVfFTixGa4yOK3LEx5zye4g5UWBXMcRJXio_xXJwHeKNhiRq3gWBCYy6L4bsHSjdNaU_P4YXfBgQCPQ3ykUSXZ0tOhbUjOmd0zatywb2yEEYKRnqEnBXFMUny7jgeMyK1AnEOzbAgT6_1zeLLqzLkitiyhZhsTQUtLFiIGt2BlLpFXULF1ibbyZRzYM-QRvxuBV2jr2D6BeC2qfcozZdI8YTlwmO6FgUZNDuqpoq4hr3pq6pnwA_fHV-3AIAa7WM_jM6LAF3xPmI-Hv5-AYgubf8FnrFr3SzrBP_rYc88LiewN3PAGVSau2p79ZYeoiM9tlkEci0WEEueFIEJVRxyr93-bQ6qvJnZoXb-oMRz17_vRS388cNhWO_L_Y-U1ixSZi8d6o8JjItz_LZNJzKRCSHStFwr59VMlQp4lxB6YUQrQxINLP2-haWSXwGt2KZMuxBL2A_vEBQ4IObTEvdX30npAal1FN2st3z_TqmCnUj1dkPSVNV19OIi2diC9IbXFyUfmnWnWDZo8JLW8rk8Gp3G41JeDIESkVH-u_tRBwjuhuNmfE8LNawACtwVgggyNNnytEhZlogzWr5P6DrPT4gvfdkgtIZzHEqXJYVVSCvtuqJgwg&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DChaYvqoUeY97rJZHy3wPzgrDABMme0rFcpfyT93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItMTEzMjU1OTM4Mjc0NjA3M6AB1bbS6gPIAQmpAoa-xJ3d2LA-qAMBqgSaAk_QQ4kpVF0hBVuC44l4mDtrT_hB0TF1QrbYbpEtHt15wUs68ReYAtDzLT0a-q0kiEGgN6xHuRupQs8uy4tSrfSs4iaZ1PCT0nfrDWG781FVE_jU45X9BmbCj-Z2lbubZhFvTAkFVKdKqd3k7GIqxT95OkPFTT-8ujEshX19auU-tUN5BTZTzdSFjjcxMvW4NhyhDZ9Rw8ibVlKzLZctIxYpBXa7XR2Mu4T-a6Zg6mRFHGdKc1ZvMkuZ5v5buEFTvgNtaGG0W0Ell2HuMGdQVJtZPpRChC8DDtTTlZC84QH0MN1wILAnEH1_mEvTgQJjTBAqWaPL1lJllejbtNbWO69Z2spQSfrTubigL_qzS-Dwg9CeCdf-ybyUxYAGir7AjffhgIVuoAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1OfnW7yNrYnxhjEf3nXs9iPQiFdA%26client%3Dca-pub-1132559382746073%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::b , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

0bdefb20e10efa65a129e68037a90d1db18dc89b2a1ab7324ecbb679ac956d73

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 01:04:43 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=GXaVgnpgPkQJ1wHpbuW7X4jhseq8EW3BPf8cTwPLfr2s_MM5RxPVjVRx_A_uKKe71Zju4qNXhUyEK9LnfsGOT51MRyXUS5WDByOcR-gsyId065kI0489jIyB26-i3A3qPb_-Av6Evpr38aP5M_vn_qE3NK8osdzKvtNAfhXLeQXAXbrcQFH5Eu07rlaNeNAKMCD-5WL49rpIckEihbElG12NMXYc88uENXEZ3WjVttmuhw_93kVpEwz4X_-Rm4mMxryLHw"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 108713030
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame 3C15 3 KB
1 KB 120ms
39ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 00:38:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1562
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 00:38:41 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame 3C15 17 KB
7 KB 120ms
40ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e368951bc5918b3d9fbc8205bfdf0d8be8b79da09b457bb113307063f3b1bc89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 00:50:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 876
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7592
x-xss-protection: 0
server: cafe
etag: 7248493764890666469
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 00:50:07 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3C15 141 KB
44 KB 54ms
51ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50f77fa9d32c1323f7e50da8d807f556cdddaea2161de6cf84a0c8b4c1dd6f79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44740
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1662550240112033"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 12 Sep 2022 01:04:43 GMT

GET
DATA 200
OK truncated
/ Frame DCBC 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ee7c59f0430abe5db4ec2b7c692b88ae5d9b858fe7c96b1bff937c86460a55a8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 23F9 2 KB
1 KB 71ms
15ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Yx6FqgAJd8YHg4UjAAyYqLBZ0wSvcJnf-lCe_w&u=%7ClQoq1dfOb%2FRBHVekhmVLl9EHlznR4HeV5%2FVw9KVb630%3D%7C&c1=0n2XosTo5cmJbNb7DNNVBd09feAUrRU5KgFh9XNQv4JdLNIKaOnb5OzEWkIpq6r1BJdkqejnNl45Kh9Y2SghDV4OirngSybS5PVG-3CU84QQfvquVGjiF09X6ttegZ8PwIg_hBNNhyXn9zcKohx7TTyROZ3rq2yfrBf9O7e61gi_PUKfjUW9Je8AZW-oq9NTuC1FOFsyqj8Bqi8pz6XKbkRBAnwmiy5D_xYP7MSzgp2oOrlXE8moZgo_s71aNFXlxMROW8gR_SPzeAOaGvitkkknrP3RcePLEV9L2MGaELmS4CSiqdj4Bvn-AuGe82xh1fV8GRJ7pmU5FeOsKwctctN9sHW_MepoGoNcKTBTQH9-L9JkQN7xu4q_oqKIVFXMYdr2tVu-Cm8E6mYxlfKJXcm6AwIXVRaYaJKHFx6b9xXuWF7cFJdg9h-nCBJzWpPIdSR7lYiYsVBIsbZrJcmo_4DFTlAzRoNhBiRA3D_lz_FFCRVxMgWIFYrDe6vakBSxntbf7FwyMaeYWI-GbFGX5u9WzMFpXg4ztZ1URrCHfjb0dxK_BtgvDeTZJ1iFjALmDoeUxbbk5jZklG3-p1_ADNfFeR0f33NpTbyjyO-dVqPL1QEjxTna412jT41WVx3AL_SzWGlO5lRgLKhYR6mFig&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCnfwnqoUeY8bvJaOKjuwPqLGy-AnJntKxXL3plfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTExMzI1NTkzODI3NDYwNzOgAdW20uoDyAEJqQKGvsSd3diwPqgDAaoElgJP0EopSCAoaAY8hQl4ehZMQS2NaFO_nimAGWLZ_s4S5J3Qq9_m94O-5F0em8KGE314ks5sEPQ5WQcErij9kObB8ac9o-O6W8atX0BjKUNalaSwPkB4CFQppl0y0ISdAUbB9HVHTaXkMevSbQ42WmB4oGwRaphlrR8mgK5OUNWSZmBmSQlsyjoQnaO0h7VJJeesACpOSnJ1FLJFAwjCBcvdNuD2XTkAsQMK9Fy_7bS8m0OPnWpcSfHSNNSUnnLrgo5jMH7P7trl48olZiqthetIcsg0QXRTmVAeAp9OjIn1IjCIccL-vAS0ec9pfAfiSSClS3Tf0Hbjs4bSnA_ZxBWxuavC4_xnwupYGY83fkmNLRzMotScF4AG752BpNeVrZsboAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2ajRSnfs2Io_dWrCro8zXER7YEpQ%26client%3Dca-pub-1132559382746073%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 23F9 2 KB
1 KB 70ms
14ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 23F9 308 B
636 B 27ms
15ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 23F9 293 B
621 B 29ms
17ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 lg.php
cat.fr.eu.criteo.com/delivery/ Frame 23F9 43 B
348 B 77ms
19ms Image
image/gif 178.250.0.160
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.fr.eu.criteo.com/delivery/lg.php?cppv=3&cpp=fB261lgLZnpK0PxU1OnM9rwR6Znsm9czjbZsU7R6eTINOZUebobH6jat9tB2xCFRsAHGBMt4dejARn0lc0zk5Co9DjMCGq1izfbYLP2uyG8gWwCThnycZ7Sl2XpnPSDR1JGuM9SY3_Amnh7VSHs4TXsavP9ws0JmsUnwTS5a3dFFSLdg029JACgDC_02JFvBuSeseuzX-rdtNsDs3g6fYQtVTAub4i83-WwpbuAlkPkKzn8kZa74oEuGsZbPZUKHnDXEAjYWQYgCD6B0yiCF7-79suuDDx-s_bo2Hu97_yCVzlP2xQm62J-rztokL0MVgNCjzViuBlBehpVvxp3AWhr798AzluE9uJW1n8tx2S3VFJzV3G5SJGLQMA9rDmpCxCn-P6UXI_nJWe_pmfKcrs6yWynONnCAXKDmHxdkmmsETqJKxUjNh3IRfQaeO4aWqrsgpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.160 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:42 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 3726417
content-type: image/gif
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 687D 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b11075fce6949d8d09607e25c5b98d099037913927192c20cefcf72852534055

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 1FE8 2 KB
1 KB 18ms
16ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Yx6FqgAJeXcKd9IQAAUieeyV3z_nEpTR6LjqAw&u=%7ClQoq1dfOb%2FSGbo238V3dN5wf6glk15D32YOjkWDAOeo%3D%7C&c1=jWCgqsKSUoV3SMf7iUfSyMCnTpn87UHNsuno7AgpGzm4RCiJiIGT5xwGwpq72AA9TknvMwYFTY9kj-FXgmUu6wLDmMWCWg46JM3QschmqKwtptxxWmqKb6qzTMCljyuZ2GgUOH89Ov3375v197aC-_Tb6YxHrCHXHp_JSKgmZXy4TYMmgBV1lm9qfAHpb_taT7ghwV2jRMykP5-1nIn-cLwr_QlCB3eJwTtIT1_tPBuP3R6e-RA82BXzzNtSy-IMm_L2Jo5i8lpDNFvAMApYGfZhN435ptgfg68WuFvy9hIVuOGvb63sYVwPbxV9tWFh4mcAUHP8fjD-Qgaph4xZGYzHg3BJw3ED0HTYBSdKGH-rtyeeiRcYFbMfNDfxTEEAaSAEJr-WPElsYfQrkVrOtrSmwgwBgoyEL1vVYTV4G-dV0k81MbndDJhk0iQPP-8hIPQWm36OBFMrxEPlBSArkeXSRMrhA4kSwme29oQg1zlqIM9ppeQAceV_a1NJaXsjh9p2P26V9u_8jBfy0oUJenudd9miZ9W_pt97glt0XVU3u9IwPkzCac8MYqE-cJ8gifBanmvuP-KcauaGuXoc2NdkceCLIDW0GDafjHRyC7_wzvl1yyx8eQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCnHI4qoUeY_fyJZCk3wP5xJTgDMme0rFc9dqW93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItMTEzMjU1OTM4Mjc0NjA3M6AB1bbS6gPIAQmpAoa-xJ3d2LA-qAMBqgSWAk_QoCa7HSUM0TCjsi1YuZUYBBJ7X2dm0TmSHOY2BAVmGfkX7HMB_Dz7LFDhGDOmA6H54OSA3lx5nTItHqzIs1zMw8Xs-WH0Nrwy5lXdKAVEFs7FLxI0JxR5z38VfRFIdQARAN0T6JKdgNKlhlvCitZ8GospKpOxWfNL6oblccQ0en9_HDr03lsnqpiTWI4A1dgxxLz75UAHS6YA47QggT9EaV2URJ4BGMkfXNUhE4oMI1w1ksL-gLrXwUD7Gy1JPWUlmJN-WDlytv1zk5qmac0LcgErGGmweGah0pEKlDGNEMTwhgO9d8uzay_WW71VCaDtp9sNBoUWFxG75u5Y2vuqOzFzD9jzEiquDn3RHbYktcfle-PsgAbxlqCd9Kjn6TSgBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_0Ox3oAzlwOKJH1YRKQ21DRM5veyQ%26client%3Dca-pub-1132559382746073%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 1FE8 2 KB
1 KB 20ms
19ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 1FE8 308 B
636 B 14ms
14ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 1FE8 293 B
621 B 22ms
22ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 lg.php
cat.fr.eu.criteo.com/delivery/ Frame 1FE8 43 B
347 B 18ms
18ms Image
image/gif 178.250.0.160
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.fr.eu.criteo.com/delivery/lg.php?cppv=3&cpp=tcMyOjU_xQiZUwUmSnWez4BdtMi8Y03W5tpZQRdYSOPojzEi2zp1U1lyhuHQj2KaE6YmMZq0qZ-gbbzFOeeDbIyiiNrRv-TD2qp46rMf4rfRf6Mt6BHEOSatEFJHx3Qg1c-KK7dqEwVc_8Y3JL1IYfkCCItUOtJ2UzcV953wlSF_woBgSwRSNANG-cdAoykqEmsZCp1MVBTEeUIGMfkgim_vWSC_VmZtQQGfU3DYoB0FPgFJber2qyi8IL4aO5C4zeSIq0-jur20OxxHfjQ6m_tyo8tQYvC4D5igYNnEyeH8P2sBiID5sCHQqC-qwaOkFjKX1GIynNQMha1ESysRwc2EvImaXIacTyKOGLxaMxLg8nBbEjz42uXPW-Zz4xXyeYisFYaGJ47nrN7Hd5Q_PE3cVFXaANxViUuC0sMHJFgooSkW

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.160 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:42 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 3019939
content-type: image/gif
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame FEF9 13 KB
5 KB 56ms
40ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://theparadise.ng/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 7547
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 11 Sep 2022 22:58:56 GMT
expires: Mon, 11 Sep 2023 22:58:56 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 0AD5 783 B
1 KB 132ms
49ms Document
text/html 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

8727f95a1005ca490268a4ed2866be6171eab79569518101d2344ef6547265dc

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-hjnXf5RCNyODqInKvg89kw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://theparadise.ng/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 514
content-security-policy: script-src 'report-sample' 'nonce-hjnXf5RCNyODqInKvg89kw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 01:04:43 GMT
expires: Mon, 12 Sep 2022 01:04:43 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

POST
H2 200 events Show response
prd-collector-anon.ex.co/main/ 0
136 B 315ms
102ms XHR
text/plain 3.211.29.40
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prd-collector-anon.ex.co/main/events
Requested by: Host: player.ex.co
URL: https://player.ex.co/player/949f6068-329e-4344-84e7-de26e7f62396
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.211.29.40 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-29-40.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://theparadise.ng/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://theparadise.ng
date: Mon, 12 Sep 2022 01:04:43 GMT
access-control-allow-credentials: true
content-length: 0
vary: Origin
content-type: text/plain; charset=utf-8

GET
H2 200 css2
fonts.googleapis.com/ 2 KB
1 KB 131ms
48ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto&display=swap

Requested by

Host: client
URL: about:client

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

df3ba57c1234e50c05735a0dedc033f43d5e638a97d5c51583cac8411d2ea34f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 12 Sep 2022 01:02:36 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 12 Sep 2022 01:04:43 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 12 Sep 2022 01:04:43 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 0050 2 KB
1 KB 17ms
16ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Yx6FqgAJc4AKd_XLAAYWf8V7S2BflfCnd62xdQ&u=%7ClQoq1dfOb%2FR6cb5dTHBQrYlqAVoXdVeb%2Bpw2gYvJQXA%3D%7C&c1=jWCgqsKSUoV3SMf7iUfSyMCnTpn87UHNsuno7AgpGzm4RCiJiIGT5xwGwpq72AA9TknvMwYFTY9kj-FXgmUu6yTRuDX9TXkF7xlK8l4SwJADIg6J8HrXqKu0cqHZbt0UVCydP7DYuzEoQizD-uf2F_MvT0z4aep-lGFMMZgkQ15cyymSejypOk2aMS2-rDZz2a3GhKe-CpGwkIyuxKi5hjXM4i3cuKYikjnz1nrf-KkwNvPhJ9T9qPlWZMQOIQdwbY-bAz21cNBCf5wl-ifG285-nNIvGdQxhJEcDYXrhhO4t6DEfMZX0WhYvGrVWTZNfCA1sWWU4XftEmgBbhEXUARNfcLqZzw6wmp4SB8lLFi3cE6q6YK0JicpwBMNp_pDfl3tRfAl7ghw0L2u6wB0Qt6NEaAdGcgPl6fxGOnfA4Bs6u4Fzj49C2VKuF4PeBG0qDJO267OjiUhQ7Fwygo0zpNXXLniuBWT-jY8tC6SuKrlOTlNnsw5g1-ZxjYZlWXoKVvs_NfgOzCUm4hvJm7ASe60i6Ds5zkJ1VmMZm98xzf5nXAdkaaT2XP3ZmVilpWfeOJCn4BhdJO-GCRj4xvELb7QltVbk09pPcwDxfjMaO0ri6-5wxs9JBUleFnPDIziGMU5vkv9j8o&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC4QaeqoUeY4DnJcvr3wP_rJgoyZ7SsVz16qGGiAHAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItMTEzMjU1OTM4Mjc0NjA3M6AB1bbS6gPIAQmpAoa-xJ3d2LA-qAMBqgSfAk_QRzcgwrtLKk93AMY1cCm20XkSwG6SbR1__lY5Vrah88-UvZDdu8eYR4FZAW1CX7Pw0YQSINA6Qg3eR5-giKbuRvDBng7XmDnz7Kppqp38ii_ivYNfmsEvTmTZWOO2yz_j30AUMIpRsgi-RAUUzqtM5SPRtBddTYbfCzrXIlTBqNcNCluDA5dosv1txD8YpXmmmMhwSxWFhEgLYb3PYJlYSCu3Cmn8x_S8rW1NjBkdzqUdgXAOuMP8a2H8oOCVWaHXAWjMx0WJTJQ51RiKxDmGfZWXZZCgQprx5D-wKW_xQrUZWWCz8lfd7qXaB5-XsOEH0sdSqaKzb1oZ207VmtZh65IKTIhvqgs5UmRgDPXN6y4t9cylCYBQLDe-MghRgAaKvsCN9-GAhW6gBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_1VtjZgS0cUtKOPhbNhu_ppVuaTiA%26client%3Dca-pub-1132559382746073%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 0050 2 KB
1 KB 14ms
14ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 0050 308 B
636 B 15ms
14ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 0050 293 B
621 B 15ms
15ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 lg.php
cat.fr.eu.criteo.com/delivery/ Frame 0050 43 B
347 B 18ms
18ms Image
image/gif 178.250.0.160
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.fr.eu.criteo.com/delivery/lg.php?cppv=3&cpp=tx3AQSQO0amY0n8kDRlZP41fk5cw-I23dG0j099X0rTgY8grgXBChHfQ0dnSRtCwF-ShVHR2BaO1R9ObN6-6dNWf7g9uGbgqhkTiuk3M0WKV7P3FWPCKAiv7ezJbcktGQMi5lTy0JLIN9hRof5vTjTro198CHM_G3NC2Pogdma-euk6QJGcJegJeKLVdue9gFABf0am1FSSFxYOpwSEbgDdsvW5GkuQjJ16baQsnjlLvq8JWNhNc-LxiWphxTM--lDLejMaBimHPRB03IhI6i_ZoHVaA58Vp0BdimIeWdoqbxJoiyqJPgrf0iV5xoZJhDLNKhPlKTSF_7NRakZOmCfCt9ALN96ku6-tfeXhAVBNhQExJSWe_febVURYY15HfCJdwm_ver6wHWMnORgvMMjVlhnhcA9H9dEIAaR1EtspBTGZq

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.160 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:42 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 3130129
content-type: image/gif
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame FD36 2 KB
1 KB 16ms
14ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Yx6FqgAJlooHg4IrAAdXxcm0octc47x47-XP5w&u=%7ClQoq1dfOb%2FRCs1WVswYoxUBBlADJJ%2BgOZ5Rsy9FtK2k%3D%7C&c1=jWCgqsKSUoV3SMf7iUfSyMCnTpn87UHNsuno7AgpGzm4RCiJiIGT5xwGwpq72AA9TknvMwYFTY9kj-FXgmUu6yTRuDX9TXkF7xlK8l4SwJBwAdk7cvCN6uUgm6-RtxofJ7QMqnNALRaxAWo43dn5JkIw1DDcM5R2yBU3-OgHxAN68VzaEp6tK68xNnqBLbKCQATBBE_K_w5blYSc2dbPyEUnvZqbUwEfQReLnH1vZI6dRgS45bD7sVytSHbShS53t5zFExQYBSHN_AQwxv7vHhc5vAwnEA_DEBRvlLokjA-FYMZYVDZ4_kiWYU_JkSP8c6IhiHIerk6t08cr9wGt8rTSjgguio1GRKAfq0sK_wzrH6Yq7annl7FZPoitpdHF5b4hMsSjX5Yjogus4fYkg4eb0Rfc_p1XTjb8j_yBZ0_j4bX7lw6kJIubtlq8Q65Ins7LjMgc9hcLuj8IoUXQGO7sSCxzk6pnx-Kn4NpzSN9MEhFfhTUFAbC-wifIwZc501a0o3gWwKEL7HodDSWGH3mppeZ6LELYk69L9hiDUEtq91kII8L3w1eRwJADNfVtjAVWNMUitZFGnP2j1zvg22bZBTVItJqejLL5JBRTg4cL2X7VhE4Bct8mxdeIzSK26Sd9NmjCG8M&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCvJO4qoUeY4qtJquEjuwPxa-dqAfJntKxXPXalvdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTExMzI1NTkzODI3NDYwNzOgAdW20uoDyAEJqQKGvsSd3diwPqgDAaoEnwJP0EfkYFbBS0_iwdqOqEBQN5H_eB-josPT3vKnkjLZa_BRbOIo6Lln6eK6AHzn8iE7T7Mgi1jHGKv5vOqLti0IFD5XedG1NKEHAGBxEVRAMY2807bqdsfC-NU5aILH1cOAezwKefZgfb8IogKgfTPgKH6NfwajXJUGxAPlG9z6M6Xd5t3Rm8X2w1zrJKVRSO8VOwbkcG4nwl801H4vkm19bNyEX-cPU8SZWscUhb9opuP5XSlGfEyBE0nyQj_aPLByJ9V9DySYT7p6I2S6mdamscK7Nrc6WRG_Ra267c8MMjB4-Wmn5OERW19EiLRfC0FBvZF2HMbZ7Fg7QrsCcHj9xuG15P_MTWRqdY9la_sUMsVrlFNFcgOvYgzLmgf7FYAGir7AjffhgIVuoAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3Dk1Y6wjBjLP_k6LhlUh1x6iecWQ%26client%3Dca-pub-1132559382746073%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame FD36 2 KB
1 KB 16ms
15ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame FD36 308 B
636 B 15ms
14ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame FD36 293 B
621 B 15ms
14ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 lg.php
cat.fr.eu.criteo.com/delivery/ Frame FD36 43 B
347 B 18ms
18ms Image
image/gif 178.250.0.160
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.fr.eu.criteo.com/delivery/lg.php?cppv=3&cpp=TxvU7CQO0amY0n8kDRlZP41fk5dkQ7i1z7h-YvmGVf-HYxVGVYPEddneQFKEt-7bQaycDTmZQ2LATJ374nEUAvqW2N-n13WqB8Q2Fq16aMKVfpTNaXMnmj9iSTSJ-PQr2kPR97Hh8FQPP4H-NcTSeBElO-pVL27kYob0FIOO410Nvan9xl3JYcnMSiJ8H8_VUhDcLmJDdpTKZ7KWSEWBg6kV83GGyt7rWXH8fC4Iiaacl8l7frL894OTWscxeTDvC_eHo83x9jsVgMgBJiqdQ9K-F--cEEy8E2pat8NslOTddfUBZ0UkiOsk-cJA_sTv55toFtVm18g3g_ReyQFf93YznG1XnYM3cVNTz1mY6V7YX3in7CoskT2vUow9xc_GLL2-QQG1iDi4UHCcst1Ify7InrOqS1fuqtgFO_i_eW658TFj

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.160 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:42 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 3029400
content-type: image/gif
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame C4E7 2 KB
1 KB 23ms
22ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Yx6FqgAJn14KixWxAAYTnTk0O1lWlwtwFD_9pw&u=%7ClQoq1dfOb%2FRmY7%2FwFstOHLUeshX1gquhmxorUjqiIkw%3D%7C&c1=0n2XosTo5clc2Y5hvSIf5u071KZSs7iZMd5UVLGq2ZmvHbRs4Z3fqc0q3y5txx2nB_DZC3x01MZ9GaKTJrvjFcrd6uXD2MTWH9FfRIatEpvUzsA7XUvHCd-F0f76Hqc6IrmAtIYYPNRp_HsJLu9B2h_YEMJDX6LWeEMLL8RGK0xtdlcDFr2Y1_Rgr160Jzz4155C7QUgSxlx2e397ncTddZQnjbMlAItp7DWI4HghANnsuLjFVLS7LitUiqRxuqtQA3htIjosMMsJ2UK5TL2CZINLzPOUk-TgNCmL6-CtlTXTQlUU-wrDfa4_g-BnHyn3vWpO7o37uR9tYL_KVxxm29Dq0IQ74cyEknU9FYg9_AJq3g9zFoBFmfxNmlBhUIig1Z7sva5VTmDKY7NAqp5BZlg51_33hF7fbSl32TY8yerPG94w_ixKUIOAcq4dp_y38Ka9jW2jUsrBo9QufXm1s6jxnkABJMdUh7M_08yVIQBJEO_3r2WwHW1npX_gwkL8ZNmBMvbgycEImvwHPuEPiHV7j6EAdpJ3BY75Lo8fWFkVgZQVlc9Rf_NJNgbDS_x_ON6oq9WR8oCuRntvaGmiE0VrMiOAxOiugGpWF__rOnbW0u9XMnzqg&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCSPIgqoUeY96-JrGrrASdp5joCMme0rFcxbKY93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItMTEzMjU1OTM4Mjc0NjA3M6AB1bbS6gPIAQmpAoa-xJ3d2LA-qAMBqgSfAk_QPkfae1V-iDRdBnl8Y-ZDlFNAjdJMEnO3Lpk1PftnOOTL5GGjb62BWJb0dplmkNmzwulXQg05EQLLuJd4Q2bgT0jATrr78nFKikguFHnzRwj27Cq2oKQh5tFnQ9vS4ExgLUSwEgW29EvwM06pqT4v7Ib69ljKPQQ_7hKWWhLBEh57musRi7Vg3we951qfytHKWSZJNE0Ewsx3TJLOYBHiBP3cjSsVqZ8PhuJP8CepEvkTBjLQGoBbLvzuGOs5sLM6zLFYSuLpIWO1_z28uueR35O2VAnMd0O6Yf5LVH6f_xizcnrTvCjOr4gnEdbz1m8gBxS9mApGhePpEuDB7ZHvMhsILzCZRVmJxKAVJfJa09nhJmduiuE4JIICwkDtgAaKvsCN9-GAhW6gBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2tDyvU5wm0FBbe4VLb66pP6PhV0g%26client%3Dca-pub-1132559382746073%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame C4E7 2 KB
1 KB 16ms
16ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame C4E7 308 B
636 B 15ms
14ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame C4E7 293 B
621 B 15ms
14ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 lg.php
cat.fr.eu.criteo.com/delivery/ Frame C4E7 43 B
347 B 18ms
18ms Image
image/gif 178.250.0.160
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.fr.eu.criteo.com/delivery/lg.php?cppv=3&cpp=fc33FyQO0amY0n8kDRlZP41fk5eP_k2Ez0-5qdSIWjQ8MYNs910nLnN19FiY4YLAIsg4D0lhQKZG_ZUcWrXRRX1ET3dpUuWn3bglD9tbG2beJysTEnP1Nov78Z2v5zQbaV89WoxuDs3lOu30_he5rb2EpRnk0cQEXmKCccAQd2UcrwhGFIg36wXtJR9FWxDpmyCu42Qj3P4ynilqW7STnPdR6yQYthVXrmjwT1BbWek3Pep95GqH_MLJCtYd24sze0_w-9huJv1jxMzhrSUK2brs44ZVmI9En7KoSR7JP7xiuTFno9ZcMnxgAqXJDgAmLUgR0hMC-biHUL8wwbVFWCm6zSHAav2zlqI0hGkUqA6lOFvLv8xn3NwCKpTIgfi2YjBrJi6PgGXPEvLpWcp5glr0xiWN0AnKCBEcbOVUXsaPOl6h

