nktbxm.erufhvdjxc.tk Open in urlscan Pro
2606:4700:3030::ac43:9259 Public Scan

URL: https://bctser343grh.giize.com/stiri-auto
Title: Știri

URL: https://bctser343grh.giize.com/eco
Title: Mașini electrice

URL: https://bctser343grh.giize.com/test-drive
Title: Test drive

URL: https://bctser343grh.giize.com/utile
Title: Utile

URL: https://bctser343grh.giize.com/teste-video
Title: Video

URL: https://bctser343grh.giize.com/podcast-cu-prioritate
Title: Podcast cu Prioritate

URL: https://bctser343grh.giize.com/cat-costa
Title: Cât costă?

URL: https://www.facebook.com/ProMotorRomania

URL: https://www.instagram.com/promotor_ro

URL: https://www.youtube.com/channel/UC0qd3p9BkE0JuV34c6hTjCA

URL: https://www.tiktok.com/@promotorro

URL: https://open.spotify.com/show/1Cy2WFngsvj2Wny596HamY

URL: https://bctser343grh.giize.com/stiri-auto/preturi-oficiale-pentru-dacia-duster-2024-start-de-la-18-800-de-euro-19242261

URL: https://bctser343grh.giize.com/stiri-auto/opulenta-pe-4-roti-fibra-de-carbon-si-aur-de-24-de-karate-pentru-koenigsegg-jesko-galerie-foto-19242002

URL: https://bctser343grh.giize.com/stiri-auto/2024-a-inceput-batalia-pentru-un-loc-de-parcare-cat-stau-unii-soferi-la-coada-pentru-a-depune-documentele-19242038

URL: https://bctser343grh.giize.com/stiri-auto/suv-ul-electric-de-la-huawei-a-fost-lansat-in-china-pasagerii-vor-avea-la-dispozitie-inclusiv-proiectoare-de-cinema-galerie-foto-19241604

URL: https://bctser343grh.giize.com/stiri-auto/un-sofer-nu-respecta-semnul-stop-si-este-taxat-in-scurt-timp-video-19242478

URL: https://bctser343grh.giize.com/stiri-auto/volkswagen-a-testat-bateria-care-nu-imbatraneste-cat-de-bine-rezista-dupa-aproape-500-000-km-19242477

URL: https://bctser343grh.giize.com/stiri-auto/hyundai-si-kia-au-planuri-mari-pentru-2024-coreenii-vor-sa-vanda-aproape-8-milioane-de-masini-19242370

URL: https://bctser343grh.giize.com/stiri-auto/care-sunt-cele-mai-avariate-masini-din-romania-19242288

URL: https://www.prosport.ro/poze/show-interzis-cardiacilor-cu-diana-munteanu-in-maldive-s-a-filmat-intr-un-costum-de-baie-minuscul-la-dus-iar-imaginile-cu-fosta-nevasta-a-lui-claudiu-niculescu-sunt-incendiare-19801393?pic=19801411&utm_source=Promotor&utm_medium=website&utm_campaign=fidmee

URL: https://www.gandul.ro/diverse/cele-5-zodii-care-se-vor-imbogati-garantat-in-2024-favoritii-astrelor-vor-avea-parte-de-numeroase-oportunitati-in-afaceri-20123941?utm_source=Promotor&utm_medium=website&utm_campaign=fidmee

URL: https://www.cancan.ro/unde-locuieste-de-fapt-ctp-intransigentul-gazetar-roman-jurnalistul-nu-si-a-cumparat-o-casa-de-fite-20939241?utm_source=Promotor+HP&utm_medium=website&utm_campaign=fidmee

URL: https://ciao.ro/poze/top-ciao-ro-wow-sau-bau-cat-de-mult-le-a-schimbat-operatiile-estetice-pe-vedetele-din-romania/?pic=734322&utm_source=ProMotor&utm_medium=website&utm_campaign=fidmee

URL: https://bctser343grh.giize.com/stiri-auto/turcii-si-au-facut-de-cap-cu-dacia-duster-cat-costa-modificarile-aduse-suv-ului-romanesc-video-19241932

URL: https://bctser343grh.giize.com/stiri-auto/poti-fi-amendat-daca-circuli-cu-mai-mult-de-2-martori-de-bord-aprinsi-ce-verifica-politia-cand-te-opreste-19242144

URL: https://bctser343grh.giize.com/stiri-auto/noul-audi-q8-e-tron-edition-dakar-mai-capabil-in-teren-dar-cu-un-pret-pe-masura-19242105

URL: https://bctser343grh.giize.com/stiri-auto/legea-care-permite-soferilor-cu-permis-cat-b-sa-conduca-si-motociclete-de-125-cmc-atacata-la-ccr-19242141

URL: https://www.descopera.ro/galerii/20529428-nasa-vrea-sa-atinga-soarele-in-anul-2024-este-echivalentul-aselenizarii-din-1969?pic=1&utm_source=Promotor+HP&utm_medium=website&utm_campaign=fidmee

URL: https://www.go4it.ro/content/dedeman-vinde-unul-dintre-cele-mai-ieftine-televizoare-cu-diagonala-de-80cm-19228000/?utm_source=promotor+hp&utm_medium=website&utm_campaign=fidmee

URL: https://bctser343grh.giize.com/stiri-auto/2024-acte-necesare-pentru-schimbarea-permisului-expirat-cat-e-taxa-de-preschimbare-a-carnetului-auto-19241747

URL: https://bctser343grh.giize.com/stiri-auto/michael-schumacher-a-implinit-azi-55-de-ani-19242101

URL: https://bctser343grh.giize.com/stiri-auto/inmatricularile-de-autoturisme-in-romania-total-2023-top-10-19241898

URL: https://bctser343grh.giize.com/stiri-auto/sofer-din-suceava-incatusat-si-amendat-pentru-ca-nu-a-vrut-sa-piarda-randul-la-mcdonalds-19241886

URL: https://bctser343grh.giize.com/comunicat-de-presa/adin-cojocaru-presedintele-fr-de-volei-este-invitatul-emisiunii-drumul-spre-paris-de-joi-4-ianuarie-de-la-ora-1900-19242257

URL: https://bctser343grh.giize.com/stiri-auto/test-drive-cu-bmw-seria-5-un-nou-inceput-19227167

URL: https://bctser343grh.giize.com/stiri-auto/test-drive-peugeot-508-facelift-o-specie-pe-cale-de-disparitie-19220699

URL: https://bctser343grh.giize.com/stiri-auto/o-legenda-americana-pe-meleaguri-romanesti-am-testat-noua-generatie-ford-bronco-in-romania-video-19219527

URL: https://bctser343grh.giize.com/stiri-auto/noul-smart-1-design-inedit-si-peste-400-km-de-autonomie-electrica-video-19240823

URL: https://www.prosport.ro/poze/fiica-anamariei-prodan-a-ridicat-temperatura-la-plaja-in-dubai-aparitia-in-costum-de-baie-cu-care-sarah-a-intors-toate-privirile-galerie-foto-19801298?pic=19801299&utm_source=Promotor+%5B2%5D&utm_medium=website&utm_campaign=fidmee