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.160 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:43 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 3194398
content-type: image/gif
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame 1FE8 12 KB
5 KB 51ms
19ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1583026
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4420
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kp4jrc9BuO0fyhU9rffONjWuJ7rhppGQpH9FQqtnxtdgIXOhaFoaIl%2FiQ%2BxpKFmWTewGIRARnnSbLvg4j%2FNPDnKz0dRNEyWuELpqk3bcEYX23i%2BLyDDRy6Hj%2BrcJpALyg5SXKdhoFPn4wCi200zWm9Gc"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 7494bb0e8d289143-FRA
expires: Sat, 02 Sep 2023 01:04:43 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 1FE8 12 KB
6 KB 20ms
20ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 player.js Show response
p.channelexco.com/player/ 15 KB
8 KB 378ms
124ms Script
application/x-javascript 192.96.200.88
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to

Full URL: https://p.channelexco.com/player/player.js?pv=117.25&p=1548817699&cb=1b3a5ce2-fe4b-4790-b80a-e825cf4ff67a&d=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&schain=1.0,1!playbuzz.com,0010J00002BlxpGQAR,1,,,theparadise.ng&w=446.859375&h=251&asr=1&impDetail=1&auction=1&auctionFast=5&hu=1&publisherType=publisher&puid=235c5f29-c9dd-4877-8bbe-c282429652c5&geo=DE&browser=chrome&os=windows&sid=&sid2=default
Requested by: Host: player.ex.co
URL: https://player.ex.co/player/949f6068-329e-4344-84e7-de26e7f62396
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.96.200.88 Ashburn, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: openresty /
Resource Hash: 38d65bd7b0fe53707105341d0204c9235367600642ac21934719b5dc051ed1ce

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
cache-control: no-cache
content-type: application/x-javascript
server: openresty
content-encoding: gzip
vary: Accept-Encoding
expires: Mon, 12 Sep 2022 01:04:42 GMT

GET
H2 200 159.1c3fceccbc80f2a3615f.js Show response
s7.addthis.com/static/ 564 B
634 B 27ms
27ms Script
application/javascript 92.123.36.37
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/159.1c3fceccbc80f2a3615f.js

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.36.37 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-36-37.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

c02d2e4ee660f561338f717a6dc83745ea23c4ad356a57bdfee60c3643b25b1a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Mon, 26 Oct 2020 18:11:48 GMT
server: nginx/1.15.8
etag: W/"5f971164-234"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=86313600
date: Mon, 12 Sep 2022 01:04:43 GMT
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 394

GET
H2 200 151.67aec2e0546e639563bb.js Show response
s7.addthis.com/static/ 2 KB
1 KB 35ms
35ms Script
application/javascript 92.123.36.37
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/151.67aec2e0546e639563bb.js

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.36.37 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-36-37.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

e1fa72e38624f68bc2039aded02a054eead1fbf24646f4df60abcacc665a8690

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Mon, 26 Oct 2020 18:11:48 GMT
server: nginx/1.15.8
etag: W/"5f971164-68f"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=86313600
date: Mon, 12 Sep 2022 01:04:43 GMT
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 815

POST
H2 200 shares-post.json Show response
api-public.addthis.com/url/serviceapi/ 2 B
314 B 208ms
192ms XHR
application/json 92.123.36.37
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://api-public.addthis.com/url/serviceapi/shares-post.json?services=sFbt&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.36.37 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-36-37.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://theparadise.ng/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-type: text/plain

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
surrogate-key: sFbt=https://theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam/
last-modified: Mon, 12 Sep 2022 01:00:00 GMT
server: nginx/1.15.8
date: Mon, 12 Sep 2022 01:04:43 GMT
content-type: application/json
access-control-allow-origin: https://theparadise.ng
cache-control: no-transform, max-age=0, s-maxage=14400
access-control-allow-credentials: true
content-length: 2

GET
H2 200 count.json Show response
widgets.pinterest.com/v1/urls/ 158 B
208 B 131ms
104ms Script
application/javascript 151.101.128.84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://widgets.pinterest.com/v1/urls/count.json?url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&callback=window._ate.cbs.rcb_e5f80

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.128.84 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

53041341dd803aad517e02943e27861ccd29f76cf0bfa4890d4a9ddb3e4fa1a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 0
vary: accept-encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: must-revalidate, max-age=887
x-envoy-upstream-service-time: 4
accept-ranges: none
x-pinterest-rid: 2384090851939936
expires: Mon, 12 Sep 2022 01:19:43 GMT

GET
H2 200 info.json Show response
www.reddit.com/api/ 144 B
991 B 150ms
120ms Script
application/javascript 151.101.129.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reddit.com/api/info.json?url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&jsonp=_ate.cbs.rcb_f0r50

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.129.140 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

snooserv /

Resource Hash

c48239057a5a613eba7dd6de1890c70a56cadcb1fa15d187ff77788e757a8dd6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-ratelimit-used: 1
via: 1.1 varnish
x-content-type-options: nosniff
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.2, "failure_fraction": 0.2}
strict-transport-security: max-age=31536000; includeSubdomains
content-length: 144
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge
x-moose: majestic
server: snooserv
x-frame-options: SAMEORIGIN
date: Mon, 12 Sep 2022 01:04:43 GMT
x-ratelimit-remaining: 299
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: X-Moose
cache-control: private, s-maxage=0, max-age=0, must-revalidate, no-store
x-ratelimit-reset: 317
accept-ranges: bytes
expires: -1

GET
H2 200 count.json Show response
widgets.pinterest.com/v1/urls/ 157 B
370 B 126ms
99ms Script
application/javascript 151.101.128.84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://widgets.pinterest.com/v1/urls/count.json?url=http%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&callback=window._ate.cbs.rcb_ig9e0

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.128.84 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

9d23ce52b7373c6ba03973340914317dcf2903ae81c656cf8efe8ebc52730fdb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 0
vary: accept-encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: must-revalidate, max-age=887
x-envoy-upstream-service-time: 2
accept-ranges: none
x-pinterest-rid: 1652052377009738
expires: Mon, 12 Sep 2022 01:19:43 GMT

GET
H2 200 info.json Show response
www.reddit.com/api/ 144 B
263 B 151ms
121ms Script
application/javascript 151.101.129.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reddit.com/api/info.json?url=http%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&jsonp=_ate.cbs.rcb_abro0

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.129.140 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

snooserv /

Resource Hash

c0d58beb181fc65ad9ecebd70019fb63bef266e09cd6f6a906e80963cd3e5399

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-ratelimit-used: 2
via: 1.1 varnish
x-content-type-options: nosniff
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.2, "failure_fraction": 0.2}
strict-transport-security: max-age=31536000; includeSubdomains
content-length: 144
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge
x-moose: majestic
server: snooserv
x-frame-options: SAMEORIGIN
date: Mon, 12 Sep 2022 01:04:43 GMT
x-ratelimit-remaining: 298
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: X-Moose
cache-control: private, s-maxage=0, max-age=0, must-revalidate, no-store
x-ratelimit-reset: 317
accept-ranges: bytes
expires: -1

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 1FE8 13 KB
13 KB 144ms
16ms Image
image/png 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=556&m=0&partner=52920&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F15516%2F190213%2F86f0f1f708604b2d82f69cc681c004dd_untitled-1.png&v=3&w=196&s=rJA6M-JvW6iNkO8_06dqU7ul

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

49ae1cb8c4f139beb5d828ee2823aa505b9fd5ca7455766659a2832bd8f5da1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=29563255
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 13048
expires: Sun, 20 Aug 2023 05:05:39 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 1FE8 11 KB
12 KB 163ms
35ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=52920&q=80&r=0&u=https%3A%2F%2Fcdn2.pipingrock.com%2Fimages%2Fproduct%2Fshoppingservice%2Fmelatonin-fast-dissolve-12-mg-180-fast-dissolve-tablets-7392.jpg&v=3&w=800&s=w8CV1smZ7Mvos2geVjB2KBVA&b=1200

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

852b348129a4382af1c4f09d102a030542224251eff484af23c7407d3a5d50cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31377743
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 11578
expires: Sun, 10 Sep 2023 05:07:07 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 1FE8 0
128 B 123ms
14ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=p9Eyp3pgPkQJ1wHp9TRCKjlD3xxFA1P_TIFw83NFM3S5M0J-G8hryFivMgCaJy1sVLxOUbfDSncdXAy-o3K4NlCSS-CVfKtZf-S_ty4uo4Y2nRJeh-XeozMVbAZd4Pqw-LFokamZPCg-6v1VzS4CntMjNXCWaUWc6BEMtx3C814q_jgonVl_tQyXL-KzhEWNfwiUw402RtzF-3O7KCSA47NcWCQZYQSkHbzZQptPGwhpkCrxMxmpTHwbIAkxYxUMskPMPA&sds=2&rev=82694&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 12 Sep 2022 01:04:43 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 1FE8 2 KB
1 KB 14ms
14ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 1FE8 2 KB
1 KB 15ms
15ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 150ms
16ms Preflight
application/json 178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Mon, 12 Sep 2022 01:04:42 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 532672
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 120ms
38ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://theparadise.ng
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 08:01:51 GMT
x-content-type-options: nosniff
age: 320572
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 08 Sep 2023 08:01:51 GMT

GET
H3 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame 23F9 12 KB
5 KB 40ms
23ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 3989587
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4420
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fn4qtjDTDnK988qGROHq01o1r%2FoJ7ntQpbj9IWiM74Ip5VvJuBZRSScawsWNVWpQXPyF74uOQdaC%2FxM64LGh6KerSxRbrIYnym%2FH5u9SGBlYpjuciLkuqn46JKpaYeUVQ5T%2BqCz9G3WjtK4VOTeMyc5B"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 7494bb0fb85c5c14-FRA
expires: Sat, 02 Sep 2023 01:04:43 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 23F9 12 KB
6 KB 26ms
14ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 3753f6ac31b748bf945ad731cbf52c0b_skyscannerrelative-book.woff
static.criteo.net/design/dt/ Frame 23F9 68 KB
68 KB 60ms
26ms Font
application/octet-stream 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/3753f6ac31b748bf945ad731cbf52c0b_skyscannerrelative-book.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

b40ed885c6eabc68309c7e3377008ec3aaba2add66e43fcf6fc2851cdc6a2f98

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Thu, 29 Jul 2021 10:27:15 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"61028283-10ec0"
strict-transport-security: max-age=31536000; preload;
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 e228b6a4e90947dcaf6c5ad0025ee925_skyscannerrelative-bold.woff
static.criteo.net/design/dt/ Frame 23F9 68 KB
68 KB 49ms
15ms Font
application/octet-stream 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/e228b6a4e90947dcaf6c5ad0025ee925_skyscannerrelative-bold.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

9cb93fc023cca355260310e41056be397ecad26f94a578c5b147762b40fc6d3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Thu, 29 Jul 2021 10:27:15 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"61028283-10f14"
strict-transport-security: max-age=31536000; preload;
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 23F9 24 KB
24 KB 43ms
26ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=1200&m=0&partner=7450&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F7450%2F211022%2F45f963b9b4db4061b7e96b7b9b33fb3d_img_horizontal_1.png&v=3&w=1200&s=aIsSsacyWVs96MWgv5ZIoipd

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

e861d3c3bf074c8b832c72921647e53513a1493a855cbfe43820933cbeb35dca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30216996
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 24138
expires: Sun, 27 Aug 2023 18:41:20 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 23F9 0
127 B 15ms
15ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=X_M6wXpgPkQJ1wHpL8lHPEjeVJMIDemhdlcrUCGIJref3EMO62ZbaMlosECbBurg_OA4gYkFh_VOmCZdMjsOPzy_Gaja78glZGqE1GRQjbMNrg6bs9VmCRARXyemNicxkzsJU_YqdVDmjP_lmqL6b2VwgeKX9W-nm7lUepgpYROdFvEHWCUVHUqNC9tABwrwlHn61-DwL2oHrackamnThiMYVVegiKe5QTiNdRb9w__hry9GYwSnSjL-6jdjSt_Tv_0fkg&sds=2&rev=82694&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 12 Sep 2022 01:04:42 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 23F9 2 KB
1 KB 15ms
14ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 23F9 2 KB
1 KB 15ms
14ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame E299 2 KB
1 KB 15ms
14ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Yx6FqgAJdd4Kd_kRAAwBcxLF10f87qKGAJBh_Q&u=%7ClQoq1dfOb%2FQOJQekhhTtJ3Bm4LScJaSSPv1sYuHVSQI%3D%7C&c1=0n2XosTo5clc2Y5hvSIf5j5HfVfFTixGa4yOK3LEx5zye4g5UWBXMcRJXio_xXJwHeKNhiRq3gWBCYy6L4bsHSjdNaU_P4YXfBgQCPQ3ykUSXZ0tOhbUjOmd0zatywb2yEEYKRnqEnBXFMUny7jgeMyK1AnEOzbAgT6_1zeLLqzLkitiyhZhsTQUtLFiIGt2BlLpFXULF1ibbyZRzYM-QRvxuBV2jr2D6BeC2qfcozZdI8YTlwmO6FgUZNDuqpoq4hr3pq6pnwA_fHV-3AIAa7WM_jM6LAF3xPmI-Hv5-AYgubf8FnrFr3SzrBP_rYc88LiewN3PAGVSau2p79ZYeoiM9tlkEci0WEEueFIEJVRxyr93-bQ6qvJnZoXb-oMRz17_vRS388cNhWO_L_Y-U1ixSZi8d6o8JjItz_LZNJzKRCSHStFwr59VMlQp4lxB6YUQrQxINLP2-haWSXwGt2KZMuxBL2A_vEBQ4IObTEvdX30npAal1FN2st3z_TqmCnUj1dkPSVNV19OIi2diC9IbXFyUfmnWnWDZo8JLW8rk8Gp3G41JeDIESkVH-u_tRBwjuhuNmfE8LNawACtwVgggyNNnytEhZlogzWr5P6DrPT4gvfdkgtIZzHEqXJYVVSCvtuqJgwg&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DChaYvqoUeY97rJZHy3wPzgrDABMme0rFcpfyT93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItMTEzMjU1OTM4Mjc0NjA3M6AB1bbS6gPIAQmpAoa-xJ3d2LA-qAMBqgSaAk_QQ4kpVF0hBVuC44l4mDtrT_hB0TF1QrbYbpEtHt15wUs68ReYAtDzLT0a-q0kiEGgN6xHuRupQs8uy4tSrfSs4iaZ1PCT0nfrDWG781FVE_jU45X9BmbCj-Z2lbubZhFvTAkFVKdKqd3k7GIqxT95OkPFTT-8ujEshX19auU-tUN5BTZTzdSFjjcxMvW4NhyhDZ9Rw8ibVlKzLZctIxYpBXa7XR2Mu4T-a6Zg6mRFHGdKc1ZvMkuZ5v5buEFTvgNtaGG0W0Ell2HuMGdQVJtZPpRChC8DDtTTlZC84QH0MN1wILAnEH1_mEvTgQJjTBAqWaPL1lJllejbtNbWO69Z2spQSfrTubigL_qzS-Dwg9CeCdf-ybyUxYAGir7AjffhgIVuoAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1OfnW7yNrYnxhjEf3nXs9iPQiFdA%26client%3Dca-pub-1132559382746073%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame E299 2 KB
1 KB 17ms
16ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame E299 308 B
636 B 15ms
14ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame E299 293 B
621 B 16ms
14ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 lg.php
cat.fr.eu.criteo.com/delivery/ Frame E299 43 B
347 B 23ms
22ms Image
image/gif 178.250.0.160
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.fr.eu.criteo.com/delivery/lg.php?cppv=3&cpp=9zw4AOwdF6-3_4c3mR53YRsIYXd_q99J_TSMMmmet_YZHdUaAWJRy1nGhb5Zzdu5VRBS_Q9bmgncSBRqYIZeBznYieMiDhyc5HAw6CjLuL1XXioplMoHv8h54GVEO_mhE4V7BcnnEhg0aBj5L9_lCVVCzRTFZmJQWHHWU8eG-VdiDCQwoPWs2IVAQ2jTiIOom1TILhWK0VgA8CpcnUr_uJoA6-WO3yUUhhF8QeoIs9Rbd9yB0Hx3bJLRl45S_hTTW4ID92QKtqchBQHxrhnnZO-xSm2hMxttlIn1R_VSJGSBetPuz9dG6ORagC5w5BK_e6sCN6rYqLj6eJmtgSBRaSsdw752ePLK_PEH2hP5yfZjsWDtSoUQYp68Wlozur4CTvpg5KAom7_SwNdVUl7pgAigM9pKM9QZQeEKur-AsebyOyjg523mEjjYFVPLGTk-ct_uDQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.160 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:42 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 3756165
content-type: image/gif
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 pica.js
theparadise.ng/cdn-cgi/challenge-platform/h/g/scripts/ Frame 831E 25 KB
9 KB 314ms
13ms Other
application/javascript 2606:4700:e2::ac40:8a0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://theparadise.ng/cdn-cgi/challenge-platform/h/g/scripts/pica.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8a0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b9fc07bbd23fcde3eeae813a803cfb57888b83b630505318679222e25aa83a08

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tichHSe8afK1WUXOq0Aw7RNZb3txCWw6oYq2PBEbWQI%2Bq1mP00q4Rw%2BbKsHGjiS4%2FxJjAC%2BOZoBbbzHkDt4gJ9Ush7lz1yKKaTURY3fRQ5n4dtz4sQl0MVtOx4QraFMPgzB6yJfZ0uuGRKU87g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
x-control-type-options: nosniff
cf-ray: 7494bb11bdaabb80-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
DATA 200
OK truncated
/ Frame 3C15 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a18661b1feb5c4e554ff381a1f7a40fd45edea2f91e4881318a178ee29e3cfa1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame 1FE8 2 KB
539 B 127ms
48ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400&subset=latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

234b9bab83aa0c52e9e5192995427a2bc44876cf1a11545ed631f369b8dc6534

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 11 Sep 2022 23:17:23 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 12 Sep 2022 01:04:43 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 12 Sep 2022 01:04:43 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 0050 12 KB
6 KB 16ms
15ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 0050 4 KB
4 KB 20ms
17ms Image
image/png 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=556&m=0&partner=71093&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F69968%2F200319%2F70a5634dc08c484a92b4a51841bcf0ce_unitednudelogo.png&v=3&w=196&s=q4mPnmJwT23d348B47j0VEI2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

5a1a8253fdc9653996614a8f70e40ef32ffad24fe68dd23ac39695ad85b816b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=29398290
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 4086
expires: Fri, 18 Aug 2023 07:16:14 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 0050 16 KB
16 KB 19ms
17ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fspace-kick-v-boot-women-grey-white-1-outside.jpg%3Fv%3D1645134647&v=3&w=800&s=-lZT2fLlf1eiMwjpuXmDhh8E&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

61cdaba86cb1a846cfe8511251b39fcee11b35da3829b1b1a8ba94fd21df902f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30893971
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 15922
expires: Mon, 04 Sep 2023 14:44:14 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 0050 18 KB
18 KB 22ms
20ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fspace-kick-women-grey-white-1-out.jpg%3Fv%3D1631849203&v=3&w=800&s=LgVfeSz0f6wPNe9Mfg2RMw8c&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

762a7b77077ba1625465af81e4ad7d9553b6e9b0296b2946a5a383fa33721f6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30108335
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 18660
expires: Sat, 26 Aug 2023 12:30:19 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 0050 26 KB
27 KB 20ms
18ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Froko-space-dark-spring-1-outside.jpg%3Fv%3D1631849224&v=3&w=800&s=EgdPlb0EMjkLVRMPi8szjaEz&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

3dfa57f04e9ccb0ab7d376aa1cab8822cdc958176fc2bd20aa8c8ea830387478

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30016799
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 26992
expires: Fri, 25 Aug 2023 11:04:43 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 0050 25 KB
25 KB 42ms
40ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fwa-run-lo-blue-beat-1-outside.jpg%3Fv%3D1645134663&v=3&w=800&s=Fcm59g6Yxt_1GGAKVeiN_OMY&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

7ec1ea6a5d7ce2078332c8ed54293ce4bfcad8e047b121cb79442df72c46536c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30716037
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 25648
expires: Sat, 02 Sep 2023 13:18:40 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 0050 23 KB
23 KB 35ms
34ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fdelta-ballet-scandinavian-out_5bfdfaef-54a1-4e80-95e0-e0c9980eef93.jpg%3Fv%3D1623337100&v=3&w=800&s=UnurAMpXis9Wk1BFt_0Eq3Hd&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

3cb45e0e3526ad9fe407c18f7506db38dc074deb8cf7d758266ae794fd2fe4c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30538279
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 23210
expires: Thu, 31 Aug 2023 11:56:02 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 0050 26 KB
27 KB 38ms
36ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fmobius-long-boot-hi-mono-outside.jpg%3Fv%3D1661371132&v=3&w=800&s=xcyYZVsedaegm8HpqDP-qfSO&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

89c364ea6daef261e87ace563ca0dd81f944c939e4769beca4c010f5cdc67430

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30340630
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 27112
expires: Tue, 29 Aug 2023 05:01:53 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 0050 12 KB
12 KB 42ms
40ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fwa-long-boot-lo-gargoyle-outside.jpg%3Fv%3D1659401975&v=3&w=800&s=bWsTD0kLwGoUzwLxGrc2tOJ4&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

582f15efe65ea228b232f0a86d79684017011d505ff1cbc603c1495231b850f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31202271
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 11936
expires: Fri, 08 Sep 2023 04:22:35 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 0050 27 KB
28 KB 46ms
44ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Froko-space-mist-1-outside.jpg%3Fv%3D1631849029&v=3&w=800&s=Mbgt5rcXkstB3KxXrVJyycxq&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

acb54eaad168950097664ed4842acf0c77053efbf2e4ebb8719f76b560fb6282

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29935671
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 28072
expires: Thu, 24 Aug 2023 12:32:34 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 0050 17 KB
17 KB 32ms
31ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fdelta-run-composite-out_a70db0f5-5b19-4cce-aca1-925a51250477.jpg%3Fv%3D1638482429&v=3&w=800&s=CN93G1Z0secmFZLiWHmV_jIO&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

20d966398aa614b28649eb18840ed43a405a84ec085c3013b8c0575dcf925dfc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30251710
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 16984
expires: Mon, 28 Aug 2023 04:19:54 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 0050 28 KB
28 KB 48ms
47ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fspace-kick-summer-women-rog-1-outside.jpg%3Fv%3D1645133771&v=3&w=800&s=tOTy1CpGzXb24vBMvLvoQIsb&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

7cc60de5360f91f302592180cebd5a16eda5ea2e72ca59722dc6933307b62f0c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30790422
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 28300
expires: Sun, 03 Sep 2023 09:58:25 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 0050 0
127 B 15ms
15ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=cRwlzXpgPkQJ1wHpxir6UmFlN9ZuW9LyWoX4NocbhddO01aC1U_qW6NofFQ-pmF6BHQZOuQeeOQ-0e0Sbk0iqcY2FFzLc8JJ-F-42cQ6HEdkn0k1qBf63HNZltHrGB9EuCdi2CaqMLuzi_NQFHZ0UPhkzkBvTMw_wLA5EWLf7mfMI1Q14SDBUAjD5Hg7TP4MZ0_jV5dDC-gcyQwr_UDx98s1D0zoLtmM72QBxm-RsVaV1xQDfwZ8PiBT_Ik&sds=2&rev=82694&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 12 Sep 2022 01:04:42 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 0050 2 KB
1 KB 15ms
15ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 0050 2 KB
1 KB 15ms
15ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame FD36 12 KB
6 KB 15ms
14ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame FD36 4 KB
4 KB 17ms
15ms Image
image/png 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

5a1a8253fdc9653996614a8f70e40ef32ffad24fe68dd23ac39695ad85b816b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=29398290
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 4086
expires: Fri, 18 Aug 2023 07:16:14 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame FD36 17 KB
17 KB 20ms
19ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fdelta-run-composite-out_a70db0f5-5b19-4cce-aca1-925a51250477.jpg%3Fv%3D1638482429&v=3&w=800&s=CN93G1Z0secmFZLiWHmV_jIO&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

20d966398aa614b28649eb18840ed43a405a84ec085c3013b8c0575dcf925dfc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30251710
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 16984
expires: Mon, 28 Aug 2023 04:19:54 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame FD36 28 KB
28 KB 17ms
16ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fspace-kick-summer-women-rog-1-outside.jpg%3Fv%3D1645133771&v=3&w=800&s=tOTy1CpGzXb24vBMvLvoQIsb&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

7cc60de5360f91f302592180cebd5a16eda5ea2e72ca59722dc6933307b62f0c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30790422
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 28300
expires: Sun, 03 Sep 2023 09:58:25 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame FD36 23 KB
23 KB 22ms
21ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fdelta-ballet-scandinavian-out_5bfdfaef-54a1-4e80-95e0-e0c9980eef93.jpg%3Fv%3D1623337100&v=3&w=800&s=UnurAMpXis9Wk1BFt_0Eq3Hd&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

3cb45e0e3526ad9fe407c18f7506db38dc074deb8cf7d758266ae794fd2fe4c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30538279
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 23210
expires: Thu, 31 Aug 2023 11:56:02 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame FD36 26 KB
27 KB 17ms
17ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fmobius-long-boot-hi-mono-outside.jpg%3Fv%3D1661371132&v=3&w=800&s=xcyYZVsedaegm8HpqDP-qfSO&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

89c364ea6daef261e87ace563ca0dd81f944c939e4769beca4c010f5cdc67430

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30340630
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 27112
expires: Tue, 29 Aug 2023 05:01:53 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame FD36 26 KB
27 KB 20ms
20ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Froko-space-dark-spring-1-outside.jpg%3Fv%3D1631849224&v=3&w=800&s=EgdPlb0EMjkLVRMPi8szjaEz&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

3dfa57f04e9ccb0ab7d376aa1cab8822cdc958176fc2bd20aa8c8ea830387478

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30016799
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 26992
expires: Fri, 25 Aug 2023 11:04:43 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame FD36 16 KB
16 KB 18ms
18ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

61cdaba86cb1a846cfe8511251b39fcee11b35da3829b1b1a8ba94fd21df902f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30893971
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 15922
expires: Mon, 04 Sep 2023 14:44:14 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame FD36 20 KB
20 KB 21ms
20ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fdelta-wedge-nude-1-outside.jpg%3Fv%3D1645133815&v=3&w=800&s=D1N4emJ7oi7of_qDAfxuZ4S8&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

8ed80b53559c06597961fd765bfe4593728b435387bfaf37f379a1f4a7ca6230

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30024743
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 20614
expires: Fri, 25 Aug 2023 13:17:07 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame FD36 13 KB
14 KB 22ms
20ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fgrip-loafer-mid-composite-outside.jpg%3Fv%3D1661370903&v=3&w=800&s=MqAF0fZDPovE_ef9rP63Nlq2&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

e452cd961f8fd3bae40b9b1fa1a68188ff465e797ec23ad4014f1e5ec5ab1c6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29992531
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 13820
expires: Fri, 25 Aug 2023 04:20:15 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame FD36 50 KB
50 KB 22ms
21ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fdelta-wedge-rog-1-outside.jpg%3Fv%3D1645133823&v=3&w=800&s=dU2ZGXUanicopR1VbVjlri6M&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

4280f24f73795dbfc0d7fad8b04c909d5ca3421007f90b43dfb9b998e2a90f34

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30633964
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 51082
expires: Fri, 01 Sep 2023 14:30:47 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame FD36 25 KB
25 KB 22ms
21ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fspace-kick-summer-women-black-1-outside.jpg%3Fv%3D1645133787&v=3&w=800&s=NE-0z0-lozdayJ0PWlWcyGp9&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

028677c8a947f497e9a555436e71007b88cae3ef7312b4fcb37719ae1f669551

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30887011
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 25750
expires: Mon, 04 Sep 2023 12:48:14 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame FD36 0
127 B 15ms
14ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=aA7OunpgPkQJ1wHpv8F9BRTocEzuCIoHsZji5rS0fPnvR2BhXLnq7TqC7KWZyADhdLrJoNtHz4PEUeK4RF3rBP4wvlQdc7aQzNLb89q04IAWsDnzXTG3wQTHCjmwKxyrHL1sNi9W0w3M7kTPMwZkXFuMZWTLEKJaildCjOM1Eh-sjNhWggVYWN6fQ4yEeTnAScMjV0LZA8Nj0Ir95azePxjBdgqTs38WdmgwniARks_85PrT_hBxacPAPQ8&sds=2&rev=82694&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 12 Sep 2022 01:04:42 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame FD36 2 KB
1 KB 17ms
17ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame FD36 2 KB
1 KB 26ms
25ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame C4E7 12 KB
6 KB 15ms
15ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 4 KB
4 KB 15ms
15ms Image
image/png 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

5a1a8253fdc9653996614a8f70e40ef32ffad24fe68dd23ac39695ad85b816b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=29398290
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 4086
expires: Fri, 18 Aug 2023 07:16:14 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 5 KB
5 KB 20ms
14ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fgrip-loafer-mid-composite-outside.jpg%3Fv%3D1661370903&v=3&w=400&s=4f8JXsX2C1Szg-qVYfAGkyPE&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

4f22e352c3bc5d92b517e1e11f433befbdabf295f9645370bdd35ab3656853b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29992531
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 4768
expires: Fri, 25 Aug 2023 04:20:15 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 6 KB
7 KB 26ms
19ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fspace-kick-summer-women-black-1-outside.jpg%3Fv%3D1645133787&v=3&w=400&s=EL5lzfAue_38AQ0P3XlzyxLz&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

709498951b9d483f4b3d96481be60d476d94a4fbea2bbadf42878f64c686038b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30887011
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 6522
expires: Mon, 04 Sep 2023 12:48:14 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 7 KB
7 KB 25ms
18ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fspace-kick-summer-women-rog-1-outside.jpg%3Fv%3D1645133771&v=3&w=400&s=fHTxPpsgZdXTQTyrfXfDdZBq&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

500cb6934ff00c4592847e76afa69fd28a7bc7ba49ca69f7c724bca5d13b4939

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30790422
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 7372
expires: Sun, 03 Sep 2023 09:58:25 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 7 KB
7 KB 24ms
17ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fspace-kick-v-boot-women-vintage-blue-1-out.jpg%3Fv%3D1631849205&v=3&w=400&s=BhWg8eLgVlTtlTd6GXgkfD6J&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

940d0fa4bafe6ab768d2c206c8116b9b8413724431335dbca042ea01c046561e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30117666
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 6736
expires: Sat, 26 Aug 2023 15:05:49 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 4 KB
5 KB 23ms
17ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fbounce-sandal-black-1-outside_60a26cc5-660f-46e3-8ad7-28afdafd96d1.jpg%3Fv%3D1642742889&v=3&w=400&s=cJ_s9oWMwzdIn2JHbrxCYFHr&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

dcff6cf62461d2312ac36c7778caa7afee4125d5f04f14e1c11b9c02098bdaf0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30177557
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 4406
expires: Sun, 27 Aug 2023 07:44:01 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 4 KB
5 KB 28ms
21ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fdelta-wedge-nude-1-outside.jpg%3Fv%3D1645133815&v=3&w=400&s=dttMK2Rl2bZFtgRzX3e-2Bsz&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

e0e8682bdc5e22db5ddd3ba511486a598561be88b04abcc6459ef973881f765d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30024743
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 4490
expires: Fri, 25 Aug 2023 13:17:07 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 9 KB
9 KB 22ms
16ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fmobius-long-boot-hi-mono-outside.jpg%3Fv%3D1661371132&v=3&w=400&s=76t1py4tKX91U2eWh73wFPeh&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

dae46245ef1fe990e750fcdd709692b086e17b1790ea3782e9bfbf8561be441c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30340630
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 8774
expires: Tue, 29 Aug 2023 05:01:53 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 8 KB
8 KB 26ms
20ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Froko-space-mist-1-outside.jpg%3Fv%3D1631849029&v=3&w=400&s=7_D0gD6AAffmErUAU_TQGv32&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

2cb071f9b52cd57bff7f866e2cb93ce9d6ae1804b10d9eb3e9599075967ecd85

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29935671
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 7692
expires: Thu, 24 Aug 2023 12:32:34 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 4 KB
4 KB 22ms
16ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fspace-kick-women-grey-white-1-out.jpg%3Fv%3D1631849203&v=3&w=400&s=-P2nsQb0FKTWEFRXvpqOCnyS&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

b4bbcfbe3d5a6d4e9316840be39545c183e8cb116fc1526cfcdec1200a481b45

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30108335
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 4294
expires: Sat, 26 Aug 2023 12:30:19 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 10 KB
10 KB 26ms
21ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Flev-calli-hi-silver-grey-outside.jpg%3Fv%3D1630226281&v=3&w=400&s=uu_cdhpAURhBQPtWxWBCyJTi&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

f4bcd92015b1af32481c4673d14acb4f9c7871d2092c1c23b1986749a6e20f66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31224846
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 10122
expires: Fri, 08 Sep 2023 10:38:50 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 6 KB
6 KB 28ms
22ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fspace-kick-max-women-mono-pavement-1-outside.jpg%3Fv%3D1631849033&v=3&w=400&s=cq-McPkZCEZPqmKVmkP4VVxa&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

762da8b35ea43269689a85dd6ee90d16ea187d9e65e98f783737a703bc127661

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29927600
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 6320
expires: Thu, 24 Aug 2023 10:18:04 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 7 KB
8 KB 32ms
27ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Froko-space-dark-spring-1-outside.jpg%3Fv%3D1631849224&v=3&w=400&s=TE3q5aa437kLHrcGF_7V8yOM&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

0950a870ed7fc321504c6f4dabff8000bf43be014d1a91c32fb49a4ea6336940

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30016799
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 7462
expires: Fri, 25 Aug 2023 11:04:43 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 6 KB
6 KB 28ms
23ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fspace-kick-v-boot-women-grey-white-1-outside.jpg%3Fv%3D1645134647&v=3&w=400&s=B40NuafzgguRmupn0vsAvY6c&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

0bd5a37dc03826e35a281502820c716aa01809a29ea5c97b63d5da551dd25aa3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30893971
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 5974
expires: Mon, 04 Sep 2023 14:44:14 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 13 KB
13 KB 29ms
24ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fdelta-wedge-rog-1-outside.jpg%3Fv%3D1645133823&v=3&w=400&s=wdnXHe7jmJ90xnVCMu28SDY6&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

c89e1f42bed0731437a8759856f7d1c24648c7db8eb198e63e13fefe8001ba77

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30633964
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 12852
expires: Fri, 01 Sep 2023 14:30:47 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 23 KB
23 KB 30ms
25ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fglam-bootie-berlin-outside.jpg%3Fv%3D1659402573&v=3&w=400&s=ezm8pZyOXuc6ABBBPDryb8b8&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

ffe8184c3325c3bfa6c52f7bb45022e84028d85cac562a53535cf406c13b6006

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30979209
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 23654
expires: Tue, 05 Sep 2023 14:24:52 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 4 KB
4 KB 79ms
74ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Ffold-hi-black-out_c8aba941-e1c5-42a4-8ec5-35f196e81cef.jpg%3Fv%3D1610068296&v=3&w=400&s=1vkyniUByhYLYIax4ViYIHBv&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

54c0cd01d9687b483b0c0b2af5853fe8e1e282b6b2be25f0ef858a5eb4f7af37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30361886
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 3854
expires: Tue, 29 Aug 2023 10:56:10 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 2 KB
2 KB 29ms
25ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fwa-long-boot-lo-gargoyle-outside.jpg%3Fv%3D1659401975&v=3&w=400&s=sGWcWy_W04B04zl2afe2R4N1&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

d49d3cff930d3a90432477f8fb875d17680761c3012ad9278d837258064a5f44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31202271
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 2138
expires: Fri, 08 Sep 2023 04:22:35 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 8 KB
8 KB 28ms
23ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Froko-bootie-ushuaia-outside.jpg%3Fv%3D1661877266&v=3&w=400&s=SAT5KKfunw2qZusLXPS4mBOG&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

6c895bf44d5da690370510ab0288dd9f5a5ed531a088065440fb2ae3553b4309

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30511059
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 7930
expires: Thu, 31 Aug 2023 04:22:23 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 6 KB
6 KB 30ms
26ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fko-mid-natural-1-outside.jpg%3Fv%3D1645134333&v=3&w=400&s=9EzZcIc0CagaRF9EgGJ8PmtC&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

e17d22c941eed01ca1a6a1d67cb028e4f7030a313fb1925ee3c25bb743b400c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30109406
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 5960
expires: Sat, 26 Aug 2023 12:48:10 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 6 KB
7 KB 31ms
26ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fwa-run-lo-blue-beat-1-outside.jpg%3Fv%3D1645134663&v=3&w=400&s=DJHQRvG1DXz7Aj334II05O8p&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

5ae8337b4b0da31129f8e699ce777b823690d2b13b3c60ac505386350987a53b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30716037
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 6482
expires: Sat, 02 Sep 2023 13:18:40 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 8 KB
9 KB 31ms
27ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fspace-kick-v-boot-women-black-marble-1-outside.jpg%3Fv%3D1631849031&v=3&w=400&s=os4IJyIlhlhmd9sVbXUnwMCl&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

e2c068caa1884b67b10d63098d87db9ea8e796c4e5f5452e74ecc6689124715c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30027384
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 8600
expires: Fri, 25 Aug 2023 14:01:07 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 8 KB
8 KB 32ms
28ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Froko-hype-nude-1-outside.jpg%3Fv%3D1645134748&v=3&w=400&s=hdLngKSoN1SQuPK7xm_C41Zk&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

275400f2d6b8f4c294a8b67f4ef141d951e6e5cfebe2440946168a01fe745020

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30885412
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 8202
expires: Mon, 04 Sep 2023 12:21:35 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 5 KB
6 KB 36ms
32ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fdelta-ballet-scandinavian-out_5bfdfaef-54a1-4e80-95e0-e0c9980eef93.jpg%3Fv%3D1623337100&v=3&w=400&s=sI9bg2cXnvgqXW-NUGzdx1s0&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

9274ac1b5f087b953061f5a808bd0efa43c4ba859acd1342aa3bbc1abd4a872a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30538278
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 5438
expires: Thu, 31 Aug 2023 11:56:02 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 7 KB
8 KB 34ms
30ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Froko-y-montreal-outside.jpg%3Fv%3D1659593073&v=3&w=400&s=g6AEIbunW10ElfZ21m4QFHCw&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

87b334ef27de51e4151e70243168b7c38966d413e785bec8de26425111423a57

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29042652
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 7586
expires: Mon, 14 Aug 2023 04:28:55 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 5 KB
5 KB 38ms
34ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fdelta-run-composite-out_a70db0f5-5b19-4cce-aca1-925a51250477.jpg%3Fv%3D1638482429&v=3&w=400&s=hETsa3On7rHUveGxqo8v1fv5&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

f7e55a560e407268e7035e074fc8360bee0d2b7c8a8578e9231507801a377eaa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30251710
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 4616
expires: Mon, 28 Aug 2023 04:19:54 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 6 KB
6 KB 33ms
29ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fmolten-flow-bootie-hi-cobalt-blue-out_0c7c4f55-fbd2-42e7-b2a5-1a647cd2326d.jpg%3Fv%3D1623338001&v=3&w=400&s=KMzUZebjZgFRJtm24AJ6R4GU&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

775916d4b61cb25c4a72f8c17768152f2ae8b2cd05e17b53c98bb9936f75f440

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30251734
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 6120
expires: Mon, 28 Aug 2023 04:20:18 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 6 KB
6 KB 36ms
33ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fgrip-chelsea-lo-quiet-grey-outside.jpg%3Fv%3D1659402551&v=3&w=400&s=2i394gyb4eN-DdmrgzJkLEef&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

33025cf788bb042b442f264c634352bd31ac5002c5227937aa6316c1834d55e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31029418
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 6140
expires: Wed, 06 Sep 2023 04:21:41 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 4 KB
4 KB 35ms
31ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fmobius-mid-black-out_6a528ecf-31f0-4983-85cd-cb944b01c549.jpg%3Fv%3D1633698106&v=3&w=400&s=a6cTxrUAkgvph3Ka03Pm75Zf&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

5df610992e3c56fe164e149309c511ccb67cfcd9e14ba321b516f57b8f492368

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29845268
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 3722
expires: Wed, 23 Aug 2023 11:25:52 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 8 KB
8 KB 31ms
28ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fdelta-wedge-black-1-outside.jpg%3Fv%3D1645133831&v=3&w=400&s=gdUjgIYxyLB1nGd2NXqEkqKm&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

fe323e2a147d519faf5c69b42f670a9af698c7ade22b63f3a5bc0d1a391806a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30033264
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 8088
expires: Fri, 25 Aug 2023 15:39:08 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 4 KB
4 KB 35ms
32ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fmobius-mid-red-glow-1-outside.jpg%3Fv%3D1644635889&v=3&w=400&s=ZU4XvAwL5Rua8uZr09kKx-2p&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

c4c0332f45863ad84aaa4e7305f97a58c95c3e6d8625fa7adc4d2f7d9017cd2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29665237
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 3860
expires: Mon, 21 Aug 2023 09:25:21 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame C4E7 0
127 B 17ms
15ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=sf5Av3pgPkQJ1wHpJSBG6SRCu48VrtS_szLR1RAoPvrFzUnKay7MRizEKYvvQBBupLRZNJ_EMODqYZ4hsLUKLPIdmsY2BWZRolm_cD1JOKv3Kg-4rk6Kad879uxykEWQUiU4TSKnMD3ycLNWJP0kis85XRI3NCi127c_M0Yer4kd7eSFOU5mjw3IhrKAAtIlsWfi1hmRJITs-G6l99M4WzQxv1-GzA2y5GtlVG4MzqndqPNDQ3yxgJWXgpg&sds=2&rev=82694&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 12 Sep 2022 01:04:43 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame C4E7 2 KB
1 KB 17ms
14ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame C4E7 2 KB
1 KB 17ms
15ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 0AD5 0
0 70ms
70ms Image
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220907&jk=2384351373504603&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 1FE8 15 KB
15 KB 117ms
38ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400&subset=latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 08:01:51 GMT
x-content-type-options: nosniff
age: 320572
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 08 Sep 2023 08:01:51 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame E299 12 KB
6 KB 18ms
18ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E299 7 KB
7 KB 17ms
16ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fspace-kick-summer-women-rog-1-outside.jpg%3Fv%3D1645133771&v=3&w=400&s=fHTxPpsgZdXTQTyrfXfDdZBq&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

500cb6934ff00c4592847e76afa69fd28a7bc7ba49ca69f7c724bca5d13b4939

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30790422
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 7372
expires: Sun, 03 Sep 2023 09:58:25 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E299 8 KB
8 KB 18ms
15ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Froko-space-mist-1-outside.jpg%3Fv%3D1631849029&v=3&w=400&s=7_D0gD6AAffmErUAU_TQGv32&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

2cb071f9b52cd57bff7f866e2cb93ce9d6ae1804b10d9eb3e9599075967ecd85

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29935671
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 7692
expires: Thu, 24 Aug 2023 12:32:34 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E299 6 KB
6 KB 20ms
17ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fspace-kick-v-boot-women-grey-white-1-outside.jpg%3Fv%3D1645134647&v=3&w=400&s=B40NuafzgguRmupn0vsAvY6c&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

0bd5a37dc03826e35a281502820c716aa01809a29ea5c97b63d5da551dd25aa3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30893971
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 5974
expires: Mon, 04 Sep 2023 14:44:14 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E299 9 KB
9 KB 21ms
18ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fmobius-long-boot-hi-mono-outside.jpg%3Fv%3D1661371132&v=3&w=400&s=76t1py4tKX91U2eWh73wFPeh&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

dae46245ef1fe990e750fcdd709692b086e17b1790ea3782e9bfbf8561be441c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30340630
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 8774
expires: Tue, 29 Aug 2023 05:01:53 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E299 7 KB
8 KB 19ms
16ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Froko-space-dark-spring-1-outside.jpg%3Fv%3D1631849224&v=3&w=400&s=TE3q5aa437kLHrcGF_7V8yOM&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

0950a870ed7fc321504c6f4dabff8000bf43be014d1a91c32fb49a4ea6336940

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30016799
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 7462
expires: Fri, 25 Aug 2023 11:04:43 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E299 7 KB
7 KB 18ms
16ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fspace-kick-v-boot-women-vintage-blue-1-out.jpg%3Fv%3D1631849205&v=3&w=400&s=BhWg8eLgVlTtlTd6GXgkfD6J&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

940d0fa4bafe6ab768d2c206c8116b9b8413724431335dbca042ea01c046561e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30117666
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 6736
expires: Sat, 26 Aug 2023 15:05:49 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E299 2 KB
2 KB 23ms
19ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fwa-long-boot-lo-gargoyle-outside.jpg%3Fv%3D1659401975&v=3&w=400&s=sGWcWy_W04B04zl2afe2R4N1&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

d49d3cff930d3a90432477f8fb875d17680761c3012ad9278d837258064a5f44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31202271
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 2138
expires: Fri, 08 Sep 2023 04:22:35 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E299 13 KB
13 KB 27ms
24ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fdelta-wedge-rog-1-outside.jpg%3Fv%3D1645133823&v=3&w=400&s=wdnXHe7jmJ90xnVCMu28SDY6&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

c89e1f42bed0731437a8759856f7d1c24648c7db8eb198e63e13fefe8001ba77

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30633964
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 12852
expires: Fri, 01 Sep 2023 14:30:47 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E299 5 KB
5 KB 24ms
21ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

4f22e352c3bc5d92b517e1e11f433befbdabf295f9645370bdd35ab3656853b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29992531
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 4768
expires: Fri, 25 Aug 2023 04:20:15 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E299 10 KB
10 KB 24ms
21ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Flev-calli-hi-silver-grey-outside.jpg%3Fv%3D1630226281&v=3&w=400&s=uu_cdhpAURhBQPtWxWBCyJTi&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

f4bcd92015b1af32481c4673d14acb4f9c7871d2092c1c23b1986749a6e20f66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31224846
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 10122
expires: Fri, 08 Sep 2023 10:38:50 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E299 8 KB
8 KB 19ms
16ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Froko-hype-nude-1-outside.jpg%3Fv%3D1645134748&v=3&w=400&s=hdLngKSoN1SQuPK7xm_C41Zk&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

275400f2d6b8f4c294a8b67f4ef141d951e6e5cfebe2440946168a01fe745020

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30885412
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 8202
expires: Mon, 04 Sep 2023 12:21:35 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E299 6 KB
7 KB 23ms
20ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fspace-kick-summer-women-black-1-outside.jpg%3Fv%3D1645133787&v=3&w=400&s=EL5lzfAue_38AQ0P3XlzyxLz&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

709498951b9d483f4b3d96481be60d476d94a4fbea2bbadf42878f64c686038b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30887011
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 6522
expires: Mon, 04 Sep 2023 12:48:14 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E299 23 KB
23 KB 24ms
21ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fglam-bootie-berlin-outside.jpg%3Fv%3D1659402573&v=3&w=400&s=ezm8pZyOXuc6ABBBPDryb8b8&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

ffe8184c3325c3bfa6c52f7bb45022e84028d85cac562a53535cf406c13b6006

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30979208
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 23654
expires: Tue, 05 Sep 2023 14:24:52 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E299 4 KB
5 KB 28ms
25ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fbounce-sandal-black-1-outside_60a26cc5-660f-46e3-8ad7-28afdafd96d1.jpg%3Fv%3D1642742889&v=3&w=400&s=cJ_s9oWMwzdIn2JHbrxCYFHr&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

dcff6cf62461d2312ac36c7778caa7afee4125d5f04f14e1c11b9c02098bdaf0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30177557
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 4406
expires: Sun, 27 Aug 2023 07:44:01 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E299 5 KB
6 KB 27ms
24ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fdelta-ballet-scandinavian-out_5bfdfaef-54a1-4e80-95e0-e0c9980eef93.jpg%3Fv%3D1623337100&v=3&w=400&s=sI9bg2cXnvgqXW-NUGzdx1s0&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

9274ac1b5f087b953061f5a808bd0efa43c4ba859acd1342aa3bbc1abd4a872a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30538278
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 5438
expires: Thu, 31 Aug 2023 11:56:02 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E299 5 KB
5 KB 28ms
25ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fdelta-run-composite-out_a70db0f5-5b19-4cce-aca1-925a51250477.jpg%3Fv%3D1638482429&v=3&w=400&s=hETsa3On7rHUveGxqo8v1fv5&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

f7e55a560e407268e7035e074fc8360bee0d2b7c8a8578e9231507801a377eaa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30251710
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 4616
expires: Mon, 28 Aug 2023 04:19:54 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E299 4 KB
4 KB 26ms
24ms Image
image/png 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=244&m=0&partner=71093&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F69968%2F200319%2F70a5634dc08c484a92b4a51841bcf0ce_unitednudelogo.png&v=3&w=196&s=cyLM27ltJg9nyNQhZom2SNzQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

5a1a8253fdc9653996614a8f70e40ef32ffad24fe68dd23ac39695ad85b816b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=29398290
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 4086
expires: Fri, 18 Aug 2023 07:16:14 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E299 6 KB
7 KB 28ms
26ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fwa-run-lo-scandinavian-1-outside.jpg%3Fv%3D1645134672&v=3&w=400&s=S3q5yEYenQ0_AsedtdvRxEgY&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

1288f3fcfdaadf5f14bd51527de6509725b1114e114680a5d5f2cfb73fbf4a10

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30698622
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 6524
expires: Sat, 02 Sep 2023 08:28:26 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E299 7 KB
7 KB 26ms
24ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fpocket-lev-silver-grey-outside.jpg%3Fv%3D1632929718&v=3&w=400&s=ru2IoepfZoAnscelJcFKlTUE&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

e01c923f9aadba3a117154ba6c1bbedb9d105661cbe61c42b068ad070cab4437

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31069464
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 7204
expires: Wed, 06 Sep 2023 15:29:08 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame E299 0
127 B 18ms
16ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=GXaVgnpgPkQJ1wHpbuW7X4jhseq8EW3BPf8cTwPLfr2s_MM5RxPVjVRx_A_uKKe71Zju4qNXhUyEK9LnfsGOT51MRyXUS5WDByOcR-gsyId065kI0489jIyB26-i3A3qPb_-Av6Evpr38aP5M_vn_qE3NK8osdzKvtNAfhXLeQXAXbrcQFH5Eu07rlaNeNAKMCD-5WL49rpIckEihbElG12NMXYc88uENXEZ3WjVttmuhw_93kVpEwz4X_-Rm4mMxryLHw&sds=2&rev=82694&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 12 Sep 2022 01:04:42 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame E299 2 KB
1 KB 18ms
17ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame E299 2 KB
1 KB 18ms
17ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 07 Sep 2023 01:04:43 GMT

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 48 KB
13 KB 17ms
17ms Script
text/javascript 2606:4700:10::6816:3556
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: jsc.mgid.com
URL: https://jsc.mgid.com/t/h/theparadise.ng.1149345.es6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3556 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e85815908064ec7977f13468af609ac980317a21b5b519cfa107948cf76b8ce9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 31 Aug 2022 11:00:45 GMT
server: cloudflare
age: 936
etag: W/"b17c28d6fd88a6b12feea5c52e9a7485"
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-ray: 7494bb118f2d91ef-FRA
x-amz-request-id: QDJ9R5CVV2749CKB
x-amz-id-2: uVNmhB5CKjvW2kk6nRvAAf2zFKzUZJGA7DDEuDmwhdWc2UFdhoWIxBcT17B4tBgSKZtq5vmjCwU=

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 5 KB
5 KB 16ms
16ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

4f22e352c3bc5d92b517e1e11f433befbdabf295f9645370bdd35ab3656853b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29992531
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 4768
expires: Fri, 25 Aug 2023 04:20:15 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 9 KB
9 KB 23ms
17ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fmobius-long-boot-hi-mono-outside.jpg%3Fv%3D1661371132&v=3&w=400&s=76t1py4tKX91U2eWh73wFPeh&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

dae46245ef1fe990e750fcdd709692b086e17b1790ea3782e9bfbf8561be441c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30340630
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 8774
expires: Tue, 29 Aug 2023 05:01:53 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 4 KB
5 KB 21ms
15ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fbounce-sandal-black-1-outside_60a26cc5-660f-46e3-8ad7-28afdafd96d1.jpg%3Fv%3D1642742889&v=3&w=400&s=cJ_s9oWMwzdIn2JHbrxCYFHr&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

dcff6cf62461d2312ac36c7778caa7afee4125d5f04f14e1c11b9c02098bdaf0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30177557
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 4406
expires: Sun, 27 Aug 2023 07:44:01 GMT

GET
H3 200 JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js Show response
pagead2.googlesyndication.com/bg/ Frame FEF9 36 KB
16 KB 40ms
36ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2510ed81c525ffb3948c9e103bc6d56f036e45346a0d4c6e481602c223c74ba5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 22:49:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8084
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15893
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 11 Sep 2023 22:49:59 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 7 KB
7 KB 23ms
19ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fspace-kick-v-boot-women-vintage-blue-1-out.jpg%3Fv%3D1631849205&v=3&w=400&s=BhWg8eLgVlTtlTd6GXgkfD6J&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

940d0fa4bafe6ab768d2c206c8116b9b8413724431335dbca042ea01c046561e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30117666
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 6736
expires: Sat, 26 Aug 2023 15:05:49 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 7 KB
7 KB 22ms
18ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fspace-kick-summer-women-rog-1-outside.jpg%3Fv%3D1645133771&v=3&w=400&s=fHTxPpsgZdXTQTyrfXfDdZBq&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

500cb6934ff00c4592847e76afa69fd28a7bc7ba49ca69f7c724bca5d13b4939

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30790422
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 7372
expires: Sun, 03 Sep 2023 09:58:25 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 6 KB
7 KB 20ms
16ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fspace-kick-summer-women-black-1-outside.jpg%3Fv%3D1645133787&v=3&w=400&s=EL5lzfAue_38AQ0P3XlzyxLz&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

709498951b9d483f4b3d96481be60d476d94a4fbea2bbadf42878f64c686038b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30887011
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 6522
expires: Mon, 04 Sep 2023 12:48:14 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 8 KB
8 KB 24ms
20ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Froko-space-mist-1-outside.jpg%3Fv%3D1631849029&v=3&w=400&s=7_D0gD6AAffmErUAU_TQGv32&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

2cb071f9b52cd57bff7f866e2cb93ce9d6ae1804b10d9eb3e9599075967ecd85

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29935671
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 7692
expires: Thu, 24 Aug 2023 12:32:34 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 10 KB
10 KB 21ms
17ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Flev-calli-hi-silver-grey-outside.jpg%3Fv%3D1630226281&v=3&w=400&s=uu_cdhpAURhBQPtWxWBCyJTi&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

f4bcd92015b1af32481c4673d14acb4f9c7871d2092c1c23b1986749a6e20f66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31224846
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 10122
expires: Fri, 08 Sep 2023 10:38:50 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 6 KB
6 KB 18ms
16ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fspace-kick-v-boot-women-grey-white-1-outside.jpg%3Fv%3D1645134647&v=3&w=400&s=B40NuafzgguRmupn0vsAvY6c&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

0bd5a37dc03826e35a281502820c716aa01809a29ea5c97b63d5da551dd25aa3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30893971
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 5974
expires: Mon, 04 Sep 2023 14:44:14 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 13 KB
13 KB 21ms
19ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fdelta-wedge-rog-1-outside.jpg%3Fv%3D1645133823&v=3&w=400&s=wdnXHe7jmJ90xnVCMu28SDY6&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

c89e1f42bed0731437a8759856f7d1c24648c7db8eb198e63e13fefe8001ba77

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30633964
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 12852
expires: Fri, 01 Sep 2023 14:30:47 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 2 KB
2 KB 20ms
18ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fwa-long-boot-lo-gargoyle-outside.jpg%3Fv%3D1659401975&v=3&w=400&s=sGWcWy_W04B04zl2afe2R4N1&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

d49d3cff930d3a90432477f8fb875d17680761c3012ad9278d837258064a5f44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31202271
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 2138
expires: Fri, 08 Sep 2023 04:22:35 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 23 KB
23 KB 19ms
17ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fglam-bootie-berlin-outside.jpg%3Fv%3D1659402573&v=3&w=400&s=ezm8pZyOXuc6ABBBPDryb8b8&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

ffe8184c3325c3bfa6c52f7bb45022e84028d85cac562a53535cf406c13b6006

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30979208
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 23654
expires: Tue, 05 Sep 2023 14:24:52 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 7 KB
8 KB 21ms
20ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Froko-space-dark-spring-1-outside.jpg%3Fv%3D1631849224&v=3&w=400&s=TE3q5aa437kLHrcGF_7V8yOM&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