URL: https://www.prosport.ro/poze/madalina-ghenea-imagini-absolut-incendiare-reactiile-nu-au-intarziat-sa-apara-si-sunt-pe-masura-devastatoare-cea-mai-frumoasa-femeie-din-lume-galerie-foto-19800337?pic=19797459&utm_source=Promotor+%5B3%5D&utm_medium=website&utm_campaign=fidmee

URL: https://bctser343grh.giize.com/stiri-auto/cehii-anunta-facelift-ul-pentru-skoda-octavia-cand-va-fi-lansata-actualizarea-video-19241861

URL: https://bctser343grh.giize.com/stiri-auto/omv-petrom-cumpara-in-totalitate-renovatio-cea-mai-mare-retea-de-incarcare-a-masinilor-electrice-din-romania-19241756

URL: https://bctser343grh.giize.com/stiri-auto/2024-ce-acte-esti-obligat-sa-prezinti-cand-te-opreste-politia-si-pasagerii-sunt-vizati-19241605

URL: https://bctser343grh.giize.com/stiri-auto/porsche-doboara-recordul-pe-nurburgring-stabilit-de-tesla-model-s-ni-se-promite-cel-mai-puternic-taycan-de-pana-acum-19241538

URL: https://bctser343grh.giize.com/stiri-auto/cum-arata-un-lamborghini-urus-fara-optiuni-configuratia-pe-care-nimeni-nu-o-vrea-video-19240996

URL: https://bctser343grh.giize.com/stiri-auto/2024-care-este-limita-de-viteza-in-localitate-amenda-pentru-cei-care-circula-cu-41-km-h-19241474

URL: https://bctser343grh.giize.com/stiri-auto/xiaomi-a-dezvaluit-prima-sa-masina-electrica-chinezii-vor-sa-rivalizeze-cu-tesla-si-porsche-19240746

URL: https://bctser343grh.giize.com/masini-noi/eco/honda-e-va-fi-scoasa-de-la-vanzare-care-ar-putea-fi-motivul-19240463

URL: https://bctser343grh.giize.com/stiri-auto/volvo-a-construit-primul-sau-sedan-electric-es90-urmeaza-sa-fie-lansat-pe-piata-19240084

URL: https://bctser343grh.giize.com/stiri-auto/guvernul-a-schimbat-legea-cine-va-mai-avea-dreptul-din-2024-sa-circule-cu-trotinete-si-biciclete-electrice-19240813

URL: https://bctser343grh.giize.com/stiri-auto/cele-mai-bune-masini-2024-suv-vedeta-19240651

URL: https://bctser343grh.giize.com/stiri-auto/codul-rutier-2024-cat-timp-ai-dreptul-sa-conduci-cu-itp-expirat-care-sunt-noile-sanctiuni-19240360

URL: https://bctser343grh.giize.com/stiri-auto/care-este-limita-de-varsta-pentru-permisul-de-conducere-in-2024-test-devine-obligatoriu-pentru-toti-soferii-19241396

URL: https://bctser343grh.giize.com/stiri-auto/ce-masini-clasice-au-trecut-pe-la-rar-in-2023-modele-speciale-fotografiate-de-inspectorii-rar-galerie-foto-19241227

URL: https://bctser343grh.giize.com/stiri-auto/cu-cat-se-vinde-masina-lui-silvio-berlusconi-a-fost-cumparata-dupa-un-pariu-pierdut-cu-vladimir-putin-19241150

URL: https://bctser343grh.giize.com/termeni-si-conditii
Title: Termeni si conditii

URL: https://bctser343grh.giize.com/politica-de-confidentialitate
Title: Politica de confidentialitate

URL: https://bctser343grh.giize.com/echipa-editoriala
Title: Echipa editorială

URL: https://bctser343grh.giize.com/contact
Title: Contact

URL: https://www.promotor.ro/stiri-auto/noul-smart-1-design-inedit-si-peste-400-km-de-autonomie-electrica-video-19240823
Title: Noul Smart #1 - Design inedit și peste 400 km de autonomie electrică - VIDEO

URL: https://www.promotor.ro/stiri-auto/porsche-718-boxter-esenta-condusului-video-19238981
Title: Porsche 718 Boxter: Esența condusului - VIDEO

URL: https://www.promotor.ro/teste-video/sedan-sau-coupe-noul-hyundai-elantra-schimba-regulile-jocului-in-lumea-masinilor-compacte-19237660
Title: Sedan sau coupe? Noul Hyundai Elantra schimbă regulile jocului în lumea mașinilor compacte

URL: https://www.promotor.ro/stiri-auto/noul-nissan-juke-iesit-din-tipare-video-19236806
Title: Noul Nissan Juke: Ieșit din tipare - VIDEO

URL: https://www.promotor.ro/stiri-auto/noul-peugeot-2008-facelift-un-suv-elegant-pregatit-pentru-jungla-urbana-video-19234978
Title: Noul Peugeot 2008 facelift: Un SUV elegant, pregătit pentru jungla urbană - VIDEO

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 111

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 114

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 118

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 123

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 132

https://us-u.openx.net/w/1.0/pd?plm=6&ph=d59e8a19-e066-4bc5-b769-dabf5d619da8&gdpr=0 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDUxtGWeKrtMDgr3lQ_DgYA&google_cver=1

Request Chain 133

https://securepubads.g.doubleclick.net/pagead/adview?ai=ChjQu0fiWZerxKd2lzLUP9ciz4ArW0omRdejKjcLMEtzZHhABINnWrTtgye6Oi8CkjBCgAe3C2bUCyAEJ4AIAqAMByAMCqgSYAk_Q6eb_3kePxDG3TPZ13XlbkxghcxWYOxNvJwn_aYJWI7Gk75Y7Rynhi-CN1AhgIj4I7i0FNHXMJKzJKdDgPZEylCm2LbpL9-NkROre6dk3lmSweAW9Cx8pni3zXC-a-LwOGj0jYsM92AZznInN0AFyrr9EJ0xbJn-XMKwwJtmlpcLYd0Wt0K0T-GugjSe1_24bt6bNtYktIwkKGRIQbxAyX8mSjOWLdQmfDUWVXbKn3Cin3o_gTmOhiaC7x-55ykBK46UF_uyKT2jmz4vl99zRzdPuUokLlAW_AVYHK9k99p-topS_jPkKzs_U1wMPPXZd-mh7o6SwXTzLrfIgE0TDy_kykawbqkML3dBvozk-GrXNG5vwGGjABIvZ0srDBOAEAYgF1bvwu02SBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGXYAH-7ymygGoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAfIHBBDkyAbSCCEIgOGAYBABGB0yAssCOgSAQIBASL39wTpYs_2zsa7EgwOaCcoBaHR0cHM6Ly9tdXNjbGUtYm9vc3Rlci5pbz9icmFuY2gtbmFtZT1nb29nbGUmdGVzdC1uYW1lPWdvNHRpayZ1dG1fc291cmNlPWdvb2dsZSZ1dG1fbWVkaXVtPWNwYyZjYW1wYWlnbl9pZD0yMDc5NTEwNDcyNSZhZGdyb3VwX2lkPTE1NTU4MDY3MzE2MyZhZF9pZD02ODU4NDk4MDIxMzkmdXRtX3Rlcm09JnBsYWNlbWVudD1ua3RieG0uZXJ1Zmh2ZGp4Yy50a4AKA8gLAaIMECoOCgzktLEC7rWxArW4sQLaDBEKCxDA0Nebw--oj8cBEgIBA-INEwigvrSxrsSDAxXdErMAHXXkDKzYEwzQFQGYFgGAFwGyFx4KHAgAEhRwdWItODgyOTU0OTc2OTY4MTc3ORjxkiA&sigh=lwcstGvUIg8&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTwAvHhf_03XVYoYsak87JzCU8oDVAPBqvoCkBGGvhfce9nAOcgH5EFjWLb5BjvtLM3ui09PAfsd-sHvWsrk_dlPFsmse9eL1IK1hGXe77xoYAQ&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xc79023c585a0fdb50000000000000000%22,%222%22:%220x9315d12267a02030000000000000000%22,%223%22:%220x2312f51fe6dd93670000000000000000%22,%224%22:%220x3324e0a9a7c0a0390000000000000000%22,%225%22:%220xffdec4b2be5b32c90000000000000000%22},%22debug_key%22:%22305089656930691067%22,%22debug_reporting%22:true,%22destination%22:%22https://muscle-booster.io%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22649486701%22],%2222%22:[%22true%22],%224%22:[%2201-04%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2216597111550560931857%22}&andc=true

Request Chain 138

https://gum.criteo.com/sid/json?origin=publishertag&domain=erufhvdjxc.tk&sn=ChromeSyncframe&so=0&topUrl=nktbxm.erufhvdjxc.tk&cw=1&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
https://mug.criteo.com/sid?cpp=pIupdHxOYkhFNFA4WmdpQW1YS0tJeExwWEZJWE9aVFoyOUNWSHhmRTBpSndCTFdhSXQxVU5GTklpUE9wcUFCOEdvYzJoNzRUNmZWYVluSTBQck5uSmVMRzBzcjJLOFJFOTJYUE9PcTFCenZqNzlxQnJNaUVaSDRaKzVmbmh0N1RXWDIxdmErMmFkRlhXMmdaYXZhODZISCttN01iSklxNmxCdStrM2x3ZlI3TTRYSlhkSlVPNDVRcFhzY2h0RDN6MmMzcm9KeEU2UFFQbnF4eE5YWmVUZGNTUTJFaksrUHFJU3hneWROK1B1TmNIbkd4eThGRUJVbmZOZWN0bEFUcnhFQWZmUElCbm54Si9sdG93UkVlOFZ4MExXY0xmaURKVHpCUnJOOTdXRnBYckdnTT18&cppv=2

Request Chain 139

https://securepubads.g.doubleclick.net/pagead/adview?ai=CYMFL0fiWZenxKd2lzLUP9ciz4ArW0omRdfiaw5TpEdzZHhABINnWrTtgye6Oi8CkjBCgAe3C2bUCyAEJ4AIAqAMByAMCqgSVAk_QpkPdIMknIs5wj7IdMBVDG8HCFfnLWyWdkelDe17j5N8Nnt9OR7zNH0WxtxZl0f2IX0SKF9g0MvQHUAuheK0lHkCLArXoKLDb0BQzYH1TFFBL8smsef99z6KvQlbB-jExYWOe3X_1ATXGzmmmlNP3edoFCqjTasXVKWxy3BmoqMzc8ltTRrTrrte7g1AB83-Ka_7OgDSMph9nHRbxOJEDTCa-MuCYrf91x5TdC7Qh_LVglW6CtmOIAHFRVJ9ayJmS4ILoL5tIDFF3CP5w9nierUIF5JziRFCFQxQJ5H67RSJT1VHURhRh_UXKUq_eesdeMm_GfRfJ--uaBF838rpPoWZAsnpCsJYR1VPXZSFpD3UY9e_ABIvZ0srDBOAEAYgF1bvwu02SBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGXYAH-7ymygGoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAfIHBBDYlQfSCCEIgOGAYBABGB0yAssCOgSAQIBASL39wTpYs_2zsa7EgwOaCcoBaHR0cHM6Ly9tdXNjbGUtYm9vc3Rlci5pbz9icmFuY2gtbmFtZT1nb29nbGUmdGVzdC1uYW1lPWdvNHRpayZ1dG1fc291cmNlPWdvb2dsZSZ1dG1fbWVkaXVtPWNwYyZjYW1wYWlnbl9pZD0yMDc5NTEwNDcyNSZhZGdyb3VwX2lkPTE1NTU4MDY3MzE2MyZhZF9pZD02ODIwODgzODAyODUmdXRtX3Rlcm09JnBsYWNlbWVudD1ua3RieG0uZXJ1Zmh2ZGp4Yy50a4AKA8gLAaIMECoOCgzktLEC7rWxArW4sQLaDBEKCxCA_5eMvJymwosBEgIBA-INEwifvrSxrsSDAxXdErMAHXXkDKzYEwyIFAHQFQGYFgGAFwGyFx4KHAgAEhRwdWItODgyOTU0OTc2OTY4MTc3ORjxkiA&sigh=MrWjfjMs-I4&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTwAvHhf_03XVYoYsak87JzCU8oDVAPBqvoCkBGGvhfce9nAOcgH5EFjWLb5BjvtLM3ui09PAfsd-sHvWsrk_dlPFsmse9eL1IK1hGXe77xoYAQ&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xc79023c585a0fdb50000000000000000%22,%222%22:%220x9315d12267a02030000000000000000%22,%223%22:%220x2312f51fe6dd93670000000000000000%22,%224%22:%220x3324e0a9a7c0a0390000000000000000%22,%225%22:%220xffdec4b2be5b32c90000000000000000%22},%22debug_key%22:%224050891642713061786%22,%22debug_reporting%22:true,%22destination%22:%22https://muscle-booster.io%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22649486701%22],%2222%22:[%22true%22],%224%22:[%2201-04%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2216619391764554755425%22}&andc=true