0950a870ed7fc321504c6f4dabff8000bf43be014d1a91c32fb49a4ea6336940

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30016799
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 7462
expires: Fri, 25 Aug 2023 11:04:43 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 8 KB
8 KB 21ms
20ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Froko-hype-nude-1-outside.jpg%3Fv%3D1645134748&v=3&w=400&s=hdLngKSoN1SQuPK7xm_C41Zk&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

275400f2d6b8f4c294a8b67f4ef141d951e6e5cfebe2440946168a01fe745020

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30885412
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 8202
expires: Mon, 04 Sep 2023 12:21:35 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 5 KB
6 KB 17ms
17ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fdelta-ballet-scandinavian-out_5bfdfaef-54a1-4e80-95e0-e0c9980eef93.jpg%3Fv%3D1623337100&v=3&w=400&s=sI9bg2cXnvgqXW-NUGzdx1s0&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

9274ac1b5f087b953061f5a808bd0efa43c4ba859acd1342aa3bbc1abd4a872a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30538278
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 5438
expires: Thu, 31 Aug 2023 11:56:02 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame C4E7 5 KB
5 KB 17ms
17ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fdelta-run-composite-out_a70db0f5-5b19-4cce-aca1-925a51250477.jpg%3Fv%3D1638482429&v=3&w=400&s=hETsa3On7rHUveGxqo8v1fv5&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

f7e55a560e407268e7035e074fc8360bee0d2b7c8a8578e9231507801a377eaa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30251710
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 4616
expires: Mon, 28 Aug 2023 04:19:54 GMT

GET
H2 204 starti
s-10.channelexco.com/ppx/ 0
109 B 152ms
120ms Image
text/plain 192.96.200.88
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-10.channelexco.com/ppx/starti?sid=&domain=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&se=3e986fd3-1ca0-4575-9879-7de2898d44e1&pv=117.25&dd=theparadise.ng&sa=shd&s=0.0&p=1548817699&cb=1662944683814
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.96.200.88 Ashburn, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: openresty /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:43 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
server: openresty

GET
H2 200 hls.min.js Show response
cdn.ex.co/player/hls/ 247 KB
71 KB 82ms
7ms Script
application/javascript 23.36.163.226
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ex.co/player/hls/hls.min.js
Requested by: Host: player.ex.co
URL: https://player.ex.co/player/949f6068-329e-4344-84e7-de26e7f62396
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.163.226 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-226.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 87bdf34d158b451ca6e6113760d8f959d43ad17373c7ac0aa70b6789f21a26b8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
vary: Accept-Encoding
content-length: 72020
last-modified: Wed, 08 Jun 2022 07:43:05 GMT
server: AmazonS3
etag: "e09058f03d6f30d32f677a963cc1572b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
access-control-allow-credentials: false
accept-ranges: bytes
access-control-allow-headers: *
expires: Mon, 19 Sep 2022 01:04:43 GMT

GET
H2 200 rtb_vast_proxy Show response
p.channelexco.com/ 60 B
436 B 136ms
136ms XHR
text/xml 192.96.200.88
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to

Full URL: https://p.channelexco.com/rtb_vast_proxy?ap=PSMiUF99bW8lUX5hO21IMhrqxYdxPIw30Ije1KfTOJBQfuAk5FEkcaAV_-tOq3Uz30CuBqD2cZiFsHi-jdzX00z4rKFssgx-ch51dZ8VWX0beV0n00Uy7BooyDXNabHt0tp7ofItFqlJcrEWv6lJ9nQeRTA6YUHaZ2JVvcCgubeRg4CKf_YN3uhlFVk6l3jDYaW4nUpEBpQ75lDHy4sRDumlMRmHNxUBGGBhJ1uyq1z5F6y2RxvR-AxcEscFT-Z-XamAKXN5GTxTmb2UUh9Z1GpbDGntsFQUvZ9AhgEtqR1aqRCeBNLgK8G5y6I5qd9xxjpv1BJtdnAOomolZmr3k4di_QlrI6xCXM_ab3baYkaw0jJN6FysBTrN9XGcFJfXfLBaWMe0AyKuRP3h_mgV4ECD348skFdkxKd13mobw2CaNZbyon2CwNjkJvJ9kaxJKeVNTlXEgCuCUob59y7mnjsjY6T9ZkQPCeXa58Q9hkBtXwEIc4qKZPlwIkOVDrGzPWnGm6Ml24ocurTC2RfOp6Mj9KLfD9kw-cmg-A15a67cUo25dN5VnBuPnbiZxTpb7mffR-fg_zEOlaceCwMVnWEyU94VKZS3aDKsDoMWI_iMFsLznpjyBWLIDJ0CeUw0iZYqOD1ao45GE7KF4bapS0xqB4HSKIngwWxEMA74WjLHdI3PmI6wSCFRQnxMsmrya0T5LjsCcUVgPB2SH-iFovnkojfGDwZuK2Dyy3xSJOeIRsbumOV3HgMW4EtgzmX2uvDdGx2O7iY325TacpXCV9YDWiD45zH1OO4F20srP_DDwmJt5GIW5-Ke87MS__jfaImNHZOZxcXiqkn4LrxXHcu_EoQ_IMqUa73KjDbGaIPuHfswoFA7jMqk1mpfjrX7aXVMuOqHzKQVO0Ab_47cHxCV98mMRywR69oix_dh6YUbJhuWUjCC8Ww3sarJAjcDMogyWG_02vmrhY9KQfNNvU1bET4KtpB5QkB7IhT-afwiTB-v1C-52UiusEq0H3--2RdHpunbgk4gihu8pypGfMWNr6XJAydYHkbwGk8x9lBk47W5Jts3-wr74Y3quZ_lz3BexMiAKB7iUGuIWb5TOpA6uN6t1W5PAx3wWUhYtr66FPB2mtvbMOPsa-aw9f3SFV5FtZ8f8cgjIStZ39MtGaPvW1ANotWEc5iTH2z9CaO5wy6H7pmL6FDHFWiMsfYKls9f5xiVJzS1rC-eOFh_E--MbfOgfNaaLA0sBGwTPW_UP8FLHVGDJ0--BJFiVVA5XJHXaU7N7IFYNFPVhwspaI8SKcJumtVs7I85__ouCOVr6f7cb7yft21TzM9tQtmETFP7BCV0MFPQZjzKxeJaNnt6Dwn441iA9B_wbl2q63GilbtNATeLKJ4VrRMORSv9yqlQpTvUeOv3yR-lMV6O4wnjw_HxfmySQKIRKILuKOegUv05mXKJbHIJz78kasJF9eKaeMeoqMColGtMZ5OI-hRJRvJ1QqHW67w6n58imgHtlWmd50NRbQSldOmiLogFRJJOz17rHu_t7LKSq8m-QKdI4QNJi0ylJ1iwfR-wn5_uDExtSMT32fB4hnqnx632Ff-zfJ4RT95SFBz9wSUF1jZwEg_cOkD6b01G9dq5CPVcFIrrbXfioES9A3PbRmhAg7lQ8-NA8JBLvjuzKTgr_1jXAylXHnrQ_FSdi73t8FZ0u7idJBowmjmnC7dfVLroX5YTNXf2MxDaPnfPlcnBmJRzMthbCUH_zrWohoTv2SHLvsyZvfgGChxkUMttukw38sKQ32W4Ryl76blAUg0y-yuF9BCyTP6HBsScY1CH1c6IK6UGDoShxjPpu5M5J5IJ2YnN1VLYU0dg_OxNCqaVkS3KK7gjIqe2VYvYtU5w_XftQO3kl2AyQyXyNxU79oQcJRz9dbALAkgRb2Ko8g_EY9Z6yQPyNEUD5qQs8hpBAR_ACetNAHzETuIilQQvuymZWxSR5wD9ZJJ1lphN0i7db1TjaOc7kUqSthySSTkDhpcqkJDrBycQZM4635gIb_3XR0IQTnZBuE0vD7ZHLuWgs4_mSxUjqQvVV29yamnEfMzb8aDxx5PrT3koCZsaXUVjb2bAivdituxWx7VSTyhDK5WiyuZKQirm3gxqRhjBFfiCoHla4T2G5gWjzsYt-hecUXIQP6SN2Hd9T1tmQVcYaWANP-Ye_3mPBjfXqsHMPvdFBFhSIip5REB1Nk0mjG65FsUKQglBpuI5rHNUcunYu48bXyKvWB8ZoMpja4xk9fKjQ0e49JyKvyffuALiGxNzb34y4gERkdzgxukZurfGI5v3tDPN9aKL0d_eCK-HC-XM1WZ5xLChW1YRmXz0GBl3NKRrmeel6vbZ0rdzDKDRBsoSV1jrc2wpnD0H__TYmaU3doawU3zsuuWj2iTCyqO9dmwxJ7k6cn9d3qvoqbTm_UcV6_yT_U9v4RV-SLDkO8VFZHPxO3BX2zjPZPhsncMe1T_P_CkcRyN2sTKgRjs-aWEKHUHC7ZqiLh22v-pB1fUqtgULEAa2c7p1QyjvexMZuP462e8ciBpw7Ju15K4YD926_C61LK4k22TO-Bnn5KwKD3Odifojy1iGF-YJFk_nfNDwH1W0_1WaAOKCnWsHObG_0uXAbo4X_FIuxUS16_yFecI_SEjkYMLzsnfaU-_vv1T0V1tQL9xt2aKNP3ammSxRHS_yhJYGgIadiYh7guHcY2U-Di2KJRE3zA-l42rw&ap_size=2752
Requested by: Host: player.ex.co
URL: https://player.ex.co/player/949f6068-329e-4344-84e7-de26e7f62396
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.96.200.88 Ashburn, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: openresty /
Resource Hash: 696ee2ff10f4d06272e23a40622ce122854f2f6bf39a7166179b79b78cdf9285

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
server: openresty
vary: Accept-Encoding
access-control-allow-methods: GET, POST
content-type: text/xml;charset=UTF-8
access-control-allow-origin: https://theparadise.ng
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires: 0

POST
H2 200 events Show response
prd-collector-anon.ex.co/main/ 0
135 B 104ms
104ms XHR
text/plain 3.211.29.40
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prd-collector-anon.ex.co/main/events
Requested by: Host: player.ex.co
URL: https://player.ex.co/player/949f6068-329e-4344-84e7-de26e7f62396
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.211.29.40 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-29-40.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://theparadise.ng/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://theparadise.ng
date: Mon, 12 Sep 2022 01:04:43 GMT
access-control-allow-credentials: true
content-length: 0
vary: Origin
content-type: text/plain; charset=utf-8

GET
H2 200 eeeea7f79a0c40d3b599b4cc1ab04786.jpeg
publisher-media.wibbitz.com/prod-media/b7f7ecf10a22a4fc99966fe5c00d348c6/ 77 KB
77 KB 113ms
10ms Image
image/jpeg 2600:9000:20eb:6000:1c:f793:41c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://publisher-media.wibbitz.com/prod-media/b7f7ecf10a22a4fc99966fe5c00d348c6/eeeea7f79a0c40d3b599b4cc1ab04786.jpeg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:6000:1c:f793:41c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 14518a7560730aa4b6c76cd6a2bd218cdaaa46b91c0dc5258040bd1bf0c72479

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 23:02:55 GMT
via: 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
last-modified: Fri, 09 Sep 2022 21:43:46 GMT
server: AmazonS3
age: 8543
etag: "641f1f88db712153ec105305a3ed15f1"
x-cache: Hit from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 78466
x-amz-cf-id: WsWcIFVDxOYZ5c4MXMIlgFFeya4gtaap4V3mcmuK-P0mMrfus0k4SA==

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E299 7 KB
7 KB 17ms
15ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fspace-kick-summer-women-rog-1-outside.jpg%3Fv%3D1645133771&v=3&w=400&s=fHTxPpsgZdXTQTyrfXfDdZBq&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

500cb6934ff00c4592847e76afa69fd28a7bc7ba49ca69f7c724bca5d13b4939

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30790422
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 7372
expires: Sun, 03 Sep 2023 09:58:25 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E299 8 KB
8 KB 17ms
15ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Froko-space-mist-1-outside.jpg%3Fv%3D1631849029&v=3&w=400&s=7_D0gD6AAffmErUAU_TQGv32&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

2cb071f9b52cd57bff7f866e2cb93ce9d6ae1804b10d9eb3e9599075967ecd85

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29935670
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 7692
expires: Thu, 24 Aug 2023 12:32:34 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E299 7 KB
7 KB 18ms
16ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fspace-kick-v-boot-women-vintage-blue-1-out.jpg%3Fv%3D1631849205&v=3&w=400&s=BhWg8eLgVlTtlTd6GXgkfD6J&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

940d0fa4bafe6ab768d2c206c8116b9b8413724431335dbca042ea01c046561e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30117665
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 6736
expires: Sat, 26 Aug 2023 15:05:49 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E299 7 KB
8 KB 18ms
17ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Froko-space-dark-spring-1-outside.jpg%3Fv%3D1631849224&v=3&w=400&s=TE3q5aa437kLHrcGF_7V8yOM&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

0950a870ed7fc321504c6f4dabff8000bf43be014d1a91c32fb49a4ea6336940

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30016799
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 7462
expires: Fri, 25 Aug 2023 11:04:43 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E299 8 KB
8 KB 17ms
16ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Froko-hype-nude-1-outside.jpg%3Fv%3D1645134748&v=3&w=400&s=hdLngKSoN1SQuPK7xm_C41Zk&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

275400f2d6b8f4c294a8b67f4ef141d951e6e5cfebe2440946168a01fe745020

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:42 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30885412
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 8202
expires: Mon, 04 Sep 2023 12:21:35 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E299 6 KB
6 KB 17ms
17ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71093&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0282%2F5394%2F5987%2Fproducts%2Fspace-kick-v-boot-women-grey-white-1-outside.jpg%3Fv%3D1645134647&v=3&w=400&s=B40NuafzgguRmupn0vsAvY6c&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

0bd5a37dc03826e35a281502820c716aa01809a29ea5c97b63d5da551dd25aa3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30893971
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 5974
expires: Mon, 04 Sep 2023 14:44:14 GMT

GET
H2 200 pb-7.2.11.js Show response
cdn.ex.co/player/prebid/ Frame 0A46 491 KB
148 KB 36ms
13ms Script
application/javascript 23.36.163.226
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ex.co/player/prebid/pb-7.2.11.js
Requested by: Host: player.ex.co
URL: https://player.ex.co/player/949f6068-329e-4344-84e7-de26e7f62396
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.163.226 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-226.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: b21b912444e379f197f6c60800bec37d8f7f05b6bed20d69a39316535b32a876

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
vary: Accept-Encoding
content-length: 150998
last-modified: Thu, 08 Sep 2022 07:53:19 GMT
server: AmazonS3
etag: "4a422fe71fb27fff54d4b5cafdc2bc42"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
access-control-allow-credentials: false
accept-ranges: bytes
access-control-allow-headers: *
expires: Mon, 19 Sep 2022 01:04:43 GMT

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 377 KB
126 KB 165ms
51ms Script
text/javascript 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: player.ex.co
URL: https://player.ex.co/player/949f6068-329e-4344-84e7-de26e7f62396

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5be70d5a1c0d7389edf9c44dfb579edec6593116194924abb6ecaa9ff75ea4f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 128333
x-xss-protection: 0
expires: Mon, 12 Sep 2022 01:04:44 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 215 KB
75 KB 146ms
57ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-1CR2EFW50G&l=dataLayer&cx=c

Requested by

Host: theparadise.ng
URL: https://theparadise.ng/?local_ga_js=62d7c677a953ca4046de79d7beb2b44c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0a5aceb2deef4d39cb3adcaa8e3aaa49ced354db1e981e452220d232a2c4070e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:44 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 76203
x-xss-protection: 0
expires: Mon, 12 Sep 2022 01:04:44 GMT

GET
H2 200 master.m3u8 Show response
cdn.ex.co/transformations/production/d061bfcceb65481f83b6dcc69973aca1/ 531 B
484 B 48ms
19ms XHR
application/octet-stream 23.36.163.226
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ex.co/transformations/production/d061bfcceb65481f83b6dcc69973aca1/master.m3u8
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/hls.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.163.226 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-226.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: eab78c3cc0b84cc3d48a27b73fb6620050d88bc25a2b9241dcffcb8134a429a0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:43 GMT
content-encoding: gzip
last-modified: Fri, 09 Sep 2022 22:00:56 GMT
server: AmazonS3
etag: "f63410565992b50448cd1f9c5dce8813"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/octet-stream
access-control-allow-origin: *
access-control-max-age: 86400
access-control-allow-credentials: false
accept-ranges: bytes
access-control-allow-headers: *
content-length: 204

POST
H2 204 mvo Show response
tag.1rx.io/rmp/213020/0/ Frame 0A46 0
162 B 59ms
20ms XHR
text/plain 213.19.147.42
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.1rx.io/rmp/213020/0/mvo?z=1r&hbv=7.2,2.1
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/prebid/pb-7.2.11.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.19.147.42 Beverwijk, Netherlands, ASN3356 (LEVEL3, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://theparadise.ng
pragma: no-cache
date: Mon, 12 Sep 2022 01:04:44 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

GET
H2 200 avjp Show response
playbuzzltd-d.openx.net/v/1.0/ Frame 0A46 106 B
380 B 147ms
46ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://playbuzzltd-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&ch=UTF-8&res=1600x1200x24&ifr=true&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=318553ec-e484-40a2-ac42-2e2a0635f90c&nocache=1662944684010&pubcid=2bbdb458-79a3-47e7-934f-7e192d092f53&schain=1.0%2C1!playbuzz.com%2C0010J00002BlxpGQAR%2C1%2C%2C%2C&openrtb=%7B%22imp%22%3A%5B%7B%22video%22%3A%7B%22api%22%3A%5B1%2C2%5D%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%5D%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22playbackmethod%22%3A%5B2%5D%2C%22linearity%22%3A1%2C%22minduration%22%3A1%2C%22startdelay%22%3A0%2C%22maxduration%22%3A60%7D%7D%5D%7D&auid=557057725&vwd=undefined&vht=undefined&aumfs=2000
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/prebid/pb-7.2.11.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:44 GMT
via: 1.1 google
server: OXGW/0.0.0
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://theparadise.ng
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 106
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 encoded-4.m3u8 Show response
cdn.ex.co/transformations/production/d061bfcceb65481f83b6dcc69973aca1/ 1 KB
501 B 8ms
8ms XHR
application/octet-stream 23.36.163.226
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ex.co/transformations/production/d061bfcceb65481f83b6dcc69973aca1/encoded-4.m3u8
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/hls.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.163.226 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-226.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 22ade20b65aafc5c181211750f4651e4075399d0c8f17be38da60e3fe8087bb3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:44 GMT
content-encoding: gzip
last-modified: Fri, 09 Sep 2022 22:00:56 GMT
server: AmazonS3
etag: "471adb43aaf8e13eefc4d53bb2cb5e3b"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/octet-stream
access-control-allow-origin: *
access-control-max-age: 86400
access-control-allow-credentials: false
accept-ranges: bytes
access-control-allow-headers: *
content-length: 222

GET
H2 200 file_4_000.ts Show response
cdn.ex.co/transformations/production/d061bfcceb65481f83b6dcc69973aca1/ 202 KB
172 KB 8ms
8ms XHR
application/octet-stream 23.36.163.226
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ex.co/transformations/production/d061bfcceb65481f83b6dcc69973aca1/file_4_000.ts
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/hls.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.163.226 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-226.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: ad0da7d82485e55b97a0ab919b0818d38e0d498eb0faa1da109db4ec0a9c3e9a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:44 GMT
content-encoding: gzip
last-modified: Fri, 09 Sep 2022 22:00:56 GMT
server: AmazonS3
etag: "2491072bdc178e268b06b13235793950"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/octet-stream
access-control-allow-origin: *
access-control-max-age: 86400
access-control-allow-credentials: false
accept-ranges: bytes
access-control-allow-headers: *
content-length: 175263

GET
BLOB 200
OK 934b8fa8-c1e8-453b-9f8b-d0e1707ea08d
https://theparadise.ng/ 63 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://theparadise.ng/934b8fa8-c1e8-453b-9f8b-d0e1707ea08d
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e1c3c2dafe2208caea4f809f414a89a9d256deb8671e1c5d49bff9a873782796

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Length: 64352
Content-Type: text/javascript

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame FEF9 0
10 B 39ms
38ms Image
text/plain 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?EQtG-g
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:44 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame E122 42 B
64 B 70ms
70ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvcPCEMuNJddtWAnQ1qi-b3WTPmfsCMDoYYQrw5Lzd6vQdFhcMGMJNU5znzhexwdXMPRkowKvvK4YQnrpz8C0Fdu2M&sig=Cg0ArKJSzGFtPDt75_iDEAE&id=lidar2&mcvt=1003&p=0,0,280,1200&mtos=1003,1003,1003,1003,1003&tos=1003,0,0,0,0&v=20220907&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2663840036&rs=2&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1662944682534&rpt=503&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 encoded-2.m3u8 Show response
cdn.ex.co/transformations/production/d061bfcceb65481f83b6dcc69973aca1/ 1 KB
501 B 12ms
12ms XHR
application/octet-stream 23.36.163.226
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ex.co/transformations/production/d061bfcceb65481f83b6dcc69973aca1/encoded-2.m3u8
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/hls.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.163.226 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-226.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: a8d120c453d5633d82f775f5002c0fe2112e1b7b50a38f90d770f1a9dca9ae3d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:44 GMT
content-encoding: gzip
last-modified: Fri, 09 Sep 2022 22:00:56 GMT
server: AmazonS3
etag: "fc014d729be9a8151d4f16c63147ad9e"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/octet-stream
access-control-allow-origin: *
access-control-max-age: 86400
access-control-allow-credentials: false
accept-ranges: bytes
access-control-allow-headers: *
content-length: 222

POST
H2 200 7494bafccde9bb80 Show response
theparadise.ng/cdn-cgi/challenge-platform/h/g/cv/result/ Frame 831E 2 B
545 B 218ms
25ms XHR
text/plain 2606:4700:e2::ac40:8a0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://theparadise.ng/cdn-cgi/challenge-platform/h/g/cv/result/7494bafccde9bb80
Requested by: Host: theparadise.ng
URL: https://theparadise.ng/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1662940800
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8a0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 12 Sep 2022 01:04:44 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gPwizw4HE3K0yY3oz94kmWgSZP4yMxuBg3%2BxzmKYaeDVXc3fkUggsynCFb7QqfZMUb6RT49p1b%2F85m0WPgdXVafVOaJWQQ2ZjhRro4r1jKeaU%2FEso3Sp9eRHFQdSkNB%2BLWRD2EN2SresDfYnSA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 7494bb15c90bbb80-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 file_2_000.ts Show response
cdn.ex.co/transformations/production/d061bfcceb65481f83b6dcc69973aca1/ 304 KB
274 KB 13ms
13ms XHR
application/octet-stream 23.36.163.226
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ex.co/transformations/production/d061bfcceb65481f83b6dcc69973aca1/file_2_000.ts
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/hls.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.163.226 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-226.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: efd40ac9fcd1732321095b2628ae3000d1405f083c87652b181c1a4285be9128

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:44 GMT
content-encoding: gzip
last-modified: Fri, 09 Sep 2022 22:00:56 GMT
server: AmazonS3
etag: "4807f3faca12aa8def48ad09236de57a"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/octet-stream
access-control-allow-origin: *
access-control-max-age: 86400
access-control-allow-credentials: false
accept-ranges: bytes
access-control-allow-headers: *
content-length: 279567

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 687D 42 B
64 B 70ms
69ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss7e69Qmuc31A5-nL50JzZhOtFffcbAPTYJasFkB7Nv1_A3VibtJXv0LUeyPlQRze4XZGiThoMaGZxO8mkzyJuSG8w&sig=Cg0ArKJSzI6RBw9gRtEVEAE&id=lidar2&mcvt=1158&p=0,0,280,1200&mtos=1158,1158,1158,1158,1158&tos=1158,0,0,0,0&v=20220907&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2012113411&rs=2&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1662944682530&rpt=572&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
346 B 127ms
41ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-1CR2EFW50G&gtm=2oe970&_p=554473790&cid=640792261.1662944683&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_z=ccd.v9B&_s=1&sid=1662944684&sct=1&seg=0&dl=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&dt=Pakistani%20Politician%20Imran%20Khan%E2%80%99s%20Instagram%20Account%20Used%20to%20Promote%20Crypto%20Giveaway%20Scam%20%7C%20The%20Paradise%20News&en=page_view&_fv=2&_ss=2&_c=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-1CR2EFW50G&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:44 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://theparadise.ng
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 bridge3.529.2_en.html Show response
imasdk.googleapis.com/js/core/ Frame ECD0 638 KB
207 KB 119ms
41ms Document
text/html 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.529.2_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

94e031c4513e39f8cb650ebaa160ab947e316ed254acac7662fd38086d74b8dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://theparadise.ng/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 451095
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 211466
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
cross-origin-resource-policy: cross-origin
date: Tue, 06 Sep 2022 19:46:29 GMT
expires: Wed, 06 Sep 2023 19:46:29 GMT
last-modified: Tue, 06 Sep 2022 19:42:12 GMT
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 client.js Show response
s0.2mdn.net/instream/video/ 44 KB
17 KB 164ms
50ms Script
text/javascript 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/video/client.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16746
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 12 Sep 2022 01:04:44 GMT

GET
H3 200 bridge3.529.2_en.html Show response
imasdk.googleapis.com/js/core/ Frame 3AD5 638 KB
207 KB 125ms
59ms Document
text/html 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.529.2_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

94e031c4513e39f8cb650ebaa160ab947e316ed254acac7662fd38086d74b8dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://theparadise.ng/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 451095
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 211466
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
cross-origin-resource-policy: cross-origin
date: Tue, 06 Sep 2022 19:46:29 GMT
expires: Wed, 06 Sep 2023 19:46:29 GMT
last-modified: Tue, 06 Sep 2022 19:42:12 GMT
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 bridge3.529.2_en.html Show response
imasdk.googleapis.com/js/core/ Frame 1041 638 KB
207 KB 134ms
75ms Document
text/html 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.529.2_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

94e031c4513e39f8cb650ebaa160ab947e316ed254acac7662fd38086d74b8dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://theparadise.ng/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 451095
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 211466
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
cross-origin-resource-policy: cross-origin
date: Tue, 06 Sep 2022 19:46:29 GMT
expires: Wed, 06 Sep 2023 19:46:29 GMT
last-modified: Tue, 06 Sep 2022 19:42:12 GMT
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 bridge3.529.2_en.html Show response
imasdk.googleapis.com/js/core/ Frame 865A 638 KB
207 KB 151ms
99ms Document
text/html 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.529.2_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

94e031c4513e39f8cb650ebaa160ab947e316ed254acac7662fd38086d74b8dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://theparadise.ng/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 451095
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 211466
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
cross-origin-resource-policy: cross-origin
date: Tue, 06 Sep 2022 19:46:29 GMT
expires: Wed, 06 Sep 2023 19:46:29 GMT
last-modified: Tue, 06 Sep 2022 19:42:12 GMT
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 bridge3.529.2_en.html Show response
imasdk.googleapis.com/js/core/ Frame C520 638 KB
207 KB 146ms
105ms Document
text/html 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.529.2_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

94e031c4513e39f8cb650ebaa160ab947e316ed254acac7662fd38086d74b8dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://theparadise.ng/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 451095
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 211466
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
cross-origin-resource-policy: cross-origin
date: Tue, 06 Sep 2022 19:46:29 GMT
expires: Wed, 06 Sep 2023 19:46:29 GMT
last-modified: Tue, 06 Sep 2022 19:42:12 GMT
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 bridge3.529.2_en.html Show response
imasdk.googleapis.com/js/core/ Frame D93E 638 KB
207 KB 76ms
44ms Document
text/html 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.529.2_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