Request Chain 142

https://securepubads.g.doubleclick.net/pagead/adview?ai=C5l6e0fiWZezxKd2lzLUP9ciz4ArW0omRdfiaw5TpEdzZHhABINnWrTtgye6Oi8CkjBCgAe3C2bUCyAEJ4AIAqAMByAMCqgSVAk_Qt4asT_dxTEmf6GzmIHTpyrone6_kDTb8bXUiGwA3jyWd3841PAXz_fa-ms4sXyFvUDwvi68Pr_txe3POmfNPYeCPwO5_KQeX6Rue8A3KJMNoA96dSFUgWxrvAj6GEPvneyAHl9EGa-0maNzn_m5XGOT3CKoc_P-B2eBRmGKxgGYTDQrhsKZLDBooq8Mylj_dxoIddgehWo8aoaz0AQ6BLMW9XK20h9vsgMK4-j9iZWERKrEAPKboVWdd3--avmHwhYuh4u_Y3sUE0DgSNEhwOqlBOlPMedCj31nV2_F-oQZLc8RQlSrnXek1agnKx3-zkTpPywOy5kfZrOcWi6QhxCUqa9ugkdC91xBPDF3DQ6xwCMDABIvZ0srDBOAEAYgF1bvwu02SBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGXYAH-7ymygGoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAfIHBBCs0QfSCCEIgOGAYBABGB0yAssCOgSAQIBASL39wTpYs_2zsa7EgwOaCcoBaHR0cHM6Ly9tdXNjbGUtYm9vc3Rlci5pbz9icmFuY2gtbmFtZT1nb29nbGUmdGVzdC1uYW1lPWdvNHRpayZ1dG1fc291cmNlPWdvb2dsZSZ1dG1fbWVkaXVtPWNwYyZjYW1wYWlnbl9pZD0yMDc5NTEwNDcyNSZhZGdyb3VwX2lkPTE1NTU4MDY3MzE2MyZhZF9pZD02ODIwODgzODAyODUmdXRtX3Rlcm09JnBsYWNlbWVudD1ua3RieG0uZXJ1Zmh2ZGp4Yy50a4AKA8gLAaIMECoOCgzktLEC7rWxArW4sQLaDBEKCxCQ35qwuLaG49IBEgIBA-INEwiivrSxrsSDAxXdErMAHXXkDKzYEwyIFAHQFQGYFgGAFwGyFx4KHAgAEhRwdWItODgyOTU0OTc2OTY4MTc3ORjxkiA&sigh=qz2c5t0n0hg&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTwAvHhf_03XVYoYsak87JzCU8oDVAPBqvoCkBGGvhfce9nAOcgH5EFjWLb5BjvtLM3ui09PAfsd-sHvWsrk_dlPFsmse9eL1IK1hGXe77xoYAQ&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xc79023c585a0fdb50000000000000000%22,%222%22:%220x9315d12267a02030000000000000000%22,%223%22:%220x2312f51fe6dd93670000000000000000%22,%224%22:%220x3324e0a9a7c0a0390000000000000000%22,%225%22:%220xffdec4b2be5b32c90000000000000000%22},%22debug_key%22:%2210289492195848903407%22,%22debug_reporting%22:true,%22destination%22:%22https://muscle-booster.io%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22649486701%22],%2222%22:[%22true%22],%224%22:[%2201-04%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2218176101466545602129%22}&andc=true

Request Chain 143

https://securepubads.g.doubleclick.net/pagead/adview?ai=C2iWK0fiWZevxKd2lzLUP9ciz4ArW0omRdfiaw5TpEdzZHhABINnWrTtgye6Oi8CkjBCgAe3C2bUCyAEJ4AIAqAMByAMCqgSYAk_QqQYg6uKpbNZkF_QKMs8CF85esnjR-NidpVWuye1-R_muwtDT8JLZ8-YJjhKwS3XHAyKjq3ONEOuzekqihxeK4NwNp3DrHWo2d5b-ve6EEfuKXJVl5nKJwCvQSDA1OCx9JoTbu21yxWsmhh5yxCwDBqx5zIqrxzlc4g5dK04KEFS5BeEfX35Liq7IcGyWemXlWeq0z2bb5N5DIbkh_kAv6X93-3OwfcmilbWVaTdaxrapBpyvYo_mFnCORw6l_rAW4V6TKENyttos1uMMANTyYUGzoCaVesn1ZckQeSA19eQCKcUMAyckRGFwXbqW0dEiiQ6lO9leSUkVmNooTKdFTbo4pQ5JB1yIbw_pEbMlPv1F4Ogjb47ABIvZ0srDBOAEAYgF1bvwu02SBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGXYAH-7ymygGoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAfIHBBDzvgXSCCEIgOGAYBABGB0yAssCOgSAQIBASL39wTpYs_2zsa7EgwOaCcoBaHR0cHM6Ly9tdXNjbGUtYm9vc3Rlci5pbz9icmFuY2gtbmFtZT1nb29nbGUmdGVzdC1uYW1lPWdvNHRpayZ1dG1fc291cmNlPWdvb2dsZSZ1dG1fbWVkaXVtPWNwYyZjYW1wYWlnbl9pZD0yMDc5NTEwNDcyNSZhZGdyb3VwX2lkPTE1NTU4MDY3MzE2MyZhZF9pZD02ODIwODgzODAyODUmdXRtX3Rlcm09JnBsYWNlbWVudD1ua3RieG0uZXJ1Zmh2ZGp4Yy50a4AKA8gLAaIMECoOCgzktLEC7rWxArW4sQLaDBEKCxCg37O27eiKlfoBEgIBA-INEwihvrSxrsSDAxXdErMAHXXkDKzYEwyIFAHQFQGYFgGAFwGyFx4KHAgAEhRwdWItODgyOTU0OTc2OTY4MTc3ORjxkiA&sigh=5Lj-rME3Za0&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTwAvHhf_03XVYoYsak87JzCU8oDVAPBqvoCkBGGvhfce9nAOcgH5EFjWLb5BjvtLM3ui09PAfsd-sHvWsrk_dlPFsmse9eL1IK1hGXe77xoYAQ&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xc79023c585a0fdb50000000000000000%22,%222%22:%220x9315d12267a02030000000000000000%22,%223%22:%220x2312f51fe6dd93670000000000000000%22,%224%22:%220x3324e0a9a7c0a0390000000000000000%22,%225%22:%220xffdec4b2be5b32c90000000000000000%22},%22debug_key%22:%225471005407814811956%22,%22debug_reporting%22:true,%22destination%22:%22https://muscle-booster.io%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22649486701%22],%2222%22:[%22true%22],%224%22:[%2201-04%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%226901389392985416289%22}&andc=true

169 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
nktbxm.erufhvdjxc.tk/ 215 KB
31 KB 927ms
762ms Document
text/html 2606:4700:3030::ac43:9259
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nktbxm.erufhvdjxc.tk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::ac43:9259 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ee3200845ab523773cfd52e75d4f997ac2c6a24237997217dcd03d5696084a19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, OPTIONS, POST, PURGE
access-control-allow-origin: *
age: 145
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-edge-cache: cache,platform=wordpress
cf-ray: 84058aa6bb2b4bc9-BUF
content-encoding: br
content-type: text/html; charset=UTF-8
date: Thu, 04 Jan 2024 18:28:30 GMT
link: <https://www.promotor.ro/wp-json/>; rel="https://api.w.org/"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BQIZTwKjb6%2Bca8P9IRP9aGVxxCkzCkKTRNsuQheCQeTJBb4uq%2B6s8Wr1e1z1PEv2l2ZbB8Rq09cz4MVbRrruLsUUDEiruQe2cTet3VaKAOerrIkhlSOaFq8nnGqqxPy9qWs%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload;
vary: Accept-Encoding
x-cacheable: yf
x-served-by: web08

GET
H2 200 styles.css
bctser343grh.giize.com/wp-content/themes/promotor-nineteen/assets/build/ 116 KB
117 KB 843ms
392ms Stylesheet
text/css 195.181.241.253
INTERNETO-VIZIJA

General

Check archive.org

Show headers Download Go to

Full URL

https://bctser343grh.giize.com/wp-content/themes/promotor-nineteen/assets/build/styles.css?ver=1702658489

Requested by

Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

195.181.241.253 , Lithuania, ASN212531 (INTERNETO-VIZIJA, LT),

Reverse DNS

Software

nginx/1.25.3 /

Resource Hash

7011f8e3d4ec5761f4adbdea01b5849cc14da8ad3f1235a72a0f2121e7801ed8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:28:31 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload;
cf-cache-status: HIT
x-cacheable: yf
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1284165
cf-polished: origSize=119327
alt-svc: h3=":443"; ma=86400
content-length: 119099
cf-bgj: minify
server: nginx/1.25.3
last-modified: Fri, 15 Dec 2023 16:41:35 GMT
etag: W/"657c81bf-1d21f"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, POST, PURGE
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ywy26ULpWhJQCtx8Azs3apBWzZcj5hrewVPPGJ2FQaZZT1NeDSbWGvVpPWGxRVdZSyhqFVXj4W8M0BjCs1Aa%2BeopFO97PwdBS1R6MjiO2KUh8v1jvkK5xzsIoX9ZX9k8oakV23mbhxuK9pyUK4o%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 84058aaf0d97c012-WAW
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
expires: Thu, 19 Dec 2024 18:36:34 GMT

GET
H2 200 polls-css.css
bctser343grh.giize.com/wp-content/plugins/wp-polls/ 2 KB
2 KB 1171ms
755ms Stylesheet
text/css 195.181.241.253
INTERNETO-VIZIJA

General

Check archive.org

Show headers Download Go to

Full URL

https://bctser343grh.giize.com/wp-content/plugins/wp-polls/polls-css.css?ver=2.77.2

Requested by

Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

195.181.241.253 , Lithuania, ASN212531 (INTERNETO-VIZIJA, LT),

Reverse DNS

Software

nginx/1.25.3 /

Resource Hash

31b11a2e634abd7166080ec689881f1152413a31284ab5fdff37ffd2cfac3212

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:28:31 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload;
cf-cache-status: HIT
x-cacheable: yf
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 59710
cf-polished: origSize=2708
alt-svc: h3=":443"; ma=86400
content-length: 1578
cf-bgj: minify
server: nginx/1.25.3
last-modified: Mon, 28 Aug 2023 06:18:38 GMT
etag: W/"64ec3c3e-a94"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, POST, PURGE
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tPi4mbq%2FqkOYcpFqDteDJN2HXouiPmiESBl61FxJgKB3yoCQSHnoKV5Qeu2BDPSgz%2BQmFX8VvsYhgDX8nlH3Z7dwRRPEHK%2FLvt1JMb9jdXQhGvGBUsYzzPmId2La8kYydOY%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 84058ab21e874059-SIN
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
expires: Thu, 02 Jan 2025 12:53:22 GMT

GET
H2 200 style.css
bctser343grh.giize.com/wp-content/plugins/strawberry-video-pop/assets/css/ 7 KB
8 KB 607ms
191ms Stylesheet
text/css 195.181.241.253
INTERNETO-VIZIJA

General

Check archive.org

Show headers Download Go to

Full URL

https://bctser343grh.giize.com/wp-content/plugins/strawberry-video-pop/assets/css/style.css?ver=1651817729

Requested by

Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

195.181.241.253 , Lithuania, ASN212531 (INTERNETO-VIZIJA, LT),

Reverse DNS

Software

nginx/1.25.3 /

Resource Hash

ac9020e4963dcda138f34b3512b528df3dc333ac3df66850e6ce9583abeb62e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:28:31 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload;
cf-cache-status: HIT
x-cacheable: yf
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3143398
cf-polished: origSize=9499
alt-svc: h3=":443"; ma=86400
content-length: 7241
cf-bgj: minify
server: nginx/1.25.3
last-modified: Wed, 01 Feb 2023 10:57:46 GMT
etag: W/"63da45aa-251b"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, POST, PURGE
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VRjVBjycNlPeJ4%2B8jOej8bJw4aPffUAfUOKeeZ9X3VmcmH5DdjglZ5TDW3Q%2F7l7OSFbjaY6GwJpQyy6FhCXsNqITNhlAnNzAJKcpW8QwSDtRAqtIwxwiVy1Lt2tHlXRftPelbGQjHvDH%2Fr%2F6HQQ%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 84058aaf0f20bf83-WAW
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
expires: Thu, 28 Nov 2024 01:49:56 GMT

GET
H2 200 prebid7.11.0.js Show response
bctser343grh.giize.com/wp-content/plugins/strawberry-ads-manager/js/ 235 KB
237 KB 208ms
205ms Script
application/javascript 195.181.241.253
INTERNETO-VIZIJA

General

Check archive.org

Show headers Download Go to

Full URL

https://bctser343grh.giize.com/wp-content/plugins/strawberry-ads-manager/js/prebid7.11.0.js

Requested by

Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

195.181.241.253 , Lithuania, ASN212531 (INTERNETO-VIZIJA, LT),

Reverse DNS

Software

nginx/1.25.3 /

Resource Hash

3f5f317d4342b3d9c0f03d15566ef0c27805e6ad7de8498e59995acd7eae6534

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:28:32 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload;
cf-cache-status: HIT
x-cacheable: yf
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4937800
cf-polished: origSize=241476
alt-svc: h3=":443"; ma=86400
content-length: 241120
cf-bgj: minify
server: nginx/1.25.3
last-modified: Thu, 17 Nov 2022 09:35:09 GMT
etag: W/"6376004d-3af44"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, POST, PURGE
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FmoGPsJQncZQKINYWvpwmeXc50n5kYWMi%2B5B%2Fo22jkEX9utmLji2QICK0HrnB%2FDbzJP3sviOKH4tbDeCGmPZRC9QFNLnMMUtWDL0JZkJlZP%2Bhcu9UTinBDt%2FiyZditUHmu8%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 84058ab3ef3634bc-WAW
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
expires: Wed, 06 Nov 2024 16:10:06 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 89 KB
29 KB 416ms
61ms Script
text/javascript 2607:f8b0:4004:c17::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::9c Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9eb0f9008ca1685420efae4b5d902a350e0c24da6a43c734a11303f3aec0e1d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:28:32 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29048
x-xss-protection: 0
server: cafe
etag: 680 / 19726 / m202312070101 / config-hash: 10560948806722870232
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Thu, 04 Jan 2024 18:28:32 GMT

GET
H/1.1 200
OK sati_init.js Show response
code3.adtlgc.com/js/ 56 KB
13 KB 411ms
57ms Script
application/javascript 23.36.91.225
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://code3.adtlgc.com/js/sati_init.js
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.91.225 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-91-225.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: b7774c353a621c534c2bc605e64a4f03f7923256b97558cc677ee5a7f732026f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date: Thu, 04 Jan 2024 18:28:32 GMT
Content-Encoding: gzip
Last-Modified: Sun, 12 Nov 2023 20:47:45 GMT
Server: AmazonS3
X-Amz-Cf-Pop: JFK50-P3
ETag: W/"3acfdaa3262f5753a87db2ee1ff9c2f0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=27601
Connection: keep-alive
X-Amz-Cf-Id: wbs14OXVAj1NZK5lb9QyntK1tkRgKD3JD3lrgMnVFxZr6sFovYQhUA==
Content-Length: 12356
Expires: Fri, 05 Jan 2024 02:08:33 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 134 KB
51 KB 371ms
53ms Script
application/javascript 2607:f8b0:4004:c17::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-1684917-1

Requested by

Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

20b785b5dfe6eaf40b16e84afdc37f27d6f5300af87e25673cf8b0ca2b65c715

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:28:32 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 52226
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 04 Jan 2024 18:28:32 GMT

GET
H2 200 promotor-logo.svg
bctser343grh.giize.com/wp-content/themes/promotor-nineteen/assets/images/ 3 KB
4 KB 202ms
201ms Image
image/svg+xml 195.181.241.253
INTERNETO-VIZIJA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bctser343grh.giize.com/wp-content/themes/promotor-nineteen/assets/images/promotor-logo.svg