94e031c4513e39f8cb650ebaa160ab947e316ed254acac7662fd38086d74b8dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://theparadise.ng/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 451095
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 211466
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
cross-origin-resource-policy: cross-origin
date: Tue, 06 Sep 2022 19:46:29 GMT
expires: Wed, 06 Sep 2023 19:46:29 GMT
last-modified: Tue, 06 Sep 2022 19:42:12 GMT
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 50ms
49ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=theparadise.ng

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 01:04:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 45ms
45ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=theparadise.ng

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 01:04:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

POST
H2 204 events
e.channelexco.com/ 0
247 B 355ms
92ms Ping
text/plain 23.19.226.131
LEASEWEB-USA-NYC

General

Check archive.org

Show headers Download Go to

Full URL: https://e.channelexco.com/events
Requested by: Host: player.ex.co
URL: https://player.ex.co/player/949f6068-329e-4344-84e7-de26e7f62396
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.19.226.131 New York, United States, ASN396362 (LEASEWEB-USA-NYC, US),
Reverse DNS
Software: openresty /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://theparadise.ng/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:44 GMT
access-control-request-method: GET, POST
server: openresty
access-control-allow-methods: GET, POST
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
access-control-allow-credentials: true
access-control-allow-headers: *

GET
H2 200 file_2_001.ts Show response
cdn.ex.co/transformations/production/d061bfcceb65481f83b6dcc69973aca1/ 327 KB
297 KB 13ms
12ms XHR
application/octet-stream 23.36.163.226
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ex.co/transformations/production/d061bfcceb65481f83b6dcc69973aca1/file_2_001.ts
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/hls.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.163.226 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-226.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: e87a59fa7b7a85add496296cd8e428331e61e309aa52fcdb62ce143bd680972f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:44 GMT
content-encoding: gzip
last-modified: Fri, 09 Sep 2022 22:00:56 GMT
server: AmazonS3
etag: "8d5505c3c4e4b09637ba22407bf983c4"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/octet-stream
access-control-allow-origin: *
access-control-max-age: 86400
access-control-allow-credentials: false
accept-ranges: bytes
access-control-allow-headers: *
content-length: 303290

GET
H2 200 file_2_002.ts Show response
cdn.ex.co/transformations/production/d061bfcceb65481f83b6dcc69973aca1/ 289 KB
257 KB 32ms
32ms XHR
application/octet-stream 23.36.163.226
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ex.co/transformations/production/d061bfcceb65481f83b6dcc69973aca1/file_2_002.ts
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/hls.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.163.226 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-226.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 34df890b773ddca119f66fcbc4e1e5e07d373f79b315075163f3446ab1cd5e89

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:44 GMT
content-encoding: gzip
last-modified: Fri, 09 Sep 2022 22:00:56 GMT
server: AmazonS3
etag: "a763d320c42c09029b8016df06aec073"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/octet-stream
access-control-allow-origin: *
access-control-max-age: 86400
access-control-allow-credentials: false
accept-ranges: bytes
access-control-allow-headers: *
content-length: 262085

POST
H2 200 all
csm.eu.criteo.net/ Frame 1FE8 0
127 B 21ms
15ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 12 Sep 2022 01:04:43 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 3C15 42 B
64 B 71ms
70ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss5PGeejpcKYrT8yVxQkvrtNNWWIx_Z2gpeolA1hgB7IHZFiICIivnidBawPOb9c2cIlskrG8M--dXi3FH6minF50Q&sig=Cg0ArKJSzIsZ8BGK18P2EAE&id=lidar2&mcvt=1000&p=0,0,124,1005&mtos=197,868,1000,1000,1000&tos=197,671,132,0,0&v=20220907&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1662944682972&rpt=542&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 23F9 0
127 B 15ms
14ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 12 Sep 2022 01:04:43 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

POST
H2 200 all
csm.eu.criteo.net/ Frame E299 0
127 B 15ms
15ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 12 Sep 2022 01:04:44 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame D93E 156 B
185 B 436ms
324ms XHR
text/xml 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?iu=%2F7103%2C22597404845%2FSMG_Playbuzz%2Fpreroll%2Fsyndication_2&description_url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&tfcd=0&npa=0&sz=640x480&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=2738978041083305&sdkv=h.3.529.2&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&u_so=l&ctv=0&sdki=44d&ptt=20&adk=3340459303&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.529.2&sid=E013533D-18C8-4FC5-944A-02E1C55CD3FE&nel=0&eid=44754420%2C44760950%2C44765701&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&dt=1662944685010&cookie=ID%3D728b4296b8291eca-22b04e5d1cce005b%3AT%3D1662944682%3ART%3D1662944682%3AS%3DALNI_MZ3pZEJlydBfg-67oh1S42RxIzuSw&scor=2497529011422160&ged=ve4_td4_tt0_pd4_la4000_er7050.690.7203.990_vi0.0.1200.1600_vp0_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.529.2_en.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:45 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 72ms
72ms Image
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20220907&jk=2384351373504603&bg=!MzClMHTNAAZTikH4c4o7ACkAdvg8Wq_NO_3EMJR1WGnWPxJsF7Zw6KdsiiFKMGfaiibFvp0SxIGbhQIAAAFiUgAAAAFoAQcKAHdoFEv8u8oV_Rsl9eLK-wNBPdh6J1cuN1y_eYtty81lrUr9lu8Sk3vEVfgVWo9tgQp2ZXKqrhOAzFIyqn8Q2u16gRmj5MLwMnXTxDscUgz3CrELtQLxKIsxIBouMjVWcC4vH690F9Q0eVZhV4Tqeul_1QSIAFeRGpkC7VjX00lvZk1m4O4GMJvYpQj5wGvBA8cFXQD1AXFLKSxHsEWMpWIfH3oz796iEs4Z7rrEqymkUdXM61BApFBrZzoQIGcRzX5fxIxmiFyb3SKpIocY7uBuAmYALO2AMxoL_jAoHBlxI7gsAM0o4uVsPnBs-V9AIrzASgQEDo7CSRXFglTApA_yEutbrPeCio7ftGyrB-cd-wQbaYGvuhLZCYb4hshCi2u_AfCqrBnjK_kh_JSklNGVpQ92_Bl3_o2hOH23R8-Z-IdBV_uN-1gum9GtcwdG4eGZya__WO2GWU-Z10mpOv45Y4AkZOmjkEtuZTYWQLChcOOwiketeaWrVjuNPtMjtI-FrJBKezo5AriXRp6mGRYnV4fr_NVVeunINGbKP4HpM_psPpP4lgUA7lutIfiTV09pOvsOOyfXQFnv_kC88BOoBV1Wb1AQOarh0L_JA0b2JEIM4AUF0lFN1JEwGrL8ObEk7CuZ2Gg4_A5YAwA5l8TH38RC4cRUh4UAG6RHj9oxcW7eSuzVxoa5BMMHzd8OHBCHdDO2LIIBCcti3DQxnpRpblqs_52SeB_rh1ihvZ5UKsgrpoMLpn-9J0jbimhYNTqacMqkA9P61Vld31VGbo_WTKOJnqERDleJT3pmzERn5sTIk3EBTUuENCrLCrUhsQH8Xau5FufErd8uTJYpLiTWeOI00vUKToZK_wHhnw56TWfsKCoS6UnmnDJV6lImbMe36sKxosN0TgS6rgn_OcxSFrAv7EmWfgLRE70lMIzp5ylvkV_mX7z5pqtn4Gb7oelR5jxVZQ3-wsR_VNmdIUJjKO_raZkm58qaIFBeIBwcckLvt8gkbzRz1nf6MRlIhcbS2VjqQ0_N6Gvw490bWw2YsYNOcjHqVmI_TLr2CCIetpPrnOnbzOa435WCQytFGne3VEqIDSCC_vfUljyF2qXNT7p2lmaqZIP6K4MsJwWPSByB1gImtQRXpBxP-cqNepy5Z9Tqs-O7
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

GET
H2 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame 3AD5 1 KB
869 B 176ms
80ms XHR
text/xml 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?iu=%2F94166617%2C22431668266%2Fca-video-pub-9790762811057699-tag%2FMCD_2.0_Ced_Desktop_theparadise.ng_5&description_url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&sz=400x300%7C640x400%7C640x480&tfcd=0&npa=0&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=3080512986380943&sdkv=h.3.529.2&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&u_so=l&ctv=0&sdki=44d&ptt=20&adk=1324917686&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.529.2&sid=E013533D-18C8-4FC5-944A-02E1C55CD3FE&nel=0&eid=44754420%2C44760950%2C44765701&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&dt=1662944685024&cookie=ID%3D728b4296b8291eca-22b04e5d1cce005b%3AT%3D1662944682%3ART%3D1662944682%3AS%3DALNI_MZ3pZEJlydBfg-67oh1S42RxIzuSw&scor=3336233280319823&ged=ve4_td4_tt0_pd4_la4000_er7050.690.7203.990_vi0.0.1200.1600_vp0_ts0_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.529.2_en.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

83d3d0d198159d0a11cfeeb54178068e5a866a297f1b58e0c5e6b10ae58a8976

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 799
x-xss-protection: 0
google-lineitem-id: 0
pragma: no-cache
server: cafe
google-creative-id: 0
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame 1041 1 KB
1 KB 166ms
78ms XHR
text/xml 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?iu=%2F94166617%2C22431668266%2Fca-video-pub-9790762811057699-tag%2FMCD_2.0_Ced_Desktop_theparadise.ng_3&description_url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&sz=400x300%7C640x400%7C640x480&tfcd=0&npa=0&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=2016578096020934&sdkv=h.3.529.2&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&u_so=l&ctv=0&sdki=44d&ptt=20&adk=3315715630&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.529.2&sid=E013533D-18C8-4FC5-944A-02E1C55CD3FE&nel=0&eid=44754420%2C44760950%2C44765701&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&dt=1662944685033&cookie=ID%3D728b4296b8291eca-22b04e5d1cce005b%3AT%3D1662944682%3ART%3D1662944682%3AS%3DALNI_MZ3pZEJlydBfg-67oh1S42RxIzuSw&scor=1554365143634550&ged=ve4_td4_tt0_pd4_la4000_er7050.690.7203.990_vi0.0.1200.1600_vp0_ts0_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.529.2_en.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5d2c7c7e3b3e6c9f116bd2b8c1837030244942a9a9e35aa8c571fd77ccc36452

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 799
x-xss-protection: 0
google-lineitem-id: 0
pragma: no-cache
server: cafe
google-creative-id: 0
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame 865A 156 B
185 B 406ms
325ms XHR
text/xml 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?iu=%2F7103%2C22597404845%2FSMG_Playbuzz%2Fpreroll%2Fsyndication_450&description_url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&tfcd=0&npa=0&sz=640x480&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=2319996638672177&sdkv=h.3.529.2&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&u_so=l&ctv=0&sdki=44d&ptt=20&adk=978861564&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.529.2&sid=E013533D-18C8-4FC5-944A-02E1C55CD3FE&nel=0&eid=44754420%2C44760950%2C44765701&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&dt=1662944685041&cookie=ID%3D728b4296b8291eca-22b04e5d1cce005b%3AT%3D1662944682%3ART%3D1662944682%3AS%3DALNI_MZ3pZEJlydBfg-67oh1S42RxIzuSw&scor=1806749343468775&ged=ve4_td4_tt0_pd4_la4000_er7050.690.7203.990_vi0.0.1200.1600_vp0_ts0_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.529.2_en.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:45 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame ECD0 1 KB
868 B 140ms
81ms XHR
text/xml 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?iu=%2F94166617%2C22431668266%2Fca-video-pub-9790762811057699-tag%2FMCD_2.0_Ced_Desktop_theparadise.ng_9&description_url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&sz=400x300%7C640x400%7C640x480&tfcd=0&npa=0&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=882688346959310&sdkv=h.3.529.2&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&u_so=l&ctv=0&sdki=44d&ptt=20&adk=328645421&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.529.2&sid=E013533D-18C8-4FC5-944A-02E1C55CD3FE&nel=0&eid=44754420%2C44760950%2C44765701&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&dt=1662944685063&cookie=ID%3D728b4296b8291eca-22b04e5d1cce005b%3AT%3D1662944682%3ART%3D1662944682%3AS%3DALNI_MZ3pZEJlydBfg-67oh1S42RxIzuSw&scor=1207223474589348&ged=ve4_td4_tt0_pd4_la4000_er7050.690.7203.990_vi0.0.1200.1600_vp0_ts0_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.529.2_en.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

df00a67e556aca1511338ddfdf604a8cb4f4c1921d9be88e0be6bb8b0f43a9aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 794
x-xss-protection: 0
google-lineitem-id: 0
pragma: no-cache
server: cafe
google-creative-id: 0
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame C520 156 B
236 B 363ms
312ms XHR
text/xml 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?iu=%2F7103%2C22597404845%2FSMG_Playbuzz%2Fpreroll%2Fsyndication_3&description_url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&tfcd=0&npa=0&sz=640x480&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=2188910449051641&sdkv=h.3.529.2&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&u_so=l&ctv=0&sdki=44d&ptt=20&adk=3481691223&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.529.2&sid=E013533D-18C8-4FC5-944A-02E1C55CD3FE&nel=0&eid=44754420%2C44760950%2C44765701&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&dt=1662944685070&cookie=ID%3D728b4296b8291eca-22b04e5d1cce005b%3AT%3D1662944682%3ART%3D1662944682%3AS%3DALNI_MZ3pZEJlydBfg-67oh1S42RxIzuSw&scor=2343334918267505&ged=ve4_td4_tt0_pd4_la4000_er7050.690.7203.990_vi0.0.1200.1600_vp0_ts0_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.529.2_en.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:45 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame ECD0 156 B
142 B 296ms
217ms XHR
text/xml 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?slotname=%2F94166617%2Fca-video-pub-9790762811057699-tag%2FMCD_2.0_Ced_Desktop_theparadise.ng_9&sz=400x300%7C640x400%7C640x480&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&unviewed_position_start=1&env=vp&gdfp_req=1&ad_rule=0&output=xml_vast4&video_url_to_fetch=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&useragent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F105.0.5195.102%20Safari%2F537.36%2Cgzip(gfe)&vad_type=linear&vpos=preroll&pod=1&vrid=1181461&min_ad_duration=0&max_ad_duration=30000&ppos=1&lip=true&sid=E013533D-18C8-4FC5-944A-02E1C55CD3FE&adk=328645421&correlator=882688346959310&dt=1662944685222&ged=ve4_td4_tt0_pd4_la4000_er7050.690.7301.1137_vi0.0.1200.1600_vp0_ts0_eb16491&is_amp=0&npa=false&omid_p=Google1%2Fh.3.529.2&osd=2&ptt=20&scor=1207223474589348&sdk_apis=2%2C7%2C8&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vis=1&u_so=l&eid=44754420%2C44760950%2C44765701&hl=en&frm=0&sdki=44d&sdkv=h.3.529.2&sdr=1&nel=0&cnc=22431668266&kfa=0&tfcd=0&ctv=0&cookie=ID%3D728b4296b8291eca-22b04e5d1cce005b%3AT%3D1662944682%3ART%3D1662944682%3AS%3DALNI_MZ3pZEJlydBfg-67oh1S42RxIzuSw

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.529.2_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:45 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame 3AD5 80 KB
16 KB 323ms
323ms XHR
text/xml 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?slotname=%2F94166617%2Fca-video-pub-9790762811057699-tag%2FMCD_2.0_Ced_Desktop_theparadise.ng_5&sz=400x300%7C640x400%7C640x480&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&unviewed_position_start=1&env=vp&gdfp_req=1&ad_rule=0&output=xml_vast4&video_url_to_fetch=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&useragent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F105.0.5195.102%20Safari%2F537.36%2Cgzip(gfe)&vad_type=linear&vpos=preroll&pod=1&vrid=1181461&min_ad_duration=0&max_ad_duration=30000&ppos=1&lip=true&sid=E013533D-18C8-4FC5-944A-02E1C55CD3FE&adk=1324917686&correlator=3080512986380943&dt=1662944685534&ged=ve4_td5_tt1_pd5_la5000_er7050.690.7301.1137_vi0.0.1200.1600_vp0_ts1_eb16491&is_amp=0&npa=false&omid_p=Google1%2Fh.3.529.2&osd=2&ptt=20&scor=3336233280319823&sdk_apis=2%2C7%2C8&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vis=1&u_so=l&eid=44754420%2C44760950%2C44765701&hl=en&frm=0&sdki=44d&sdkv=h.3.529.2&sdr=1&nel=0&cnc=22431668266&kfa=0&tfcd=0&ctv=0&cookie=ID%3D728b4296b8291eca-22b04e5d1cce005b%3AT%3D1662944682%3ART%3D1662944682%3AS%3DALNI_MZ3pZEJlydBfg-67oh1S42RxIzuSw

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.529.2_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

79d585aff058bfb7a252dc58d461f26202eca76ee30a8ffedd99ea1ae0e470ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16340
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame FD36 0
127 B 15ms
15ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 12 Sep 2022 01:04:45 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

POST
H2 204 csi
csi.gstatic.com/ Frame 3AD5 0
54 B 1308ms
445ms Ping
image/gif 2404:6800:4002:81f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~l7y2buw1&c=2084311714587&slotId=1042155857293.5&qqid=COvTj9qHjvoCFYa3dwodZQwMHQ&gqid=rYUeY_bQIaKOjuwPnsqBmAM&fb=ima_html5-lima&sdkv=h.3.529.2&mrd=4&aab=0&itv=1&eee=missing-element&bi=missing-id&vast_v=4.0&icc=1&icrh=0&icri=0&icrs=1&icru=0&icp=GoogleWhyThisAd&icdi=18x18&vmfc=2&vhc=0&wta=1&hghme=1&ghmsh_eids=44754420%2C44760950%2C44765701&met.4=ghmsh_s.l7y2bvoy~ghmsh_s.l7y2bvoz&ghmsh_mi=22%2C18%2C&ghmsh_vi=134%2C136%2C243%2C247%2C&ghmsh_ai=139%2C140%2C250%2C&ghmsh_gvt=0&ams=1&vs=720x720&vc=avc1.64001F&mt=video%2Fmp4&vsrc=youtube&bit=22&cpn=bHUAF4te0Zn32eB7
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.529.2_en.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4002:81f::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:46 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 simid_trueview_en.html Show response
imasdk.googleapis.com/js/simid/ Frame B35D 148 KB
45 KB 47ms
47ms Document
text/html 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/simid/simid_trueview_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.529.2_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

984cf028eefd524f1be2a6eca2c9fc3a07e6f3c197e5c9246ee7769674067fda

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-oYXnVmUmnZoYi5C_V52tIw' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/ads-doubleclick-instream-static; base-uri 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://imasdk.googleapis.com/js/core/bridge3.529.2_en.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'nonce-oYXnVmUmnZoYi5C_V52tIw' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/ads-doubleclick-instream-static; base-uri 'none'
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 01:04:45 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 events Show response
prd-collector-anon.ex.co/main/ 0
135 B 102ms
102ms XHR
text/plain 3.211.29.40
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prd-collector-anon.ex.co/main/events
Requested by: Host: player.ex.co
URL: https://player.ex.co/player/949f6068-329e-4344-84e7-de26e7f62396
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.211.29.40 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-29-40.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://theparadise.ng/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://theparadise.ng
date: Mon, 12 Sep 2022 01:04:45 GMT
access-control-allow-credentials: true
content-length: 0
vary: Origin
content-type: text/plain; charset=utf-8

GET
H3 200 help_outline_white_24dp_with_3px_trbl_padding.png
imasdk.googleapis.com/formats/wta/ Frame 3AD5 453 B
478 B 39ms
38ms Image
image/png 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imasdk.googleapis.com/formats/wta/help_outline_white_24dp_with_3px_trbl_padding.png?wp=ca-pub-9848746867798493

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e519cc4b7b8fdc64a7aaafc1b808cde266a234205aac0d6c55589c12446d565e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/js/core/bridge3.529.2_en.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 00:55:03 GMT
x-content-type-options: nosniff
age: 582
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 453
x-xss-protection: 0
last-modified: Wed, 13 Oct 2021 14:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: image/png
cache-control: public, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 12 Sep 2022 01:45:03 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 3AD5 42 B
64 B 52ms
52ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CfLvlrYUeY6vJI4bv3gPlmLDoAczYi4xq3ZiQ8cIPsJAfEAEguY2OKGCV4pCCoAegAYyhr8QCyAEFqQKGvsSd3diwPuACAKgDAZgEAKoE4gJP0NG_LRFdOWTQ0J_5pcKOOeP7ceVSJw8BlqHvrXncctYa9XeOtoQBx4ngGUvcSvH_z19sQ8K4VnbiHRrJbtzTgDGdMO7LGf4y9jbUe8czVKok1A7n2tSQt9yECU01KD3LZzfmpVBZQ3FcZJsuFpaiQ7xRILgng_DQcdlRU9l-CCNE4SgNAEW7llWy8TX9C-EHbkK1WZtFw9XdEuzbSx8Hbq4G4f-cPMtNatIoRhIK5IbGzPnD_IHnXJnq1IlBGxnkfoUxY0wxtf0uLubYcqcOj029xA03koHREvrHjyycp4NdaYrw5GS0XwB4rViDHnv4cqi7qWcBaU2374iY91Gk9hDJvTFRZxy6mFYqWbuFsbvsEl5bUwNSFSmkZ6_uwc5jqGBlLQDJPKkHsWMoeX7GsQImqX-IHz_JWl2wIuS-eCcYtwYEJvz66bolzWGxsSDgmdW5lrvEfWX9sxzDAcohrxfABOe7w9CCBOAEAaAGVIAH3N7QuwGoB47OG6gHk9gbqAec3BuoB-6WsQKoB_6esQKoB6SjsQKoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcBqAgB0ggRCIDhgBAQARgdMgKqAjoCgECaCSVodHRwczovL3d3dy5kYXNoYXVzZGVydWViZXJ6dWVnZS5jb20vsQm07h7Bpf3QAoAKA8gLAdALDuALAbgMAdgTDdAVAZgWAeIWAggB-BYBgBcB&sigh=vO1gIFwL5Co&label=show_ad&sdkv=h.3.529.2&vci=CmsIARIYcHViYWRzLmcuZG91YmxlY2xpY2submV0GgdBZFNlbnNlIAQqDDUzMzM1MDA1OTEwMTIMNTg3NjMyNDMzMjA0QMkCUiMQDyUAACBCKAE6C0ZlTFFhTndwY004Qglnb29nbGVhZHNQABgB

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:45 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
pubads.g.doubleclick.net/pagead/ Frame 3AD5 0
0 80ms
80ms Image
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pubads.g.doubleclick.net/pagead/adview?ai=Cka4yrYUeY6vJI4bv3gPlmLDoAczYi4xq3ZiQ8cIPsJAfEAEguY2OKGCV4pCCoAegAYyhr8QCyAEFqQKGvsSd3diwPuACAKgDAZgEAKoE3wJP0NG_LRFdOWTQ0J_5pcKOOeP7ceVSJw8BlqHvrXncctYa9XeOtoQBx4ngGUvcSvH_z19sQ8K4VnbiHRrJbtzTgDGdMO7LGf4y9jbUe8czVKok1A7n2tSQt9yECU01KD3LZzfmpVBZQ3FcZJsuFpaiQ7xRILgng_DQcdlRU9l-CCNE4SgNAEW7llWy8TX9C-EHbkK1WZtFw9XdEuzbSx8Hbq4G4f-cPMtNatIoRhIK5IbGzPnD_IHnXJnq1IlBGxnkfoUxY0wxtf0uLubYcqcOj029xA03koHREvrHjyycp4NdaYrw5GS0XwB4rViDHnv4cqi7qWcBaU2374iY91Gk9hDJvTFRZxy6mFYqWbuFsbvsEl5bUwNSFSmkZ6_uwc5jqGBlLQDJPKkHsWMoeX7GsQImqSeJ3QfCAO-RsE9-xEjuCx6q39pfOMY6x-W4nzg-JjSfM2A8a0nlGvlnbjzABOe7w9CCBOAEAaAGVIAH3N7QuwGoB47OG6gHk9gbqAec3BuoB-6WsQKoB_6esQKoB6SjsQKoB6a-G9gHAfIHBBDV9WqoCAHSCBEIgOGAEBABGB0yAqoCOgKAQIAKA8gLAcITBhiMoa_EAtgTDdAVAZgWAeIWAggBgBcBshceChwIABIUcHViLTk3OTA3NjI4MTEwNTc2OTkY0dUT&sigh=kVt1z11Ovxc&cmd=Ch1jYS12aWRlby1wdWItOTc5MDc2MjgxMTA1NzY5ORAAGAI&uach_m=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vt=10&sdkv=h.3.529.2&vci=CmsIARIYcHViYWRzLmcuZG91YmxlY2xpY2submV0GgdBZFNlbnNlIAQqDDUzMzM1MDA1OTEwMTIMNTg3NjMyNDMzMjA0QMkCUiMQDyUAACBCKAE6C0ZlTFFhTndwY004Qglnb29nbGVhZHNQABgB
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

POST
H2 204 csi
csi.gstatic.com/ 0
54 B 1277ms
443ms Ping
image/gif 2404:6800:4002:81f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&top=1&puid=1~l7y2buhe&c=2084311714587&slotId=1042155857293.5&eee=missing-element&bi=missing-id
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4002:81f::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:46 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 206
Partial Content videoplayback
rr4---sn-5hneknee.googlevideo.com/ 3 MB
0 85ms
16ms Media
video/mp4 2a00:1450:400e:8::9
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://rr4---sn-5hneknee.googlevideo.com/videoplayback?expire=1662973485&ei=rYUeY8u5L4mp7gPnzbb4AQ&ip=2a03:1b20:6:f011::7e&id=15e2d068dc2970cf&itag=22&source=youtube&requiressl=yes&mh=ES&mm=31&mn=sn-5hneknee&ms=au&mv=m&mvi=4&pl=48&susc=gvp&acao=yes&ctier=L&mime=video/mp4&vprv=1&dur=40.100&lmt=1633946161826586&mt=1662944210&txp=5311224&sparams=expire,ei,ip,id,itag,source,requiressl,susc,acao,ctier,mime,vprv,dur,lmt&sig=AOq0QJ8wRgIhAL8NWIZdmLLRzQ3h-4dAOJw4Ljwx-lMJytXHtTWMERljAiEAh-kgvJhbuxw9-NxeebRjS0uLMw0XawPpeegxZdKjD1o=&lsparams=mh,mm,mn,ms,mv,mvi,pl&lsig=AG3C_xAwRgIhAPKZvejf11Wtg-rrKyRHVU-khZg_JDAsg6Sex3e3Xq8BAiEArEJ9mlRGQKnd8FsLrC_PwSBhJ4T2ZM-fh9dR0ZuXxCk=&cpn=bHUAF4te0Zn32eB7

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400e:8::9 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://theparadise.ng/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Range: bytes=0-

Response headers

Date: Mon, 12 Sep 2022 01:04:45 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 11 Oct 2021 09:56:01 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Content-Range: bytes 0-6945553/6945554
Cache-Control: private, max-age=28500
Cross-Origin-Resource-Policy: cross-origin
Connection: close
Accept-Ranges: bytes
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 6945554
Expires: Mon, 12 Sep 2022 01:04:45 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 3AD5 0
327 B 1242ms
442ms Ping
image/gif 2404:6800:4002:81f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=2~l7y2bvp2&c=2084311714587&slotId=1042155857293.5&qqid=COvTj9qHjvoCFYa3dwodZQwMHQ&gqid=rYUeY_bQIaKOjuwPnsqBmAM&fb=ima_html5-lima&sdkv=h.3.529.2&mrd=4&aab=0&itv=1&met.4=ghmsh_s.l7y2bvp4
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.529.2_en.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4002:81f::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:46 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame B35D 0
54 B 1241ms
455ms Ping
image/gif 2404:6800:4002:81f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~l7y2bvr5&c=4769640348069&slotId=2384820174034.5&eee=missing-element&bi=missing-id
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/simid/simid_trueview_en.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4002:81f::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:46 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame B35D 0
54 B 1223ms
445ms Ping
image/gif 2404:6800:4002:81f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=2~l7y2bvr7&c=4769640348069&slotId=2384820174034.5&fb=simid_trueview&simid_trvc_e=c
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/simid/simid_trueview_en.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4002:81f::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:46 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 AMLnZu_S0ADJZ6_jfLrhh1USmX5dQovdzHadHNkoNmnF=s48-c-k-c0x00ffffff-no-rj
yt3.ggpht.com/ytc/ Frame B35D 922 B
1 KB 146ms
50ms Image
image/jpeg 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://yt3.ggpht.com/ytc/AMLnZu_S0ADJZ6_jfLrhh1USmX5dQovdzHadHNkoNmnF=s48-c-k-c0x00ffffff-no-rj

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

ff65446fe9e1694af7da6b141dfeaf5fda405f4253ae411f8ac244bced493355

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 21:41:00 GMT
x-content-type-options: nosniff
age: 12226
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 922
x-xss-protection: 0
server: fife
etag: "v16"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 31 Jul 2022 07:23:19 GMT

GET
H2 200 hqdefault.jpg
i.ytimg.com/vi/FeLQaNwpcM8/ Frame B35D 11 KB
12 KB 135ms
51ms Image
image/jpeg 2a00:1450:4001:812::2016
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.ytimg.com/vi/FeLQaNwpcM8/hqdefault.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2016 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ab3e879537964cf684b67c01748b5cf9e6aad783f06d754d30d5f6e0b78db18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 00:06:17 GMT
x-content-type-options: nosniff
age: 3509
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11286
x-xss-protection: 0
server: sffe
etag: "0"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Mon, 12 Sep 2022 02:06:17 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame B35D 0
54 B 1217ms
446ms Ping
image/gif 2404:6800:4002:81f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=3~l7y2bvrg&c=4769640348069&slotId=2384820174034.5&fb=simid_trueview&simid_cturl=1&simid_cturi=1&simid_fs=0&simid_ns=adHandles&simid_vda=1&simid_vd=0-0-447-251&simid_ap_f=1&simid_ap_is=true&simid_ap_it=true&simid_trvc_e=s_pi
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/simid/simid_trueview_en.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4002:81f::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:46 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 3AD5 42 B
64 B 65ms
64ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CfLvlrYUeY6vJI4bv3gPlmLDoAczYi4xq3ZiQ8cIPsJAfEAEguY2OKGCV4pCCoAegAYyhr8QCyAEFqQKGvsSd3diwPuACAKgDAZgEAKoE4gJP0NG_LRFdOWTQ0J_5pcKOOeP7ceVSJw8BlqHvrXncctYa9XeOtoQBx4ngGUvcSvH_z19sQ8K4VnbiHRrJbtzTgDGdMO7LGf4y9jbUe8czVKok1A7n2tSQt9yECU01KD3LZzfmpVBZQ3FcZJsuFpaiQ7xRILgng_DQcdlRU9l-CCNE4SgNAEW7llWy8TX9C-EHbkK1WZtFw9XdEuzbSx8Hbq4G4f-cPMtNatIoRhIK5IbGzPnD_IHnXJnq1IlBGxnkfoUxY0wxtf0uLubYcqcOj029xA03koHREvrHjyycp4NdaYrw5GS0XwB4rViDHnv4cqi7qWcBaU2374iY91Gk9hDJvTFRZxy6mFYqWbuFsbvsEl5bUwNSFSmkZ6_uwc5jqGBlLQDJPKkHsWMoeX7GsQImqX-IHz_JWl2wIuS-eCcYtwYEJvz66bolzWGxsSDgmdW5lrvEfWX9sxzDAcohrxfABOe7w9CCBOAEAaAGVIAH3N7QuwGoB47OG6gHk9gbqAec3BuoB-6WsQKoB_6esQKoB6SjsQKoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcBqAgB0ggRCIDhgBAQARgdMgKqAjoCgECaCSVodHRwczovL3d3dy5kYXNoYXVzZGVydWViZXJ6dWVnZS5jb20vsQm07h7Bpf3QAoAKA8gLAdALDuALAbgMAdgTDdAVAZgWAeIWAggB-BYBgBcB&sigh=vO1gIFwL5Co&label=video_ad_loaded&sdkv=h.3.529.2&vci=CmsIARIYcHViYWRzLmcuZG91YmxlY2xpY2submV0GgdBZFNlbnNlIAQqDDUzMzM1MDA1OTEwMTIMNTg3NjMyNDMzMjA0QMkCUiMQDyUAACBCKAE6C0ZlTFFhTndwY004Qglnb29nbGVhZHNQABgB

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Oy6hyfNY.js Show response
tpc.googlesyndication.com/sodar/ Frame 3AD5 41 KB
15 KB 51ms
51ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Oy6hyfNY.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.529.2_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3b2ea1c9f3587781b58285cf64279e67f6329a3924fb93f81529f1826e2f4d16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 10:58:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 482763
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15406
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Wed, 06 Sep 2023 10:58:43 GMT

GET
H3 200 adview
pubads.g.doubleclick.net/pagead/ Frame 3AD5 0
0 88ms
86ms Image
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pubads.g.doubleclick.net/pagead/adview?ai=Cka4yrYUeY6vJI4bv3gPlmLDoAczYi4xq3ZiQ8cIPsJAfEAEguY2OKGCV4pCCoAegAYyhr8QCyAEFqQKGvsSd3diwPuACAKgDAZgEAKoE3wJP0NG_LRFdOWTQ0J_5pcKOOeP7ceVSJw8BlqHvrXncctYa9XeOtoQBx4ngGUvcSvH_z19sQ8K4VnbiHRrJbtzTgDGdMO7LGf4y9jbUe8czVKok1A7n2tSQt9yECU01KD3LZzfmpVBZQ3FcZJsuFpaiQ7xRILgng_DQcdlRU9l-CCNE4SgNAEW7llWy8TX9C-EHbkK1WZtFw9XdEuzbSx8Hbq4G4f-cPMtNatIoRhIK5IbGzPnD_IHnXJnq1IlBGxnkfoUxY0wxtf0uLubYcqcOj029xA03koHREvrHjyycp4NdaYrw5GS0XwB4rViDHnv4cqi7qWcBaU2374iY91Gk9hDJvTFRZxy6mFYqWbuFsbvsEl5bUwNSFSmkZ6_uwc5jqGBlLQDJPKkHsWMoeX7GsQImqSeJ3QfCAO-RsE9-xEjuCx6q39pfOMY6x-W4nzg-JjSfM2A8a0nlGvlnbjzABOe7w9CCBOAEAaAGVIAH3N7QuwGoB47OG6gHk9gbqAec3BuoB-6WsQKoB_6esQKoB6SjsQKoB6a-G9gHAfIHBBDV9WqoCAHSCBEIgOGAEBABGB0yAqoCOgKAQIAKA8gLAcITBhiMoa_EAtgTDdAVAZgWAeIWAggBgBcBshceChwIABIUcHViLTk3OTA3NjI4MTEwNTc2OTkY0dUT&sigh=kVt1z11Ovxc&cmd=Ch1jYS12aWRlby1wdWItOTc5MDc2MjgxMTA1NzY5ORAAGAI&uach_m=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&sdkv=h.3.529.2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 3AD5 42 B
64 B 58ms
56ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CuTRerYUeY6vJI4bv3gPlmLDoAczYi4xq3ZiQ8cIPsJAfEAEguY2OKGCV4pCCoAegAYyhr8QCyAEFqQKGvsSd3diwPuACAKgDAZgEAKoE3wJP0NG_LRFdOWTQ0J_5pcKOOeP7ceVSJw8BlqHvrXncctYa9XeOtoQBx4ngGUvcSvH_z19sQ8K4VnbiHRrJbtzTgDGdMO7LGf4y9jbUe8czVKok1A7n2tSQt9yECU01KD3LZzfmpVBZQ3FcZJsuFpaiQ7xRILgng_DQcdlRU9l-CCNE4SgNAEW7llWy8TX9C-EHbkK1WZtFw9XdEuzbSx8Hbq4G4f-cPMtNatIoRhIK5IbGzPnD_IHnXJnq1IlBGxnkfoUxY0wxtf0uLubYcqcOj029xA03koHREvrHjyycp4NdaYrw5GS0XwB4rViDHnv4cqi7qWcBaU2374iY91Gk9hDJvTFRZxy6mFYqWbuFsbvsEl5bUwNSFSmkZ6_uwc5jqGBlLQDJPKkHsWMoeX7GsQImqSeJ3QfCAO-RsE9-xEjuCx6q39pfOMY6x-W4nzg-JjSfM2A8a0nlGvlnbjzABOe7w9CCBOAEAaAGVIAH3N7QuwGoB47OG6gHk9gbqAec3BuoB-6WsQKoB_6esQKoB6SjsQKoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcBqAgB0ggRCIDhgBAQARgdMgKqAjoCgECACgPICwHYEw3QFQGYFgHiFgIIAfgWAYAXAQ&sigh=2HTSgfltEF4&cmd=Ch1jYS12aWRlby1wdWItOTc5MDc2MjgxMTA1NzY5ORAAGAI&label=vast_creativeview&ad_mt=0&acvw=sv%3D935%26cb%3Dima%26e%3D19%26nas%3D1%26sdk%3Dh%26p%3D7050,690,7301,1137%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26at%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D40054%26vmtime%3D-1%26is%3D18%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D0%26ces%26femt%3D1065%26femvt%3D0%26emc%3D2%26emuc%3D0%26emb%3D0,0,0,0,0%26avms%3Dexc%26qi%3D718280693%26psm%3D-2147483648%26psv%3D0%26psfv%3D0%26psa%3D0%26ptlt%3D1748%26pngs%3D9,14,15%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26ss%3D0%26t%3D1662944685895&sdkv=h.3.529.2&vci=Cm4IARIYcHViYWRzLmcuZG91YmxlY2xpY2submV0GgdBZFNlbnNlIAQqDDUzMzM1MDA1OTEwMTIMNTg3NjMyNDMzMjA0QMkCUiYQDyUAACBCKAE6C0ZlTFFhTndwY004Qglnb29nbGVhZHNIlgFQABgB

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 3AD5 42 B
64 B 75ms
73ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsunVc3JkxB8KnBvx_eyZybf5thSjPU3opFVMMD4RYwS3O0bcD-xu7QMYBPmxoGt1EZ-BcGE2rRkhgX-E7t59dLNPV2VXMfYbfrSpECyPP5CsU50NgHuJozmZzYPp4fAttnzMSLwzw&sai=AMfl-YSNhho-W1foZIX_GCpLxwnNamjHQKHGv50NDpf0pZkQL2_78garCdnrY1cWvbECM0ZIglLGmqqWEfihr9fQsXjwZ_FaOx6dmsfRuy58cYRaiDw15IHHDOVs_E0&sig=Cg0ArKJSzLCk5sxZQNhIEAE&cid=CAASF-RoX6lWfB9q08BN9QtkD73NKCJxbZxN&id=lidarv&acvw=sv%3D935%26cb%3Dima%26e%3D15%26nas%3D1%26sdk%3Dh%26p%3D7050,690,7301,1137%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D40054%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26ic%3D18%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D0%26ces%26femt%3D1065%26femvt%3D0%26emc%3D2%26emuc%3D0%26emb%3D0,0,0,0,0%26avms%3Dexc%26qi%3D718280693%26psm%3D-2147483648%26psv%3D0%26psfv%3D0%26psa%3D0%26ptlt%3D1750%26pngs%3D9,14,15%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1662944685895&avm=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 3AD5 42 B
64 B 59ms
58ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CuTRerYUeY6vJI4bv3gPlmLDoAczYi4xq3ZiQ8cIPsJAfEAEguY2OKGCV4pCCoAegAYyhr8QCyAEFqQKGvsSd3diwPuACAKgDAZgEAKoE3wJP0NG_LRFdOWTQ0J_5pcKOOeP7ceVSJw8BlqHvrXncctYa9XeOtoQBx4ngGUvcSvH_z19sQ8K4VnbiHRrJbtzTgDGdMO7LGf4y9jbUe8czVKok1A7n2tSQt9yECU01KD3LZzfmpVBZQ3FcZJsuFpaiQ7xRILgng_DQcdlRU9l-CCNE4SgNAEW7llWy8TX9C-EHbkK1WZtFw9XdEuzbSx8Hbq4G4f-cPMtNatIoRhIK5IbGzPnD_IHnXJnq1IlBGxnkfoUxY0wxtf0uLubYcqcOj029xA03koHREvrHjyycp4NdaYrw5GS0XwB4rViDHnv4cqi7qWcBaU2374iY91Gk9hDJvTFRZxy6mFYqWbuFsbvsEl5bUwNSFSmkZ6_uwc5jqGBlLQDJPKkHsWMoeX7GsQImqSeJ3QfCAO-RsE9-xEjuCx6q39pfOMY6x-W4nzg-JjSfM2A8a0nlGvlnbjzABOe7w9CCBOAEAaAGVIAH3N7QuwGoB47OG6gHk9gbqAec3BuoB-6WsQKoB_6esQKoB6SjsQKoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcBqAgB0ggRCIDhgBAQARgdMgKqAjoCgECACgPICwHYEw3QFQGYFgHiFgIIAfgWAYAXAQ&sigh=2HTSgfltEF4&cmd=Ch1jYS12aWRlby1wdWItOTc5MDc2MjgxMTA1NzY5ORAAGAI&label=part2viewed&ad_mt=0&acvw=sv%3D935%26cb%3Dima%26e%3D0%26nas%3D1%26sdk%3Dh%26p%3D7050,690,7301,1137%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D40054%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26i0%3D18%26ic%3D0%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D0%26ces%26femt%3D1065%26femvt%3D0%26emc%3D2%26emuc%3D0%26emb%3D0,0,0,0,0%26avms%3Dexc%26qi%3D718280693%26psm%3D-2147483648%26psv%3D0%26psfv%3D0%26psa%3D0%26ptlt%3D1751%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1662944685895&sdkv=h.3.529.2&vci=Cm4IARIYcHViYWRzLmcuZG91YmxlY2xpY2submV0GgdBZFNlbnNlIAQqDDUzMzM1MDA1OTEwMTIMNTg3NjMyNDMzMjA0QMkCUiYQDyUAACBCKAE6C0ZlTFFhTndwY004Qglnb29nbGVhZHNIlgFQABgB

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 3AD5 42 B
64 B 59ms
57ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CuTRerYUeY6vJI4bv3gPlmLDoAczYi4xq3ZiQ8cIPsJAfEAEguY2OKGCV4pCCoAegAYyhr8QCyAEFqQKGvsSd3diwPuACAKgDAZgEAKoE3wJP0NG_LRFdOWTQ0J_5pcKOOeP7ceVSJw8BlqHvrXncctYa9XeOtoQBx4ngGUvcSvH_z19sQ8K4VnbiHRrJbtzTgDGdMO7LGf4y9jbUe8czVKok1A7n2tSQt9yECU01KD3LZzfmpVBZQ3FcZJsuFpaiQ7xRILgng_DQcdlRU9l-CCNE4SgNAEW7llWy8TX9C-EHbkK1WZtFw9XdEuzbSx8Hbq4G4f-cPMtNatIoRhIK5IbGzPnD_IHnXJnq1IlBGxnkfoUxY0wxtf0uLubYcqcOj029xA03koHREvrHjyycp4NdaYrw5GS0XwB4rViDHnv4cqi7qWcBaU2374iY91Gk9hDJvTFRZxy6mFYqWbuFsbvsEl5bUwNSFSmkZ6_uwc5jqGBlLQDJPKkHsWMoeX7GsQImqSeJ3QfCAO-RsE9-xEjuCx6q39pfOMY6x-W4nzg-JjSfM2A8a0nlGvlnbjzABOe7w9CCBOAEAaAGVIAH3N7QuwGoB47OG6gHk9gbqAec3BuoB-6WsQKoB_6esQKoB6SjsQKoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcBqAgB0ggRCIDhgBAQARgdMgKqAjoCgECACgPICwHYEw3QFQGYFgHiFgIIAfgWAYAXAQ&sigh=2HTSgfltEF4&cmd=Ch1jYS12aWRlby1wdWItOTc5MDc2MjgxMTA1NzY5ORAAGAI&label=admute&ad_mt=0&acvw=sv%3D935%26cb%3Dima%26e%3D10%26nas%3D1%26sdk%3Dh%26p%3D7050,690,7301,1137%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D10%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D10%26pst%3D-1%26dur%3D40054%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D10%26is%3D18%26i0%3D18%26ic%3D4096%26cs%3D4114%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D0%26ces%26femt%3D1065%26femvt%3D0%26emc%3D2%26emuc%3D0%26emb%3D0,0,0,0,0%26avms%3Dexc%26qi%3D718280693%26psm%3D-2147483648%26psv%3D0%26psfv%3D0%26psa%3D0%26ptlt%3D1754%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1662944685895&sdkv=h.3.529.2&vci=Cm4IARIYcHViYWRzLmcuZG91YmxlY2xpY2submV0GgdBZFNlbnNlIAQqDDUzMzM1MDA1OTEwMTIMNTg3NjMyNDMzMjA0QMkCUiYQDyUAACBCKAE6C0ZlTFFhTndwY004Qglnb29nbGVhZHNIlgFQABgB

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 moatvideo.js Show response
z.moatads.com/cedatojsvideo958042602703/ 343 KB
114 KB 10ms
10ms Script
application/x-javascript 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cedatojsvideo958042602703/moatvideo.js
Requested by: Host: player.ex.co
URL: https://player.ex.co/player/949f6068-329e-4344-84e7-de26e7f62396
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 7f349eccf6b15cca595ac0a6569b619bd03853c746763ab66a6ab10bb68648cb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:46 GMT
content-encoding: gzip
last-modified: Mon, 29 Aug 2022 19:15:11 GMT
server: AmazonS3
x-amz-request-id: VA5KFJ19J141CK6T
etag: "a5e03673f6af759a549db3eab496c9f6"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=41398
accept-ranges: bytes
content-length: 116295
x-amz-id-2: C+CCO7c2iQXm3+/1MjleU0iILmdviVcegTgWrVsMmrBIhxgFUctaLUcF/gRpQ6ujsS3/6CDsHtM=

GET
H2 200 eeeea7f79a0c40d3b599b4cc1ab04786.jpeg
publisher-media.wibbitz.com/prod-media/b7f7ecf10a22a4fc99966fe5c00d348c6/ 77 KB
77 KB 15ms
15ms Image
image/jpeg 2600:9000:20eb:6000:1c:f793:41c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://publisher-media.wibbitz.com/prod-media/b7f7ecf10a22a4fc99966fe5c00d348c6/eeeea7f79a0c40d3b599b4cc1ab04786.jpeg
Requested by: Host: player.ex.co
URL: https://player.ex.co/player/949f6068-329e-4344-84e7-de26e7f62396
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:6000:1c:f793:41c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 14518a7560730aa4b6c76cd6a2bd218cdaaa46b91c0dc5258040bd1bf0c72479

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 23:02:55 GMT
via: 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
last-modified: Fri, 09 Sep 2022 21:43:46 GMT
server: AmazonS3
age: 8546
etag: "641f1f88db712153ec105305a3ed15f1"
x-cache: Hit from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 78466
x-amz-cf-id: 0wZrWiI1F7FeVszhosR6Qf9s14fuN7GUtJPH95Zllh9W9Z_c9SDdiw==

POST
H2 200 events Show response
prd-collector-anon.ex.co/main/ 0
135 B 104ms
103ms XHR
text/plain 3.211.29.40
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prd-collector-anon.ex.co/main/events
Requested by: Host: player.ex.co
URL: https://player.ex.co/player/949f6068-329e-4344-84e7-de26e7f62396
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.211.29.40 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-29-40.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://theparadise.ng/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://theparadise.ng
date: Mon, 12 Sep 2022 01:04:46 GMT
access-control-allow-credentials: true
content-length: 0
vary: Origin
content-type: text/plain; charset=utf-8

POST
H2 200 events Show response
prd-collector-anon.ex.co/main/ 0
135 B 105ms
103ms XHR
text/plain 3.211.29.40
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prd-collector-anon.ex.co/main/events
Requested by: Host: player.ex.co
URL: https://player.ex.co/player/949f6068-329e-4344-84e7-de26e7f62396
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.211.29.40 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-29-40.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://theparadise.ng/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://theparadise.ng
date: Mon, 12 Sep 2022 01:04:46 GMT
access-control-allow-credentials: true
content-length: 0
vary: Origin
content-type: text/plain; charset=utf-8

GET
H2 204 adplayedi
s-10.channelexco.com/ppx/ 0
109 B 121ms
119ms Image
text/plain 192.96.200.88
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-10.channelexco.com/ppx/adplayedi?sid=&domain=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&se=3e986fd3-1ca0-4575-9879-7de2898d44e1&pv=117.25&dd=theparadise.ng&gpvck=v022771574__446x251______DEF__nil__409&sa=shd&s=2.3&p=1548817699&gpvn=3&t=2.3&cb=1662944686074
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.96.200.88 Ashburn, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: openresty /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:46 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
server: openresty

GET
H2 200 multiple-events
s-10.channelexco.com/vpx/ 43 B
142 B 121ms
119ms Image
image/gif 192.96.200.88
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-10.channelexco.com/vpx/multiple-events?events=errori%2Cerrori%2Cerrori%2Cerrori%2Cerrori%2Cloadedi%2Crequesti&data=mu%3A%2Cp%3A1548817699%2Cv%3A591280398%2Cdmid%3A1548817699-591280398%2Cen%3A21%2Cem%3Ano%20%3CAd%3E%20element%2Clr%3A1%2Ct%3A0.2%7Cs%3A1.6%2Cmu%3A%2Cp%3A1548817699%2Cv%3A765589296%2Cdmid%3A1548817699-765589296%2Cen%3A10%2Cem%3AThe%20VAST%20response%20document%20is%20empty.%2Ct%3A1.2%7Cs%3A1.6%2Cmu%3A%2Cp%3A1548817699%2Cv%3A1551939958%2Cdmid%3A1548817699-1551939958%2Cen%3A10%2Cem%3AThe%20VAST%20response%20document%20is%20empty.%2Ct%3A1.2%7Cs%3A1.6%2Cmu%3A%2Cp%3A1548817699%2Cv%3A634096559%2Cdmid%3A1548817699-634096559%2Cen%3A10%2Cem%3AThe%20VAST%20response%20document%20is%20empty.%2Ct%3A1.2%7Cs%3A1.7%2Cmu%3A%2Cp%3A1548817699%2Cv%3A2051825037%2Cdmid%3A1548817699-2051825037%2Cen%3A10%2Cem%3AIMA%20Content%20Resume%2Clr%3A1%2Ct%3A1.6%7Cs%3A2.1%2Cp%3A1548817699%2Cv%3A1049792968%2Cdmid%3A1548817699-1049792968%2Ct%3A2.0%2Cy%3A4%2Cyy%3A4%7Cs%3A2.1%2Cp%3A1548817699%2Cv%3A1049792968%2Cdmid%3A1548817699-1049792968&sid=&domain=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&se=3e986fd3-1ca0-4575-9879-7de2898d44e1&pv=117.25&dd=theparadise.ng&gpvck=v022771574__446x251______DEF__nil__409&sa=shd&s=0.2&cb=1662944686075
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.96.200.88 Ashburn, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: openresty /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:46 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: openresty
content-length: 43
content-type: image/gif

GET
H2 204 areq
a.channelexco.com/ 0
92 B 425ms
126ms Image
text/plain 209.58.147.67
LEASEWEB-USA-DAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.channelexco.com/areq?sid=&domain=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&se=3e986fd3-1ca0-4575-9879-7de2898d44e1&pv=117.25&dd=theparadise.ng&gpvck=v022771574__446x251______DEF__nil__409&sa=shd&dmid1=1548817699-591280398&dmid2=1548817699-1346433317&dmid3=1548817699-1049792968&dmid4=1548817699-2051825037&dmid5=1548817699-765589296&dmid6=1548817699-1551939958&dmid7=1548817699-634096559&cb=1662944686075
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.58.147.67 Dallas, United States, ASN394380 (LEASEWEB-USA-DAL, US),
Reverse DNS
Software: openresty /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:46 GMT
cache-control: no-cache
server: openresty
expires: Mon, 12 Sep 2022 01:04:45 GMT

GET
H2 204 multiple-events
s-10.channelexco.com/vpx/ 0
291 B 122ms
120ms Image
text/plain 192.96.200.88
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-10.channelexco.com/vpx/multiple-events?events=starti&data=p%3A1548817699%2Cv%3A1049792968%2Cdmid%3A1548817699-1049792968%2Ct%3A0.2%2Cgpvn%3A3%2Cy%3A4%2Cyy%3A4%2Cwd%3A447%2Chd%3A251&sid=&domain=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&se=3e986fd3-1ca0-4575-9879-7de2898d44e1&pv=117.25&dd=theparadise.ng&gpvck=v022771574__446x251______DEF__nil__409&sa=shd&s=2.3&cb=1662944686087
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.96.200.88 Ashburn, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: openresty /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:46 GMT
access-control-request-method: GET, POST
server: openresty
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H3 200 /
c.mgid.com/vs/ 43 B
167 B 121ms
120ms Image
image/gif 2606:4700:1::6813:864e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.mgid.com/vs/?tid=603&iid=1149345&e=load&o=%7B%22timeOffset%22%3A0%2C%22muidn%22%3A%22-%22%2C%22playerEngine%22%3A%22exco%22%2C%22adPlayer%22%3A0%2C%22uuid%22%3A%22e26ddee8-3236-11ed-9feb-e43d1a2a53a0%22%2C%22subId%22%3A0%2C%22sticky%22%3A0%2C%22viewable%22%3A0%2C%22tt%22%3A%22Direct%22%7D&t=0&c=55249&h=3hJknWoXpGweR3ILKpsSv_4_vPVVNEs0BWO5-z7kR3mcEQOZmqiYq5fHA4OjiOrSKLI3gm6AS2leDLvCk2BgJw**
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:1::6813:864e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:46 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7494bb202aa59b3d-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-type: image/gif

GET
H2 200 mgPlayer_v2_sprite.svg
video-native.mgid.com/mgPlayer/img/ 3 KB
1 KB 18ms
18ms Image
image/svg+xml 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://video-native.mgid.com/mgPlayer/img/mgPlayer_v2_sprite.svg
Requested by: Host: video-native.mgid.com
URL: https://video-native.mgid.com/mgPlayer/css/1.11/performance.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: e59c0f735471d90ea02234c6d94ee8fb9033ddd50f3f6b50ecf238dba336b842

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://video-native.mgid.com/mgPlayer/css/1.11/performance.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-id: fr5-up-gc32
date: Mon, 12 Sep 2022 01:04:46 GMT
content-encoding: gzip
last-modified: Wed, 07 Jul 2021 14:37:30 GMT
server: nginx
etag: "c1c-5c6897a74212b-gzip"
vary: Accept-Encoding
x-cached-since: 2022-07-26T09:43:36+00:00
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=290304000, public
cache: HIT
accept-ranges: bytes
content-length: 1154
expires: Wed, 26 Jul 2023 09:43:36 GMT

GET
H3 200 hhrtBw21.html Show response
tpc.googlesyndication.com/sodar/ Frame 2211 23 KB
9 KB 45ms
44ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/hhrtBw21.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Oy6hyfNY.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

861aed070db50ce0da9928455deff784c115b44540b09450f225ff7cff0c7429

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://imasdk.googleapis.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 312091
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8727
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 08 Sep 2022 10:23:15 GMT
expires: Fri, 08 Sep 2023 10:23:15 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js Show response
pagead2.googlesyndication.com/bg/ Frame 2211 36 KB
16 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/hhrtBw21.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2510ed81c525ffb3948c9e103bc6d56f036e45346a0d4c6e481602c223c74ba5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 22:49:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8087
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15893
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 11 Sep 2023 22:49:59 GMT