Requested by

Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

195.181.241.253 , Lithuania, ASN212531 (INTERNETO-VIZIJA, LT),

Reverse DNS

Software

nginx/1.25.3 /

Resource Hash

0c2eb05d46d97e8b48b70dc02f0b9c222de695214bc7f761a4d83635e9f5ee1a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:28:32 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload;
cf-cache-status: HIT
x-cacheable: yf
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2325654
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 23 Jul 2019 20:07:14 GMT
server: nginx/1.25.3
etag: W/"5d3768f2-b56"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, POST, PURGE
content-type: image/svg+xml
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HuXOUjTvE9bmbonp%2B5xdp%2FxG3%2BlR%2FpC9Zx6XSfGB5LsDrRbeHZ2t%2BIEE%2FV%2BqPVHZDybwrzxIKVhumSd1gMk2Q2P%2FftsHMw7XDYA3%2BTz3ZdsAjSr2FJE3RmVHBSmf7K5HqmrKXtkpqqSEcyVHifg%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=31536000
cf-ray: 84058ab3eb6634c1-WAW
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
expires: Sat, 07 Dec 2024 12:49:36 GMT

GET
H2 503 https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2024%2F01%2Fpreturi-oficiale-pentru-dacia-duster-2024-start-de-la-18-800-de-euro-13-1024x683.jpg
media.promotor.ro/FCGRk7QExstb5tmL8yeYKNW7qrM=/790x555/smart/filters:contrast(5):format(webp):quality(80)/ 0
0 1151ms
613ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/FCGRk7QExstb5tmL8yeYKNW7qrM=/790x555/smart/filters:contrast(5):format(webp):quality(80)/https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2024%2F01%2Fpreturi-oficiale-pentru-dacia-duster-2024-start-de-la-18-800-de-euro-13-1024x683.jpg
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2 200 jquery.js Show response
bctser343grh.giize.com/wp-content/themes/promotor-nineteen/assets/scripts/ 95 KB
96 KB 324ms
192ms Script
application/javascript 195.181.241.253
INTERNETO-VIZIJA

General

Check archive.org

Show headers Download Go to

Full URL

https://bctser343grh.giize.com/wp-content/themes/promotor-nineteen/assets/scripts/jquery.js?ver=1702658489

Requested by

Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

195.181.241.253 , Lithuania, ASN212531 (INTERNETO-VIZIJA, LT),

Reverse DNS

Software

nginx/1.25.3 /

Resource Hash

c7d4c43f68c47e19be7184c316c903223b984fc57c4634fada219f486663cefb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:28:31 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload;
cf-cache-status: HIT
x-cacheable: yf
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1730124
cf-polished: origSize=97174
alt-svc: h3=":443"; ma=86400
content-length: 97156
cf-bgj: minify
server: nginx/1.25.3
last-modified: Fri, 21 Oct 2022 07:06:31 GMT
etag: W/"635244f7-17b96"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, POST, PURGE
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W4x5c27tqThte9kymooCaZD0z4xGtEm%2BZez2DY43cCV4v3Nmun%2Fe1wTk8Z%2BhPs7p6kznDVGHFszs8TdgQXgRbmM%2Fn3u0zg6oYjb2acqO2Ur9HXUNpzRMIixaicgB74jp2xw%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 84058aaf0e9a3500-WAW
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
expires: Sat, 14 Dec 2024 16:41:46 GMT

GET
H2 200 pushmenu.js Show response
bctser343grh.giize.com/wp-content/themes/promotor-nineteen/assets/scripts/ 2 KB
3 KB 210ms
207ms Script
application/javascript 195.181.241.253
INTERNETO-VIZIJA

General

Check archive.org

Show headers Download Go to

Full URL

https://bctser343grh.giize.com/wp-content/themes/promotor-nineteen/assets/scripts/pushmenu.js?ver=1702658489

Requested by

Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

195.181.241.253 , Lithuania, ASN212531 (INTERNETO-VIZIJA, LT),

Reverse DNS

Software

nginx/1.25.3 /

Resource Hash

c86a504e4ccaa48d0bcfecdc6ade53faaf83334b1c2e7bb0a9b791809e03aa7c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:28:31 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload;
cf-cache-status: HIT
x-cacheable: yf
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1730124
cf-polished: origSize=2948
alt-svc: h3=":443"; ma=86400
content-length: 1772
cf-bgj: minify
server: nginx/1.25.3
last-modified: Fri, 21 Oct 2022 07:06:31 GMT
etag: W/"635244f7-b84"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, POST, PURGE
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3aXQnjTAeJLA1iJB6SisnXDJzqpf%2FxGZMZy7O%2FfckDtOPLP1T%2Fg00KJ15oADs28orzTX6CmzWVWjE%2FCRRya75cNcWRFQ4g3tO59raIXbqORxgNalHUHQnxY1OR3ghGbnUifeA23V5U9Uq0%2FS1%2Bo%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 84058ab31ce7bfbe-WAW
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
expires: Sat, 14 Dec 2024 16:41:46 GMT

GET
H2 200 polls-js.js Show response
bctser343grh.giize.com/wp-content/plugins/wp-polls/ 3 KB
4 KB 261ms
257ms Script
application/javascript 195.181.241.253
INTERNETO-VIZIJA

General

Check archive.org

Show headers Download Go to

Full URL

https://bctser343grh.giize.com/wp-content/plugins/wp-polls/polls-js.js?ver=2.77.2

Requested by

Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

195.181.241.253 , Lithuania, ASN212531 (INTERNETO-VIZIJA, LT),

Reverse DNS

Software

nginx/1.25.3 /

Resource Hash

03d87f337bb68d971d9fdb8ed746c0ab6f4008e6060e63ed67057f444a05a6a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:28:32 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload;
cf-cache-status: HIT
x-cacheable: yf
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4620114
alt-svc: h3=":443"; ma=86400
content-length: 3242
cf-bgj: minify
server: nginx/1.25.3
last-modified: Mon, 28 Aug 2023 06:18:38 GMT
etag: W/"64ec3c3e-caa"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, POST, PURGE
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C0r98sNktug67zux3%2B1onZUUmCuIGKsHPUj1geruScmz0A57%2BCrOgq36aDmq9%2BDLM5RDNSuRC8GcwKzqCxouYZHFyYM7M7ifFkl7eizB0pHTMDH1d1CqUL8K2MvAksxSPyE151%2B27RZbIIDPvJQ%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 84058ab40e64bf6f-WAW
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
expires: Mon, 11 Nov 2024 01:50:53 GMT

GET
H2 200 async-widgets.js Show response
bctser343grh.giize.com/wp-content/themes/promotor-nineteen/strawberry/widgets/resources/ 788 B
2 KB 337ms
334ms Script
application/javascript 195.181.241.253
INTERNETO-VIZIJA

General

Check archive.org

Show headers Download Go to

Full URL

https://bctser343grh.giize.com/wp-content/themes/promotor-nineteen/strawberry/widgets/resources/async-widgets.js?ver=1.0.0

Requested by

Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

195.181.241.253 , Lithuania, ASN212531 (INTERNETO-VIZIJA, LT),

Reverse DNS

Software

nginx/1.25.3 /

Resource Hash

e6c25262e81839b1a1c14ae664f0a46f60e746ed3fdd2b5a530f3ed24f078ab2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:28:32 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload;
cf-cache-status: HIT
x-cacheable: yf
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3151913
cf-polished: origSize=1296
alt-svc: h3=":443"; ma=86400
content-length: 788
cf-bgj: minify
server: nginx/1.25.3
last-modified: Wed, 29 May 2019 06:35:23 GMT
etag: W/"5cee282b-510"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, POST, PURGE
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hIor9zVjsrHaZknnxbiWNquqePAfbS%2FZKWBadxqBnwOW1mg72IzV%2FRL%2F7TmI9inBhQuH4L5pci8qO6JDSVNEMF442gy4H9MaeAkz38lrSMOlCggN0yWBeYzecTBAYvZhBrc%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 84058ab46ebf01bf-CDG
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
expires: Thu, 28 Nov 2024 03:18:40 GMT

GET
H2 200 index.js Show response
bctser343grh.giize.com/wp-content/plugins/strawberry-video-pop/assets/scripts/dist/assets/ 61 KB
62 KB 183ms
182ms Script
application/javascript 195.181.241.253
INTERNETO-VIZIJA

General

Check archive.org

Show headers Download Go to

Full URL

https://bctser343grh.giize.com/wp-content/plugins/strawberry-video-pop/assets/scripts/dist/assets/index.js?ver=1651817729

Requested by

Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

195.181.241.253 , Lithuania, ASN212531 (INTERNETO-VIZIJA, LT),

Reverse DNS

672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.25.3 /

Resource Hash

b9d6414733583af09dece61e7ec8529201333617f4637123c816f5c285d0e69e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:28:32 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload;
cf-cache-status: HIT
x-cacheable: yf
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4380355
cf-polished: origSize=62951
alt-svc: h3=":443"; ma=86400
content-length: 62949
cf-bgj: minify
server: nginx/1.25.3
last-modified: Wed, 01 Feb 2023 10:57:47 GMT
etag: W/"63da45ab-f5e7"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, POST, PURGE
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xr409eyTlADcQy0FhUJqwElN3tGTsAgzz25plUuIEIa53zy40VnKJcSSDH%2FGDtFiXAObeqE8XQ5a%2BBDeM7a0w4If8pvfLG3ftPT2%2FPs4vjRSmjDozWB076LSgcftSJpC4bJsXBp2JPHtdlOf5GY%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 84058ab3ea0434f8-WAW
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
expires: Wed, 13 Nov 2024 14:28:11 GMT

GET
H/1.1 200
OK cx.js Show response
scdn.cxense.com/ 111 KB
37 KB 391ms
38ms Script
application/x-javascript 2600:141b:1c00:12a2::268b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://scdn.cxense.com/cx.js
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:12a2::268b Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: baa1e321fd815ef7c8bec6e9daa2ef002aadb656cc27cfdf6661dfdac33e0cda

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date: Thu, 04 Jan 2024 18:28:32 GMT
Content-Encoding: gzip
Last-Modified: Wed, 20 Dec 2023 12:22:49 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 37123
Expires: Thu, 04 Jan 2024 19:28:32 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
15 KB 424ms
83ms Font
font/woff2 2607:f8b0:4004:c09::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nktbxm.erufhvdjxc.tk/
Origin: https://nktbxm.erufhvdjxc.tk
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 15:39:19 GMT
x-content-type-options: nosniff
age: 10153
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 03 Jan 2025 15:39:19 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2
fonts.gstatic.com/s/roboto/v29/ 12 KB
12 KB 425ms
85ms Font
font/woff2 2607:f8b0:4004:c09::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2

Requested by

Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

336bb30461d407ee72236de87aca4fe68d611e1bee0030326778c858a4685b1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nktbxm.erufhvdjxc.tk/
Origin: https://nktbxm.erufhvdjxc.tk
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 01:22:42 GMT
x-content-type-options: nosniff
age: 147950
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11836
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 02 Jan 2025 01:22:42 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
16 KB 399ms
59ms Font
font/woff2 2607:f8b0:4004:c09::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nktbxm.erufhvdjxc.tk/
Origin: https://nktbxm.erufhvdjxc.tk
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 04:19:58 GMT
x-content-type-options: nosniff
age: 569314
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 28 Dec 2024 04:19:58 GMT

GET
H2 200 JTURjIg1_i6t8kCHKm45_dJE3gfD_u50.woff2
fonts.gstatic.com/s/montserrat/v18/ 16 KB
17 KB 380ms
40ms Font
font/woff2 2607:f8b0:4004:c09::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v18/JTURjIg1_i6t8kCHKm45_dJE3gfD_u50.woff2

Requested by

Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a0f6078ddaeef5f86b7e6ed74247c6ade57731a4c6ff797dbfa4b3ead20b4392

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nktbxm.erufhvdjxc.tk/
Origin: https://nktbxm.erufhvdjxc.tk
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 03:39:14 GMT
x-content-type-options: nosniff
age: 571758
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16764
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:21:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 28 Dec 2024 03:39:14 GMT

GET
H2 200 JTURjIg1_i6t8kCHKm45_dJE3gnD_g.woff2
fonts.gstatic.com/s/montserrat/v18/ 20 KB
20 KB 441ms
102ms Font
font/woff2 2607:f8b0:4004:c09::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v18/JTURjIg1_i6t8kCHKm45_dJE3gnD_g.woff2

Requested by

Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ec7d69015be507ee6045d259f50b6cf8ccb52ec7b41ec1bf50fee681683bea60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nktbxm.erufhvdjxc.tk/
Origin: https://nktbxm.erufhvdjxc.tk
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 02:58:37 GMT
x-content-type-options: nosniff
age: 574195
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20040
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:20:44 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 28 Dec 2024 02:58:37 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu7GxKOzY.woff2
fonts.gstatic.com/s/roboto/v29/ 12 KB
12 KB 415ms
115ms Font
font/woff2 2607:f8b0:4004:c09::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu7GxKOzY.woff2

Requested by

Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e959d9106d846030c0a62de668ec7c5810a3a1282c4f4ca98e1ea0756c75b8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nktbxm.erufhvdjxc.tk/
Origin: https://nktbxm.erufhvdjxc.tk
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 15:42:26 GMT
x-content-type-options: nosniff
age: 9966
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11860
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:24 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 03 Jan 2025 15:42:26 GMT