GET
H2 200 n.js Show response
geo.moatads.com/ 111 B
284 B 174ms
33ms Script
text/html 52.18.219.233
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CA%24%3D!!tmx%5Dh3Mn%3Cz%5D6WAJN3NZ_h)G%3E3%5D*lTr1W*d%5B4kf%2FLyUoRdByZ%3CPnKMV%25%3C%2Cbq.%22oDOk%2Cz%25GY&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-BuYHbtgGjXhDLOlS9taa18sl5UMbMAFrHQZRAnlp9pAdeA91T5s1LwZtUqv15LnesVBD&rs=1-kplEbVjbGrWLAw%3D%3D&sc=1&os=1-Rw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&i=CEDATOJSVIDEO1&hp=1&wf=1&ra=2&pxm=2&vz=-&zp=0&sgs=2&vb=-1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=8&f=0&j=&t=1662944686215&de=137759801049&m=0&ar=5aeef158bee-clean&iw=de966c1&q=2&cb=0&ym=0&cu=1662944686215&ll=2&lm=0&ln=0&r=0&em=0&en=0&d=368531133%3A1548817699%3A%5BDMID%5D%3A&zGSRC=1&gu=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&id=1&ii=4&bo=theparadise.ng&bd=undefined&zMoatOrigSlicer1=theparadise.ng&zMoatOrigSlicer2=N%2FA&gw=cedatojsvideo958042602703&fd=1&it=500&ti=0&ih=2&pe=1%3A3378%3A3378%3A3555%3A3370&jk=-1&jm=-1&fs=200157&na=1777893943&cs=0&ord=1662944686215&jv=1765924405&callback=DOMlessLLDcallback_79047024
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/cedatojsvideo958042602703/moatvideo.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.18.219.233 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-219-233.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/6.0 /
Resource Hash: 805cf619aae1cb2144ba9fbf920aa9c5fecc45c1327e31272badd1f0355d7b11

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 01:04:46 GMT
cache-control: max-age=900
server: Microsoft-IIS/6.0
timing-allow-origin: *
etag: "8024676dd61144baa5ec2e60c42cf6c005b761ac"
content-length: 111
content-type: text/html; charset=UTF-8

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
274 B 50ms
7ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=CEDATOJSVIDEO1&hp=1&wf=1&ra=2&pxm=2&vz=-&zp=0&sgs=2&vb=-1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=8&f=0&j=&t=1662944686215&de=137759801049&m=0&ar=5aeef158bee-clean&iw=de966c1&q=3&cb=0&ym=0&cu=1662944686215&ll=2&lm=0&ln=0&r=0&em=0&en=0&d=368531133%3A1548817699%3A%5BDMID%5D%3A&zGSRC=1&gu=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&id=1&ii=4&bo=theparadise.ng&bd=undefined&zMoatOrigSlicer1=theparadise.ng&zMoatOrigSlicer2=N%2FA&gw=cedatojsvideo958042602703&fd=1&it=500&ti=0&ih=2&pe=1%3A3378%3A3378%3A3555%3A3370&jk=-1&jm=-1&fs=200157&na=64689911&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

unused62: 8096267
date: Mon, 12 Sep 2022 01:04:46 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 12 Sep 2022 01:04:46 GMT

POST
H2 200 events Show response
prd-collector-anon.ex.co/main/ 0
135 B 102ms
102ms XHR
text/plain 3.211.29.40
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prd-collector-anon.ex.co/main/events
Requested by: Host: player.ex.co
URL: https://player.ex.co/player/949f6068-329e-4344-84e7-de26e7f62396
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.211.29.40 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-29-40.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://theparadise.ng/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://theparadise.ng
date: Mon, 12 Sep 2022 01:04:46 GMT
access-control-allow-credentials: true
content-length: 0
vary: Origin
content-type: text/plain; charset=utf-8

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
274 B 7ms
7ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&ra=2&pxm=2&vz=-&zp=0&sgs=2&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=https%3A%2F%2Ftheparadise.ng%2F%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F-&i=CEDATOJSVIDEO1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CA%24%3D!!tmx%5Dh3Mn%3Cz%5D6WAJN3NZ_h)G%3E3%5D*lTr1W*d%5B4kf%2FLyUoRdByZ%3CPnKMV%25%3C%2Cbq.%22oDOk%2Cz%25GY&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-BuYHbtgGjXhDLOlS9taa18sl5UMbMAFrHQZRAnlp9pAdeA91T5s1LwZtUqv15LnesVBD&rs=1-kplEbVjbGrWLAw%3D%3D&sc=1&os=1-Rw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&bq=8&g=0&h=231&w=410&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&fy=1175&gp=954&zGSRC=1&gu=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&id=1&ii=4&f=0&j=&t=1662944686215&de=137759801049&cu=1662944686215&m=72&ar=5aeef158bee-clean&iw=de966c1&cb=0&ym=0&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=954&lb=8774&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A3378%3A3378%3A3555%3A3370&as=0&ag=28&an=0&gf=28&gg=0&ez=1&aj=1&pg=100&pf=0&ib=1&cc=0&bw=28&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&hj=0&pv=0&em=0&en=0&st=1&su=1&of=1&oz=1&bu=55&cd=0&ah=55&am=0&dq=55&dr=0&ds=55&dt=0&zx=0&vu=0&tb=0&te=0&nj=0&vm=0&vl=0&vt=0&vd=0&zMoatSRE=0&zMoatVSD=0&hc=0&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&eb=1&rf=0&re=0&cl=0&at=0&d=368531133%3A1548817699%3A%5BDMID%5D%3A&bo=theparadise.ng&bd=undefined&gw=cedatojsvideo958042602703&zMoatOrigSlicer1=theparadise.ng&zMoatOrigSlicer2=N%2FA&ab=3&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=2&jk=-1&jm=-1&tc=0&fs=200157&na=1633513581&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

unused62: 8096267
date: Mon, 12 Sep 2022 01:04:46 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 12 Sep 2022 01:04:46 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
274 B 7ms
7ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=29&q=0&hp=1&wf=1&ra=2&pxm=2&vz=-&zp=0&sgs=2&vb=-1&kq=1&lo=0&tr=1&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=CEDATOJSVIDEO1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CA%24%3D!!tmx%5Dh3Mn%3Cz%5D6WAJN3NZ_h)G%3E3%5D*lTr1W*d%5B4kf%2FLyUoRdByZ%3CPnKMV%25%3C%2Cbq.%22oDOk%2Cz%25GY&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-BuYHbtgGjXhDLOlS9taa18sl5UMbMAFrHQZRAnlp9pAdeA91T5s1LwZtUqv15LnesVBD&rs=1-kplEbVjbGrWLAw%3D%3D&sc=1&os=1-Rw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&bq=8&g=1&h=231&w=410&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&fy=1175&gp=954&zGSRC=1&gu=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&id=1&ii=4&f=0&j=&t=1662944686215&de=137759801049&cu=1662944686215&m=74&ar=5aeef158bee-clean&iw=de966c1&cb=0&ym=0&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=954&lb=8774&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A3378%3A3378%3A3555%3A3370&as=0&ag=28&an=28&gf=28&gg=28&ez=1&aj=1&pg=100&pf=100&ib=1&cc=0&bw=28&bx=28&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&hj=0&pv=0&em=0&en=0&st=1&su=1&of=1&oz=1&bu=55&cd=55&ah=55&am=55&dq=55&dr=55&ds=55&dt=55&zx=0&vu=0&tb=0&te=0&nj=0&vm=0&vl=0&vt=0&vd=0&zMoatSRE=0&zMoatVSD=0&hc=0&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&eb=1&ef=1&rf=0&re=0&cl=0&at=0&d=368531133%3A1548817699%3A%5BDMID%5D%3A&bo=theparadise.ng&bd=undefined&gw=cedatojsvideo958042602703&zMoatOrigSlicer1=theparadise.ng&zMoatOrigSlicer2=N%2FA&ab=3&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=2&jk=-1&jm=-1&tc=0&fs=200157&na=1901219229&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

unused62: 8096267
date: Mon, 12 Sep 2022 01:04:46 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 12 Sep 2022 01:04:46 GMT

POST
H2 204 events
e.channelexco.com/ 0
246 B 92ms
92ms Ping
text/plain 23.19.226.131
LEASEWEB-USA-NYC

General

Check archive.org

Show headers Download Go to

Full URL: https://e.channelexco.com/events
Requested by: Host: player.ex.co
URL: https://player.ex.co/player/949f6068-329e-4344-84e7-de26e7f62396
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.19.226.131 New York, United States, ASN396362 (LEASEWEB-USA-NYC, US),
Reverse DNS
Software: openresty /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://theparadise.ng/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:46 GMT
access-control-request-method: GET, POST
server: openresty
access-control-allow-methods: GET, POST
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
access-control-allow-credentials: true
access-control-allow-headers: *

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2211 0
20 B 72ms
72ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=36&t=2&li=v_h.3.529.2&bgai=B3EPNrYUeY6vJI4bv3gPlmLDoAQAAAAA4AboFEwi2243ah476AhUih4MHHR5lADM&bg=!QUKlQgbNAAZTikH4c4o7ACkAdvg8WuWB-keXKq9_wRGB0sPEP89UYQCmrFssbaGOZfVCssPn_uWQsAIAAABDUgAAAAJoAQeZAoL15sTEZUOxvHEJFzqWV-_jslrGE2O4s1oqy5t-c3ANGncG3wZwiBczrqNl4CDcC6WEWmSlHZa2qbpc4yatQvmoFml8L0umJp2qihEprjaEisUEPB2Crf_KbuursptV22x9M6GKTqEDhjyvN2c7byem1Glkfiq1ZxtCbLXfvvpmqx4B9WMq3UFG0pU8j8y1mEBBFlMNsKk0rweb6dHFMDO6-hzuZAMzLzr8KE9CD14rcnNTXuNJbQlJnLKhrAPUdotrKQL5rxE8YUnzHFzxZecg9eGfbeZnTrvgLycJEe2TuDw_HLJiQgsvyPQ-BhF8lW3mFRt4RuGWxzHH2Y4qq9xfiGxoH3Qhsfkmsw8UNWxvpZOPLVlCWmYPdJL6p3wQ7KNyT0i-cIXFBse53b7c1f27WJy2jhYZ80Jmrr0Ws_tbTU7FjRA2vcqjRBPCli5mM1C7WpMWc1I8nUBa18tU2xjZ88S8akV34vKnnPU7wkkMwm9aBcErwhcuqUq8iARDb7udkaYVaU4NZFap65zYknIIUYZ6ObfvALnS73xhr2YiqS2svqIxHWLTu2Hx8Z5Z53GNRP7C_kRndbY6c-CvpBZH2IMqlHlZhCC5sgVeTqXN6gljARIAEmdTC1V2FclJ1EIkEOTj2_uuuqmpG9zebGMojE-ikAcbXBGO1g1hmhbKf59OwHIZu2c42Vtu8efHoGrRv1yAgWHPhsSFkIYYf_O6vNLizDl1j-mmdW_wsIAcOdAYunyROVsYnFaEyYr_ovxjdHkmAi3PKqM90KaY_Dd-5rWl487SrcVvSvcY42tC7LUisw6T0sHCinBgrglLLYUOD24EbBKOfPRRLoE3X9L2pgw

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel.gif
cedatojsvideo958042602703.s.moatpixel.com/ 43 B
274 B 62ms
6ms Image
image/gif 23.35.229.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cedatojsvideo958042602703.s.moatpixel.com/pixel.gif?m=1&vpt=55&iv=0&tuv=-1&ivt=28&cvt=28&fvt=28&cfvt=28&vol=0&at=0&cat=0&gmv=0&gmt=0&cgmt=0&apd=55&dh=40000&hov=0&th=-1&d=theparadise.ng&w=410&h=231&sp=0&bfa=1&L1id=368531133&L2id=1548817699&L3id=%5BDMID%5D&L4id=-&S1id=theparadise.ng&S2id=-&ord=1662944686215&r=137759801049&t=meas&os=1&fi2=0&div1=0&ait=0&bedc=1&q=1&nu=1&ib=0&dc=1&ob=0&oh=1&lt=1&ab=0&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.229.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-229-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

unused62: 8096267
date: Mon, 12 Sep 2022 01:04:46 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 12 Sep 2022 01:04:46 GMT

GET
H2 200 pixel.gif
cedatojsvideo958042602703.s.moatpixel.com/ 43 B
274 B 63ms
7ms Image
image/gif 23.35.229.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cedatojsvideo958042602703.s.moatpixel.com/pixel.gif?m=1&vpt=55&iv=0&tuv=-1&ivt=28&cvt=28&fvt=28&cfvt=28&vol=0&at=0&cat=0&gmv=0&gmt=0&cgmt=0&apd=55&dh=40000&hov=0&th=-1&d=theparadise.ng&w=410&h=231&sp=0&bfa=1&L1id=368531133&L2id=1548817699&L3id=%5BDMID%5D&L4id=-&S1id=theparadise.ng&S2id=-&ord=1662944686215&r=137759801049&t=hdn&os=1&fi2=0&div1=0&ait=0&bedc=1&q=2&nu=1&ib=0&dc=1&ob=0&oh=1&lt=1&ab=0&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.229.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-229-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

unused62: 8096267
date: Mon, 12 Sep 2022 01:04:46 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 12 Sep 2022 01:04:46 GMT

GET
H2 200 pixel.gif
cedatojsvideo958042602703.s.moatpixel.com/ 43 B
274 B 8ms
8ms Image
image/gif 23.35.229.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cedatojsvideo958042602703.s.moatpixel.com/pixel.gif?m=1&vpt=397&iv=0&tuv=-1&ivt=370&cvt=370&fvt=370&cfvt=370&vol=0&at=0&cat=0&gmv=0&gmt=0&cgmt=0&apd=397&dh=40000&hov=0&th=-1&d=theparadise.ng&w=410&h=231&sp=0&bfa=1&L1id=368531133&L2id=1548817699&L3id=%5BDMID%5D&L4id=-&S1id=theparadise.ng&S2id=-&ord=1662944686215&r=137759801049&t=nht&os=1&fi2=0&div1=0&ait=0&bedc=1&q=3&nu=1&ib=0&dc=1&ob=0&oh=1&lt=1&ab=0&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.229.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-229-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

unused62: 8096267
date: Mon, 12 Sep 2022 01:04:46 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 12 Sep 2022 01:04:46 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame B35D 0
54 B 440ms
440ms Ping
image/gif 2404:6800:4002:81f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=4~l7y2bvrn&c=4769640348069&slotId=2384820174034.5&fb=simid_trueview&simid_trvc_e=s_psc
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/simid/simid_trueview_en.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4002:81f::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:47 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 avjp Show response
playbuzzltd-d.openx.net/v/1.0/ Frame 0A46 106 B
126 B 71ms
41ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://playbuzzltd-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&ch=UTF-8&res=1600x1200x24&ifr=true&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=4876dcd2-4d76-4bb3-bc87-a9557390c6ae&nocache=1662944687305&pubcid=2bbdb458-79a3-47e7-934f-7e192d092f53&schain=1.0%2C1!playbuzz.com%2C0010J00002BlxpGQAR%2C1%2C%2C%2C&openrtb=%7B%22imp%22%3A%5B%7B%22video%22%3A%7B%22w%22%3A410%2C%22h%22%3A231%2C%22api%22%3A%5B1%2C2%5D%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%5D%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22playbackmethod%22%3A%5B2%5D%2C%22linearity%22%3A1%2C%22minduration%22%3A1%2C%22startdelay%22%3A0%2C%22maxduration%22%3A60%7D%7D%5D%7D&auid=557057725&vwd=410&vht=231&aumfs=2000
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/prebid/pb-7.2.11.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:47 GMT
via: 1.1 google
server: OXGW/0.0.0
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://theparadise.ng
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 106
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 204 mvo Show response
tag.1rx.io/rmp/213020/0/ Frame 0A46 0
162 B 43ms
15ms XHR
text/plain 213.19.147.42
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.1rx.io/rmp/213020/0/mvo?z=1r&hbv=7.2,2.1
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/prebid/pb-7.2.11.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.19.147.42 Beverwijk, Netherlands, ASN3356 (LEVEL3, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://theparadise.ng
pragma: no-cache
date: Mon, 12 Sep 2022 01:04:47 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ Frame 0A46 173 B
402 B 277ms
8ms XHR
application/json 35.158.20.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/prebid/pb-7.2.11.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.158.20.13 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-158-20-13.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 009917eb31cabb878caf1c23ac8df8709fd070ee180cc807ff3b499b998cfd0c

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:47 GMT
content-encoding: gzip
x-prebid: pbs-java/1.97.0
content-type: application/json
access-control-allow-origin: https://theparadise.ng
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 168
expires: 0

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
274 B 7ms
7ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&wf=1&ra=2&pxm=2&vz=-&zp=0&sgs=2&vb=-1&kq=1&lo=0&tr=1&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=CEDATOJSVIDEO1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CA%24%3D!!tmx%5Dh3Mn%3Cz%5D6WAJN3NZ_h)G%3E3%5D*lTr1W*d%5B4kf%2FLyUoRdByZ%3CPnKMV%25%3C%2Cbq.%22oDOk%2Cz%25GY&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-BuYHbtgGjXhDLOlS9taa18sl5UMbMAFrHQZRAnlp9pAdeA91T5s1LwZtUqv15LnesVBD&rs=1-kplEbVjbGrWLAw%3D%3D&sc=1&os=1-Rw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=8&g=2&h=231&w=410&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&fy=1175&gp=954&zGSRC=1&gu=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&id=1&ii=4&f=0&j=&t=1662944686215&de=137759801049&cu=1662944686215&m=1213&ar=5aeef158bee-clean&iw=de966c1&cb=0&ym=0&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=954&lb=8774&le=1&lf=176&lg=1&lh=31&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A3378%3A3378%3A3555%3A3370&as=1&ag=1175&an=28&gi=1&gf=1175&gg=28&ez=1&kw=1001&aj=1&pg=100&pf=100&ib=1&dw=1&cc=1&bw=1175&bx=28&jz=1001&dj=1&dx=1&aa=1&ad=1077&cn=0&gn=1&gk=1077&gl=0&cp=1001&cq=1&cr=1&hj=0&pv=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1001&cd=55&ah=1001&am=55&dq=1001&dr=55&ds=1001&dt=55&xd=00&zx=0&vu=0&tb=0&te=0&nj=0&vm=1&vl=0&vt=10&vd=0&zMoatSRE=0.049328125&zMoatVSD=40&hc=0&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&du=11&eb=1&ec=7804&ef=1&rf=0&re=0&cl=0&at=0&d=368531133%3A1548817699%3A%5BDMID%5D%3A&bo=theparadise.ng&bd=undefined&gw=cedatojsvideo958042602703&zMoatOrigSlicer1=theparadise.ng&zMoatOrigSlicer2=N%2FA&ab=3&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=2&jk=3&jm=-1&tc=0&fs=200157&na=1184378806&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

unused62: 8096267
date: Mon, 12 Sep 2022 01:04:47 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 12 Sep 2022 01:04:47 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
274 B 7ms
6ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&wf=1&ra=2&pxm=2&vz=-&zp=0&sgs=2&vb=-1&kq=1&lo=0&tr=1&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=CEDATOJSVIDEO1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CA%24%3D!!tmx%5Dh3Mn%3Cz%5D6WAJN3NZ_h)G%3E3%5D*lTr1W*d%5B4kf%2FLyUoRdByZ%3CPnKMV%25%3C%2Cbq.%22oDOk%2Cz%25GY&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-BuYHbtgGjXhDLOlS9taa18sl5UMbMAFrHQZRAnlp9pAdeA91T5s1LwZtUqv15LnesVBD&rs=1-kplEbVjbGrWLAw%3D%3D&sc=1&os=1-Rw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=8&g=3&h=231&w=410&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&fy=1175&gp=954&zGSRC=1&gu=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&id=1&ii=4&f=0&j=&t=1662944686215&de=137759801049&cu=1662944686215&m=1214&ar=5aeef158bee-clean&iw=de966c1&cb=0&ym=0&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=954&lb=8774&le=1&lf=176&lg=1&lh=31&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A3378%3A3378%3A3555%3A3370&as=1&ag=1175&an=1175&gi=1&gf=1175&gg=1175&ez=1&kw=1001&aj=1&pg=100&pf=100&ib=1&dw=1&cc=1&bw=1175&bx=1175&jz=1001&dj=1&dx=1&aa=1&ad=1077&cn=1077&gn=1&gk=1077&gl=1077&cp=1001&cq=1&cr=1&hj=0&pv=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1001&cd=1001&ah=1001&am=1001&dq=1001&dr=1001&ds=1001&dt=1001&xd=00&zx=0&vu=0&tb=0&te=0&nj=0&vm=1&vl=10&vt=10&vd=0&zMoatSRE=0.049328125&zMoatVSD=40&hc=0&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&du=11&eb=1&ec=7804&ef=1&rf=0&re=0&cl=0&at=0&d=368531133%3A1548817699%3A%5BDMID%5D%3A&bo=theparadise.ng&bd=undefined&gw=cedatojsvideo958042602703&zMoatOrigSlicer1=theparadise.ng&zMoatOrigSlicer2=N%2FA&ab=3&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=2&jk=3&jm=-1&tc=0&fs=200157&na=432326368&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

unused62: 8096267
date: Mon, 12 Sep 2022 01:04:47 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 12 Sep 2022 01:04:47 GMT

POST
H2 200 events Show response
prd-collector-anon.ex.co/main/ 0
135 B 102ms
102ms XHR
text/plain 3.211.29.40
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prd-collector-anon.ex.co/main/events
Requested by: Host: player.ex.co
URL: https://player.ex.co/player/949f6068-329e-4344-84e7-de26e7f62396
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.211.29.40 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-29-40.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://theparadise.ng/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://theparadise.ng
date: Mon, 12 Sep 2022 01:04:48 GMT
access-control-allow-credentials: true
content-length: 0
vary: Origin
content-type: text/plain; charset=utf-8

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 3AD5 42 B
64 B 78ms
77ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsunVc3JkxB8KnBvx_eyZybf5thSjPU3opFVMMD4RYwS3O0bcD-xu7QMYBPmxoGt1EZ-BcGE2rRkhgX-E7t59dLNPV2VXMfYbfrSpECyPP5CsU50NgHuJozmZzYPp4fAttnzMSLwzw&sai=AMfl-YSNhho-W1foZIX_GCpLxwnNamjHQKHGv50NDpf0pZkQL2_78garCdnrY1cWvbECM0ZIglLGmqqWEfihr9fQsXjwZ_FaOx6dmsfRuy58cYRaiDw15IHHDOVs_E0&sig=Cg0ArKJSzLCk5sxZQNhIEAE&cid=CAASF-RoX6lWfB9q08BN9QtkD73NKCJxbZxN&id=lidarv&acvw=sv%3D935%26cb%3Dima%26e%3D9%26nas%3D1%26sdk%3Dh%26p%3D954,1175,1185,1585%26tos%3D2016,0,0,0,0%26mtos%3D2016,2016,2016,2016,2016%26amtos%3D0,0,0,0,0%26mcvt%3D2016%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D2263%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D655%26pst%3D448%26dur%3D45108%26vmtime%3D2067%26dtos%3D2016%26dtoss%3D1%26dvs%3D2016%26dfvs%3D2016%26dvpt%3D2253%26is%3D275%26i0%3D18%26ic%3D16777473%26cs%3D16781587%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D0%26ces%26femt%3D1065%26femvt%3D0%26emc%3D13%26emuc%3D0%26emb%3D11,0,0,0,0%26avms%3Dexc%26qi%3D718280693%26psm%3D-2147483641%26psv%3D7%26psfv%3D7%26psa%3D0%26ptlt%3D4006%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,2016&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.04%26t%3D1662944685895

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 01:04:48 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
274 B 8ms
7ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&wf=1&ra=2&pxm=2&vz=-&zp=0&sgs=2&vb=-1&kq=1&lo=0&tr=1&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=CEDATOJSVIDEO1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CA%24%3D!!tmx%5Dh3Mn%3Cz%5D6WAJN3NZ_h)G%3E3%5D*lTr1W*d%5B4kf%2FLyUoRdByZ%3CPnKMV%25%3C%2Cbq.%22oDOk%2Cz%25GY&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-BuYHbtgGjXhDLOlS9taa18sl5UMbMAFrHQZRAnlp9pAdeA91T5s1LwZtUqv15LnesVBD&rs=1-kplEbVjbGrWLAw%3D%3D&sc=1&os=1-Rw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=8&g=4&h=231&w=410&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&fy=1175&gp=954&zGSRC=1&gu=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&id=1&ii=4&f=0&j=&t=1662944686215&de=137759801049&cu=1662944686215&m=2220&ar=5aeef158bee-clean&iw=de966c1&cb=0&ym=0&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=954&lb=8774&le=1&lf=176&lg=1&lh=31&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A3378%3A3378%3A3555%3A3370&as=1&ag=2183&an=1175&gi=1&gf=2183&gg=1175&ez=1&ck=2183&kw=1001&aj=1&pg=100&pf=100&ib=1&dw=1&ka=1&kb=1&cc=1&bw=2183&bx=1175&ci=2183&jz=1001&dj=1&dx=1&undefined=1&aa=1&ad=2085&cn=1077&gn=1&gk=2085&gl=1077&co=2085&cp=1001&cq=1&cr=1&ew=1&ex=1&hj=0&pv=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=2009&cd=1001&ah=2009&am=1001&dq=2009&dr=1001&ds=2009&dt=1001&xd=00&zx=0&vu=0&tb=0&te=0&nj=0&vm=1&vl=10&vt=18&vd=0&zMoatSRE=0.049328125&zMoatVSD=40&hc=0&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&du=11&eb=1&ec=7804&ef=1&rf=0&re=0&cl=0&at=0&d=368531133%3A1548817699%3A%5BDMID%5D%3A&bo=theparadise.ng&bd=undefined&gw=cedatojsvideo958042602703&zMoatOrigSlicer1=theparadise.ng&zMoatOrigSlicer2=N%2FA&ab=3&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=2&jk=3&jm=-1&tc=0&fs=200157&na=1111582259&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

unused62: 8096267
date: Mon, 12 Sep 2022 01:04:48 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 12 Sep 2022 01:04:48 GMT

GET
H2 200 pixel.gif
cedatojsvideo958042602703.s.moatpixel.com/ 43 B
274 B 7ms
6ms Image
image/gif 23.35.229.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cedatojsvideo958042602703.s.moatpixel.com/pixel.gif?m=1&vpt=2210&iv=1&tuv=2009&ivt=2183&cvt=2183&fvt=2183&cfvt=2183&vol=0&at=0&cat=0&gmv=0&gmt=0&cgmt=0&apd=2210&dh=40000&hov=0&th=-1&d=theparadise.ng&w=410&h=231&sp=0&bfa=1&L1id=368531133&L2id=1548817699&L3id=%5BDMID%5D&L4id=-&S1id=theparadise.ng&S2id=-&ord=1662944686215&r=137759801049&t=iv&os=1&fi2=1&div1=1&ait=0&bedc=1&q=4&nu=1&ib=0&dc=1&ob=0&oh=1&lt=1&ab=0&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.229.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-229-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

unused62: 8096267
date: Mon, 12 Sep 2022 01:04:48 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 12 Sep 2022 01:04:48 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
274 B 7ms
7ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=1&hp=1&wf=1&ra=2&pxm=2&vz=-&zp=0&sgs=2&vb=-1&kq=1&lo=0&tr=1&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=CEDATOJSVIDEO1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CA%24%3D!!tmx%5Dh3Mn%3Cz%5D6WAJN3NZ_h)G%3E3%5D*lTr1W*d%5B4kf%2FLyUoRdByZ%3CPnKMV%25%3C%2Cbq.%22oDOk%2Cz%25GY&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-BuYHbtgGjXhDLOlS9taa18sl5UMbMAFrHQZRAnlp9pAdeA91T5s1LwZtUqv15LnesVBD&rs=1-kplEbVjbGrWLAw%3D%3D&sc=1&os=1-Rw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=8&g=5&h=231&w=410&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&fy=1175&gp=954&zGSRC=1&gu=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&id=1&ii=4&f=0&j=&t=1662944686215&de=137759801049&cu=1662944686215&m=2221&ar=5aeef158bee-clean&iw=de966c1&cb=0&ym=0&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=954&lb=8774&le=1&lf=176&lg=1&lh=31&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A3378%3A3378%3A3555%3A3370&as=1&ag=2183&an=2183&gi=1&gf=2183&gg=2183&ez=1&ck=2183&kw=1001&aj=1&pg=100&pf=100&ib=1&dw=1&ka=1&kb=1&cc=1&bw=2183&bx=2183&ci=2183&jz=1001&dj=1&dx=1&undefined=1&aa=1&ad=2085&cn=2085&gn=1&gk=2085&gl=2085&co=2085&cp=1001&cq=1&cr=1&ew=1&ex=1&hj=0&pv=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=2009&cd=2009&ah=2009&am=2009&dq=2009&dr=2009&ds=2009&dt=2009&xd=00&zx=0&vu=0&tb=0&te=0&nj=0&vm=1&vl=18&vt=18&vd=0&zMoatSRE=0.049328125&zMoatVSD=40&hc=0&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&du=11&eb=1&ec=7804&ef=1&rf=0&re=0&cl=0&at=0&d=368531133%3A1548817699%3A%5BDMID%5D%3A&bo=theparadise.ng&bd=undefined&gw=cedatojsvideo958042602703&zMoatOrigSlicer1=theparadise.ng&zMoatOrigSlicer2=N%2FA&ab=3&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=2&jk=3&jm=-1&tc=0&fs=200157&na=1442146760&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://theparadise.ng/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

unused62: 8096267
date: Mon, 12 Sep 2022 01:04:48 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 12 Sep 2022 01:04:48 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: s7.addthis.com
URL: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Verdicts & Comments Add Verdict or Comment

190 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

17 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
theparadise.ng/pakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam	1970-01-20 06:38:56	Name: exco-uid Value: srqnbieuz16teh0m
.mgid.com/	1970-01-20 05:55:46	Name: __cf_bm Value: 5MJN_Je0U2fm48DfMMpiEYyKH8LYWsDMznWSaGnidQM-1662944682-0-AXUlX7C7hJDraW/2WJeCoKLPXxZvQUJr/NTKHhMwQ6rc+vwUBxQIRKrqXwT6R5K4XHnTGKDWd8Wf5nZmfBO1Ecc=
theparadise.ng/	1970-01-20 15:24:32	Name: __atuvc Value: 1%7C37
theparadise.ng/	1970-01-20 05:55:46	Name: __atuvs Value: 631e85aa3eb8447b000
.addthis.com/	1970-01-20 15:24:32	Name: uvc Value: 1%7C37
theparadise.ng/	1969-12-31 23:59:59	Name: MgidStorage Value: %7B%220%22%3A%7B%22svspr%22%3A%22%22%2C%22svsds%22%3A2%7D%2C%22C1319656%22%3A%7B%22page%22%3A1%2C%22time%22%3A1662944682714%7D%2C%22C1149345%22%3A%7B%22page%22%3A1%2C%22time%22%3A1662944682912%7D%7D
theparadise.ng/	1970-01-20 06:38:56	Name: _pbjs_userid_consent_data Value: 3524755945110770
.doubleclick.net/	1970-01-20 15:17:20	Name: IDE Value: AHWqTUntcLFo9D5TTx-oma1GKHwHr3vqqa276tS6VbtpyKPlffZVfy4IrG13H1fC5ec
.theparadise.ng/	1970-01-20 14:41:20	Name: zpstorage_MA%3D%3Dconsenttheparadise.ng Value: eyJyZXNvbHZlZCI6dHJ1ZSwiY29uc2VudFN0cmluZyI6IiIsImdkcHJBcHBsaWVzIjpmYWxzZSwidHJhY2siOnRydWUsImlkZW50aWZ5Ijp0cnVlLCJjb29raWVTeW5jIjp0cnVlLCJ2ZW5kb3JDb25zZW50Ijp0cnVlfQ%3D%3D
.addthis.com/	1970-01-20 15:24:32	Name: loc Value: MDAwMDBFVURFSEUyMzAxMTg4NTAwMzAwMDBDSA==
.reddit.com/	1970-01-20 15:31:44	Name: csv Value: 2
theparadise.ng/	1970-01-20 15:17:20	Name: cto_bidid Value: KcTkB19nU3A2NTVDRTJKRmN6UHhFR3JISiUyRlViZ1BFcVBTVXFnbXVyNGRTJTJGa2R3WXY0USUyQkhJMjZKVENCQ3BNMWF5OHdUUUtrJTJGSnAzTkpsUUtGS2lZVkpES2pnJTNEJTNE
theparadise.ng/	1970-01-20 15:17:20	Name: cto_bundle Value: aqViDF9FTVM0Wk9pNVpVWiUyRjVEa01vREtFZHhtc1BiZEtSZ213anhteFc1d1Z2WkdDc1g1OFJGZHhNJTJGWWhobDhzSVVPb2dVaVUlMkZRZWtSbktrZjZvSExjbSUyRnJnJTJGV1kyY2pZREg4REhRaFBRd0I2MVVnQyUyRnhCRFBaWkZZaWh5ZGFyYjJzaQ
.theparadise.ng/	1970-01-20 15:31:44	Name: _ga_1CR2EFW50G Value: GS1.1.1662944684.1.0.1662944684.0.0.0
.theparadise.ng/	1970-01-20 15:31:44	Name: _ga Value: GA1.1.640792261.1662944683
.theparadise.ng/	1970-01-20 05:55:46	Name: __cf_bm Value: J1EAQS3kA2XR0P3KeUDZdR3EMrrewJhSkqI3JYXMkfQ-1662944684-0-AfrWbkLnSpmG7UHSZexLiqWmGBb3UVcKihmVC8eQ/emlbtEkb1qY9/SSrmBQ1zWEnuoWXJmKZi4XMqn0iKeziCrEW+0LsXyLIchQYQ2Q95Im5pZ+7OcqYOOhpzLwPTjWtQ==
.theparadise.ng/	1970-01-20 15:17:20	Name: __gads Value: ID=728b4296b8291eca:T=1662944682:S=ALNI_MZnnNPe0QSiHZpNrYDLt-pAB90Nag

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1132559382746073&output=html&h=280&slotname=4144515257&adk=2663840036&adf=854766408&pi=t.ma~as.4144515257&w=1200&fwrn=4&fwrnh=100&lmt=1662944682&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Ftheparadise.ng%2Fpakistani-politician-imran-khans-instagram-account-used-to-promote-crypto-giveaway-scam%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662944682174&bpp=1&bdt=713&idt=358&shv=r20220907&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=2084311714587&frm=20&pv=1&ga_vid=640792261.1662944683&ga_sid=1662944683&ga_hid=554473790&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=80&ady=564&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31069448%2C31060049%2C31062931&oid=2&pvsid=2384351373504603&tmod=742133991&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=Deu7fp4Cwk&p=https%3A//theparadise.ng&dtd=359 Message: Origin trial controlled feature not enabled: 'attribution-reporting'.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.channelexco.com
ads.eu.criteo.com
ads.pubmatic.com
adservice.google.com
adservice.google.de
api-public.addthis.com
c.mgid.com
cat.fr.eu.criteo.com
cdn.ex.co
cdn.id5-sync.com
cdn.mgid.com
cdnjs.cloudflare.com
cedatojsvideo958042602703.s.moatpixel.com
cm.mgid.com
connect.facebook.net
content.zeotap.com
csi.gstatic.com
csm.eu.criteo.net
e.channelexco.com
fonts.googleapis.com
fonts.gstatic.com
geo.moatads.com
googleads.g.doubleclick.net
gum.criteo.com
i.ytimg.com
id5-sync.com
imasdk.googleapis.com
jsc.mgid.com
lb.eu-1-id5-sync.com
m.addthis.com
mug.criteo.com
p.channelexco.com
pagead2.googlesyndication.com
partner.googleadservices.com
pix.eu.criteo.net
playbuzzltd-d.openx.net
player.ex.co
prd-collector-anon.ex.co
prebid-server.rubiconproject.com
pubads.g.doubleclick.net
publisher-media.wibbitz.com
px.moatads.com
region1.google-analytics.com
rr4---sn-5hneknee.googlevideo.com
rtb.fr.eu.criteo.com
rtb.nl.eu.criteo.com
s-10.channelexco.com
s-img.mgid.com
s0.2mdn.net
s7.addthis.com
servicer.mgid.com
static.cloudflareinsights.com
static.criteo.net
static.news.bitcoin.com
tag.1rx.io
theparadise.ng
tpc.googlesyndication.com
v1.addthisedge.com
video-native.mgid.com
widgets.pinterest.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.reddit.com
yt3.ggpht.com
z.moatads.com
s7.addthis.com
141.95.98.69
142.250.186.162
151.101.128.84
151.101.129.140
151.101.130.132
162.19.138.116
178.250.0.139
178.250.0.160
178.250.0.162
178.250.2.146
192.96.200.88
2001:4860:4802:34::36
209.58.147.67
213.19.147.42
23.19.226.131
23.35.229.151
23.35.236.201
23.35.237.151
23.36.163.226
2404:6800:4002:81f::2003
2600:9000:20eb:6000:1c:f793:41c0:93a1
2606:4700:10::6816:1857
2606:4700:10::6816:3556
2606:4700:1::6813:864e
2606:4700:1::6813:884e
2606:4700:440e::ac40:9c1a
2606:4700::6811:190e
2606:4700::6812:189c
2606:4700:e2::ac40:8a0f
2a00:1450:4001:800::2006
2a00:1450:4001:80b::2001
2a00:1450:4001:80b::2008
2a00:1450:4001:80e::2003
2a00:1450:4001:80f::2001
2a00:1450:4001:80f::2004
2a00:1450:4001:810::2002
2a00:1450:4001:811::2002
2a00:1450:4001:812::2016
2a00:1450:4001:829::2002
2a00:1450:4001:82a::200a
2a00:1450:4001:82f::2002
2a00:1450:4001:82f::200a
2a00:1450:400e:8::9
2a02:2638:1::13
2a02:2638:1::2
2a02:2638:1::3
2a02:2638::2
2a02:2638::b
2a03:2880:f01c:216:face:b00c:0:3
2a03:90c0:41:2801::254
3.211.29.40
35.158.20.13
35.244.159.8
52.18.219.233
92.123.36.37
009917eb31cabb878caf1c23ac8df8709fd070ee180cc807ff3b499b998cfd0c
028677c8a947f497e9a555436e71007b88cae3ef7312b4fcb37719ae1f669551
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
08506e42ddc6e70f65fd376f6e427a795b7ed072f4ed8c12e120be7dac942313
0950a870ed7fc321504c6f4dabff8000bf43be014d1a91c32fb49a4ea6336940
095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6
0a5aceb2deef4d39cb3adcaa8e3aaa49ced354db1e981e452220d232a2c4070e
0bd5a37dc03826e35a281502820c716aa01809a29ea5c97b63d5da551dd25aa3
0bdefb20e10efa65a129e68037a90d1db18dc89b2a1ab7324ecbb679ac956d73
0eb10d7730724bcef9a3108b0c087ba94e32141e642f05fd7cdc2812ef915fcd
1288f3fcfdaadf5f14bd51527de6509725b1114e114680a5d5f2cfb73fbf4a10
14518a7560730aa4b6c76cd6a2bd218cdaaa46b91c0dc5258040bd1bf0c72479
1c59ff71a892295f7eee9d91a2bc50552a15c7055318535c51ac70231a8c7f57
20d966398aa614b28649eb18840ed43a405a84ec085c3013b8c0575dcf925dfc
22ade20b65aafc5c181211750f4651e4075399d0c8f17be38da60e3fe8087bb3
2318175e8dc599c091942c24bf1464ea62902eb79628cc156dae9865181c2ee0
234b9bab83aa0c52e9e5192995427a2bc44876cf1a11545ed631f369b8dc6534
2510ed81c525ffb3948c9e103bc6d56f036e45346a0d4c6e481602c223c74ba5
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
275400f2d6b8f4c294a8b67f4ef141d951e6e5cfebe2440946168a01fe745020
2af72af6936f6950777735f6032cb81720da21f45c75f4b3a08ade2d90750392
2cb071f9b52cd57bff7f866e2cb93ce9d6ae1804b10d9eb3e9599075967ecd85
2fd437b321115eecbf421233c7505e810936746a5ad5684cf233915b1c2f2c5b
30041fa0f06fc8cffe503a865dd7a5e1c2c620e7ce1277fc76a8fd1cc58701b3
33025cf788bb042b442f264c634352bd31ac5002c5227937aa6316c1834d55e7
34df890b773ddca119f66fcbc4e1e5e07d373f79b315075163f3446ab1cd5e89
38522a752476d909d673c77f8f7032f870cccd105805c6912cb64e8d7adabc32
389432c022a4c46442a2140186aef7d773997b2a1ab4a1081b875c87003c9d97
38a3fb17959e93e1bb04c3b6242c7fa9ff246d6b5c3aeade07018d4766739ef4
38d65bd7b0fe53707105341d0204c9235367600642ac21934719b5dc051ed1ce
394ddb1c211e4f30e56a293bedea06f20f658a8b15a3041d1c48beef3cd55e1e
3b0250d69d8fd2f4000885ae9b5d6d9414dfe6b53a1874bf095ef136dd73b2d2
3b2ea1c9f3587781b58285cf64279e67f6329a3924fb93f81529f1826e2f4d16
3cb45e0e3526ad9fe407c18f7506db38dc074deb8cf7d758266ae794fd2fe4c0
3dfa57f04e9ccb0ab7d376aa1cab8822cdc958176fc2bd20aa8c8ea830387478
4280f24f73795dbfc0d7fad8b04c909d5ca3421007f90b43dfb9b998e2a90f34
43605db4453aed3c966dda36f501cd25d35d7790e34f4c395c5259e69d89bc19
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
46ef4a81846fe13676f8b10625dbf9da789b293aafba254b31a3f60ab4833e93
49ae1cb8c4f139beb5d828ee2823aa505b9fd5ca7455766659a2832bd8f5da1d
4aa3f5a05efab5542bd21fffb6bed9bd2391dfdd5eb4bbdac20fd9dcbff29908
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f22e352c3bc5d92b517e1e11f433befbdabf295f9645370bdd35ab3656853b1
500cb6934ff00c4592847e76afa69fd28a7bc7ba49ca69f7c724bca5d13b4939
50eb69eb0b73e947ec9408e5a26db2c44af66735117de6d988272e040a952ae7
50f77fa9d32c1323f7e50da8d807f556cdddaea2161de6cf84a0c8b4c1dd6f79
53041341dd803aad517e02943e27861ccd29f76cf0bfa4890d4a9ddb3e4fa1a5
542e163c6693c24ec159bcdcdbe8324ddf224acf5c57d0e6b289c179acc4ce6e
54c0cd01d9687b483b0c0b2af5853fe8e1e282b6b2be25f0ef858a5eb4f7af37
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
582f15efe65ea228b232f0a86d79684017011d505ff1cbc603c1495231b850f2
5a1a8253fdc9653996614a8f70e40ef32ffad24fe68dd23ac39695ad85b816b8
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
5ae8337b4b0da31129f8e699ce777b823690d2b13b3c60ac505386350987a53b
5b9aecebf9fa8f2edec31f129ab05d66bf08d8a999e72737f9bdbf9eb70fedc1
5be70d5a1c0d7389edf9c44dfb579edec6593116194924abb6ecaa9ff75ea4f4
5d2c7c7e3b3e6c9f116bd2b8c1837030244942a9a9e35aa8c571fd77ccc36452
5df610992e3c56fe164e149309c511ccb67cfcd9e14ba321b516f57b8f492368
5f5762b48eeca0a2107c93ea0d7337c9a2d5a27d1d8f8d768b608b7a5be78340
603bc04288269bc556451d7121922b0fe3e069cc02f2b5225f44d42a7116aaa0
60ddc774c7b5fd0c01d169321a444da403d60c0042f6bee01b0c96f6e1535fda
6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
61cdaba86cb1a846cfe8511251b39fcee11b35da3829b1b1a8ba94fd21df902f
6248200e6d69af4443f83d29cb46c1122a1396f1c439c20c4529985d77b9ab26
679552970b131f8ab2f7f5d6202ad8cce0b63b89e110fdb6fa65fb1283fa399b
696ee2ff10f4d06272e23a40622ce122854f2f6bf39a7166179b79b78cdf9285
6a836e4caa35c5fbfb5c9df2eba59dc576ea7a0f8b61fef392379afb4515091d
6b2bb68f2d5799229c28c537ed8df8e997241fcad3e41fb324bfa3bec1fd627f
6c0166d05b31e52fac21f8f56c009640f561ded3f56543c9825a149e9ab570ce
6c895bf44d5da690370510ab0288dd9f5a5ed531a088065440fb2ae3553b4309
709498951b9d483f4b3d96481be60d476d94a4fbea2bbadf42878f64c686038b
70d5c4de881e718d0b7638959680ba86722d44eecbe4058d20dd77b8d0d97155
725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a
730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658
73e19401707d030422213eacea81ed13ef140752da1382a534e2e52385425e02
762a7b77077ba1625465af81e4ad7d9553b6e9b0296b2946a5a383fa33721f6d
762da8b35ea43269689a85dd6ee90d16ea187d9e65e98f783737a703bc127661
775916d4b61cb25c4a72f8c17768152f2ae8b2cd05e17b53c98bb9936f75f440
7992a4430843ef8b4bbae534358be3193aa1ae9c78f273e8e8a70b6af1244ac5
79d585aff058bfb7a252dc58d461f26202eca76ee30a8ffedd99ea1ae0e470ea
7b6bfa13f0778c40bb2a00af9819bea2f07afcb4d071e7e4f436196953a5db4d
7cc60de5360f91f302592180cebd5a16eda5ea2e72ca59722dc6933307b62f0c
7ec1ea6a5d7ce2078332c8ed54293ce4bfcad8e047b121cb79442df72c46536c
7f349eccf6b15cca595ac0a6569b619bd03853c746763ab66a6ab10bb68648cb
805cf619aae1cb2144ba9fbf920aa9c5fecc45c1327e31272badd1f0355d7b11
83d3d0d198159d0a11cfeeb54178068e5a866a297f1b58e0c5e6b10ae58a8976
852b348129a4382af1c4f09d102a030542224251eff484af23c7407d3a5d50cb
861aed070db50ce0da9928455deff784c115b44540b09450f225ff7cff0c7429
8727f95a1005ca490268a4ed2866be6171eab79569518101d2344ef6547265dc
87464dc935d6ae5d89e78c390a2c0fa004597815ff0debeeeae507e7e8ea652a
87b334ef27de51e4151e70243168b7c38966d413e785bec8de26425111423a57
87bdf34d158b451ca6e6113760d8f959d43ad17373c7ac0aa70b6789f21a26b8
89c364ea6daef261e87ace563ca0dd81f944c939e4769beca4c010f5cdc67430
8a74c30a88646490e535001de72cb793563fef52b94c748adb90f03aa219201c
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7
8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395
8ed80b53559c06597961fd765bfe4593728b435387bfaf37f379a1f4a7ca6230
8fdd77e7c517b8587115bfa3cfab2144a0d95b19fc79558864ef11ac935295af
9274ac1b5f087b953061f5a808bd0efa43c4ba859acd1342aa3bbc1abd4a872a
940d0fa4bafe6ab768d2c206c8116b9b8413724431335dbca042ea01c046561e
94e031c4513e39f8cb650ebaa160ab947e316ed254acac7662fd38086d74b8dc
98162403ac312e5006a12e036206eb457cad7908c0cbf999500a6c1af1a1592a
984cf028eefd524f1be2a6eca2c9fc3a07e6f3c197e5c9246ee7769674067fda
997b71421e0756e47b32ce8081e9d01ce020361b342900990964262815f889cf
9a0334d7207042feed4558b710fa3d8e1ede1f47053d01705672807220087c25
9b6112851e9cc4d63f1815ff104cbf1fc4bb5bed0d9bddce1638ce9698dc3187
9cb93fc023cca355260310e41056be397ecad26f94a578c5b147762b40fc6d3b
9d23ce52b7373c6ba03973340914317dcf2903ae81c656cf8efe8ebc52730fdb
9d5f5e189fe8e863fe1ec57c027dcf75e00294f104f8daa487061094639150a8
a04f3de9dc4c5f5c2c15f8d0c53ddbf00e4457cb2284b4eba082750021818ba8
a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553
a13b8edf519611379569011dc81fd20613ad68500e67f98f74ee0df28527aea6
a18661b1feb5c4e554ff381a1f7a40fd45edea2f91e4881318a178ee29e3cfa1
a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37
a8d120c453d5633d82f775f5002c0fe2112e1b7b50a38f90d770f1a9dca9ae3d
a9956b3cf88b957e5d80efac5128ebbe8d6d8919091968f2a337d8a6e73bfaf6
a9ad4f943406d3c79601f097c245a0be9b65b3518335679b6a82f942b92f9884
aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22
ab3e879537964cf684b67c01748b5cf9e6aad783f06d754d30d5f6e0b78db18f
ac0db7e1be7391b35b0b76446bd2382e587554532fabccc9013c3b628002aa38
acb54eaad168950097664ed4842acf0c77053efbf2e4ebb8719f76b560fb6282
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
ad0da7d82485e55b97a0ab919b0818d38e0d498eb0faa1da109db4ec0a9c3e9a
b11075fce6949d8d09607e25c5b98d099037913927192c20cefcf72852534055
b21b912444e379f197f6c60800bec37d8f7f05b6bed20d69a39316535b32a876
b40ed885c6eabc68309c7e3377008ec3aaba2add66e43fcf6fc2851cdc6a2f98
b4bbcfbe3d5a6d4e9316840be39545c183e8cb116fc1526cfcdec1200a481b45
b9fc07bbd23fcde3eeae813a803cfb57888b83b630505318679222e25aa83a08
bb8c4212414ce2a7887636e1c6eb1fd3ab46e4391226fd39653a2c2abbb17697
bcd70cc8ed4a9eaca7ba3e55009b16fe08c00b13b0fc05a5b661ddddcf596817
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
c02d2e4ee660f561338f717a6dc83745ea23c4ad356a57bdfee60c3643b25b1a
c0d58beb181fc65ad9ecebd70019fb63bef266e09cd6f6a906e80963cd3e5399
c43166d8a985f9b54a791e457134ae182e52bd69af7117d7b8d2d01c18b36440
c48239057a5a613eba7dd6de1890c70a56cadcb1fa15d187ff77788e757a8dd6
c4c0332f45863ad84aaa4e7305f97a58c95c3e6d8625fa7adc4d2f7d9017cd2b
c5a03868219d7a6ac1f4c3259879f0c2443406c8343eaadf6fd25aa0d23649f0
c7b2bf7a43072b220492af01bef5358c77cf701e5f72f499680368c8af934ef2
c89e1f42bed0731437a8759856f7d1c24648c7db8eb198e63e13fefe8001ba77
c98b8bea34034f401295c19aa5ff1cef6b37651837a553f968097e6b9677e0e1
cc206c514253113c307b4357e5e97a8d6e1c025d523476cf1ebe625dd8dc7bb0
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54
d17f13b6b582a3ffefd2f20b70f7a913acd78d53f35aa52ecad415f824c195b5
d29d233f76ff579d16fac45983df41c9050bf997fd0363df821bf3c359d6e999
d30610506b0b83a1f0973705ecfb1b81726971f3f6270aad605aa515b20b56e2
d49d3cff930d3a90432477f8fb875d17680761c3012ad9278d837258064a5f44
d68edf3c87c6a6d87223649e8162ef1584ea6faad6f20e80fdd5f72c21b16a17
da26f75773d686f672adddeabc4378a593a11845f01c01dbd2c941744d2ff96a
dae46245ef1fe990e750fcdd709692b086e17b1790ea3782e9bfbf8561be441c
dcff6cf62461d2312ac36c7778caa7afee4125d5f04f14e1c11b9c02098bdaf0
de317176fa6b64a8e89bbd45d20b6be2560bbfa96e7e53e63eb754e18bfe6c1f
df00a67e556aca1511338ddfdf604a8cb4f4c1921d9be88e0be6bb8b0f43a9aa
df3ba57c1234e50c05735a0dedc033f43d5e638a97d5c51583cac8411d2ea34f
e01c923f9aadba3a117154ba6c1bbedb9d105661cbe61c42b068ad070cab4437
e0e8682bdc5e22db5ddd3ba511486a598561be88b04abcc6459ef973881f765d
e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047
e17d22c941eed01ca1a6a1d67cb028e4f7030a313fb1925ee3c25bb743b400c5
e1c3c2dafe2208caea4f809f414a89a9d256deb8671e1c5d49bff9a873782796
e1fa72e38624f68bc2039aded02a054eead1fbf24646f4df60abcacc665a8690
e2c068caa1884b67b10d63098d87db9ea8e796c4e5f5452e74ecc6689124715c
e2f0066effe5a27b9c10762d3e9e7676d20fe1b233807edfe57cbfe1cf234f7e
e368951bc5918b3d9fbc8205bfdf0d8be8b79da09b457bb113307063f3b1bc89
e37071398d21f18dff2370ee0885f38811bb69bb465b398100ab3101fc521d6b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e44c56414d6d7edd75f68e972b2c7161626f82d4d3df26d8b76c237a223c090a
e452cd961f8fd3bae40b9b1fa1a68188ff465e797ec23ad4014f1e5ec5ab1c6e
e497f0ccb9e91a1500b607768344319dd1bfc6b88295e0fc44eeb9c4baf50e22
e4f422812c20d1d2f9271caea88e4d805fafad5048044d89a73dab51eb49a95d
e519cc4b7b8fdc64a7aaafc1b808cde266a234205aac0d6c55589c12446d565e
e59c0f735471d90ea02234c6d94ee8fb9033ddd50f3f6b50ecf238dba336b842
e85815908064ec7977f13468af609ac980317a21b5b519cfa107948cf76b8ce9
e861d3c3bf074c8b832c72921647e53513a1493a855cbfe43820933cbeb35dca
e87a59fa7b7a85add496296cd8e428331e61e309aa52fcdb62ce143bd680972f
e8dc228fc68ad646f19ff9bcdd50c6fdb64b14b1daa92fc90e088cb723800a97
e8fd4f43efe1b8f70b8fb3daa6dc09cb6418aca68b99d8076d0cb57445f379d2
e96308985f29bbf9d5449c17ccd051289b6bc187015e5a8bbb7aa08ffdf41568
eab78c3cc0b84cc3d48a27b73fb6620050d88bc25a2b9241dcffcb8134a429a0
ebfe24e2e6c120f0298d23124af1da2ab0553d8867c9d19a92fc2fbd371bfea6
ed487cd99bbeef30c3dc7815053457f6c8e843a28e93a5fab274fd53f8a02492
ee7c59f0430abe5db4ec2b7c692b88ae5d9b858fe7c96b1bff937c86460a55a8
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efd40ac9fcd1732321095b2628ae3000d1405f083c87652b181c1a4285be9128
f4bcd92015b1af32481c4673d14acb4f9c7871d2092c1c23b1986749a6e20f66
f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f7e55a560e407268e7035e074fc8360bee0d2b7c8a8578e9231507801a377eaa
f90a15e43e6aeef1a63d364e23c81c24868e3866212bfd743ff4338cb25c3e21
fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505
fe323e2a147d519faf5c69b42f670a9af698c7ade22b63f3a5bc0d1a391806a7
fe9da4900c1a085cf9348e3ca01284c80ecd9306354a5de7945e8cddf6a363a3
feb4fc467795a580abc9ca8be5f38bbec4cb85b1a5cd9c40743052acf912cf47
ff5e68cab2e192f6e08426122bf74b29b6630e063b6a4034bf44bd8eeeaad69a
ff65446fe9e1694af7da6b141dfeaf5fda405f4253ae411f8ac244bced493355
ffe8184c3325c3bfa6c52f7bb45022e84028d85cac562a53535cf406c13b6006

theparadise.ng Open in urlscan Pro 2606:4700:e2::ac40:8a0f Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

404 Requests

98 %HTTPS

58 %IPv6

38 Domains

66 Subdomains

56 IPs

7 Countries

7637 kBTransfer

19997 kBSize

17 Cookies

7 Outgoing links

Page URL History

Redirected requests

404 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

theparadise.ng Open in urlscan Pro
2606:4700:e2::ac40:8a0f Public Scan

Screenshot
Live screenshot

Full Image

404
Requests

98 %
HTTPS

58 %
IPv6

38
Domains

66
Subdomains

56
IPs

7
Countries

7637 kB
Transfer

19997 kB
Size

17
Cookies

404 HTTP transactions
6 data transactions