GET
H2 503 https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2024%2F01%2Fopulenta-pe-4-roti-fibra-de-carbon-si-aur-de-24-de-karate-pentru-koenigsegg-jesko-galerie-foto-11-1024x576.jpg
media.promotor.ro/HwIHEStzhGWTQr3ETlXIu2MORkA=/500x250/smart/filters:contrast(5):format(webp):quality(80)/ 0
0 451ms
420ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/HwIHEStzhGWTQr3ETlXIu2MORkA=/500x250/smart/filters:contrast(5):format(webp):quality(80)/https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2024%2F01%2Fopulenta-pe-4-roti-fibra-de-carbon-si-aur-de-24-de-karate-pentru-koenigsegg-jesko-galerie-foto-11-1024x576.jpg
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2 503 https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2023%2F12%2Fparlamentarii-se-plang-ca-nu-au-unde-sasi-parcheze-masinile-cand-vin-la-munca-ce-propun-alesii-1024x797.jpg
media.promotor.ro/_wxHcG4g-ZEYQG-O3HwY7KJrq5o=/500x250/smart/filters:contrast(5):format(webp):quality(80)/ 0
0 460ms
457ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/_wxHcG4g-ZEYQG-O3HwY7KJrq5o=/500x250/smart/filters:contrast(5):format(webp):quality(80)/https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2023%2F12%2Fparlamentarii-se-plang-ca-nu-au-unde-sasi-parcheze-masinile-cand-vin-la-munca-ce-propun-alesii-1024x797.jpg
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2 503 https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2024%2F01%2Fsuv-ul-electric-de-la-huawei-a-fost-lansat-in-china-pasagerii-vor-avea-la-dispozitie-inclusiv-proiectoare-de-cinema-galerie...
media.promotor.ro/UGmMhiMmwNT6gChLVKk0bc-p7IE=/500x250/smart/filters:contrast(5):format(webp):quality(80)/ 0
0 438ms
435ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/UGmMhiMmwNT6gChLVKk0bc-p7IE=/500x250/smart/filters:contrast(5):format(webp):quality(80)/https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2024%2F01%2Fsuv-ul-electric-de-la-huawei-a-fost-lansat-in-china-pasagerii-vor-avea-la-dispozitie-inclusiv-proiectoare-de-cinema-galerie-foto-5.jpg
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2 503 https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2024%2F01%2Fun-sofer-nu-respecta-semnul-stop-si-este-%E2%80%9Etaxat-corespunzator-1.jpg
media.promotor.ro/nspG-rI6Frv9zvHSHZ_12jgxNYI=/250x150/smart/filters:contrast(5):format(webp):quality(80)/ 0
0 175ms
173ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/nspG-rI6Frv9zvHSHZ_12jgxNYI=/250x150/smart/filters:contrast(5):format(webp):quality(80)/https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2024%2F01%2Fun-sofer-nu-respecta-semnul-stop-si-este-%E2%80%9Etaxat-corespunzator-1.jpg
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2 503 https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2023%2F10%2FVolkswagen-ID-2.jpg
media.promotor.ro/ayIQx9jkx1sBTiY7WeZitgVz9Ug=/250x150/smart/filters:contrast(5):format(webp):quality(80)/ 0
0 452ms
450ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/ayIQx9jkx1sBTiY7WeZitgVz9Ug=/250x150/smart/filters:contrast(5):format(webp):quality(80)/https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2023%2F10%2FVolkswagen-ID-2.jpg
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2 503 https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2023%2F08%2FHyundai-Kona_N-2022-1280-4d-1024x597.jpg
media.promotor.ro/V_YYg60nC4ckpMQtCIsQt9ptfpg=/250x150/smart/filters:contrast(5):format(webp):quality(80)/ 0
0 449ms
448ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/V_YYg60nC4ckpMQtCIsQt9ptfpg=/250x150/smart/filters:contrast(5):format(webp):quality(80)/https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2023%2F08%2FHyundai-Kona_N-2022-1280-4d-1024x597.jpg
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2 503 https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2023%2F05%2Fcare-sunt-daunele-unei-masini-second-hand-care-o-fac-de-necumparat-dan-babu-masina-potrivita-promotor-2023-3-1024x684.jpg
media.promotor.ro/CVpKGe4qKGFhDkhn9kXg0MjCfp0=/250x150/smart/filters:contrast(5):format(webp):quality(80)/ 0
0 452ms
422ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/CVpKGe4qKGFhDkhn9kXg0MjCfp0=/250x150/smart/filters:contrast(5):format(webp):quality(80)/https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2023%2F05%2Fcare-sunt-daunele-unei-masini-second-hand-care-o-fac-de-necumparat-dan-babu-masina-potrivita-promotor-2023-3-1024x684.jpg
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2 503 ca890beef2705c81b066a62db08d3ecf-o.jpg
media.promotor.ro/4sK7y-YP0nBd0PoXuRiizxyukic=/220x124/smart/filters:contrast(5):format(webp):quality(80)/https://bctser343grh.giize.com/wp-content/uploads/sfm/2024/01/1571297645/ 0
0 468ms
438ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/4sK7y-YP0nBd0PoXuRiizxyukic=/220x124/smart/filters:contrast(5):format(webp):quality(80)/https://bctser343grh.giize.com/wp-content/uploads/sfm/2024/01/1571297645/ca890beef2705c81b066a62db08d3ecf-o.jpg
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2 503 9066238100cf5daed692115c2e245484-o.jpg
media.promotor.ro/k_TwBJ9YqOZU-IIQV8UXe_ZJMQ0=/220x124/smart/filters:contrast(5):format(webp):quality(80)/https://bctser343grh.giize.com/wp-content/uploads/sfm/2024/01/1571297657/ 0
0 461ms
433ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/k_TwBJ9YqOZU-IIQV8UXe_ZJMQ0=/220x124/smart/filters:contrast(5):format(webp):quality(80)/https://bctser343grh.giize.com/wp-content/uploads/sfm/2024/01/1571297657/9066238100cf5daed692115c2e245484-o.jpg
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2 503 e0ff659545887d3d8c9885c4d3f60a35-o.jpg
media.promotor.ro/2xs07d9bdi3lw92NUC_MLaOibT8=/220x124/smart/filters:contrast(5):format(webp):quality(80)/https://bctser343grh.giize.com/wp-content/uploads/sfm/2024/01/1571380236/ 0
0 432ms
408ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/2xs07d9bdi3lw92NUC_MLaOibT8=/220x124/smart/filters:contrast(5):format(webp):quality(80)/https://bctser343grh.giize.com/wp-content/uploads/sfm/2024/01/1571380236/e0ff659545887d3d8c9885c4d3f60a35-o.jpg
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2 503 832f2097fca8e2e1a322665329878aba-o.jpg
media.promotor.ro/ssNhEjDoX1KdN22rm2UJI9SmunA=/220x124/smart/filters:contrast(5):format(webp):quality(80)/https://bctser343grh.giize.com/wp-content/uploads/sfm/2024/01/1571380247/ 0
0 442ms
418ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/ssNhEjDoX1KdN22rm2UJI9SmunA=/220x124/smart/filters:contrast(5):format(webp):quality(80)/https://bctser343grh.giize.com/wp-content/uploads/sfm/2024/01/1571380247/832f2097fca8e2e1a322665329878aba-o.jpg
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2 503 https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2024%2F01%2Fturcii-si-au-facut-de-cap-cu-dacia-duster-cat-costa-modificarile-aduse-suv-ului-romanesc-video-1-1024x511.png
media.promotor.ro/yfElWA3jpaWi3Vq872SKDrLemRY=/250x150/smart/filters:contrast(5):format(webp):quality(80)/ 0
0 445ms
424ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/yfElWA3jpaWi3Vq872SKDrLemRY=/250x150/smart/filters:contrast(5):format(webp):quality(80)/https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2024%2F01%2Fturcii-si-au-facut-de-cap-cu-dacia-duster-cat-costa-modificarile-aduse-suv-ului-romanesc-video-1-1024x511.png
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2 503 https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2024%2F01%2Fpoti-fi-amendat-daca-circuli-cu-mai-mult-de-2-martori-de-bord-aprinsi-ce-verifica-politia-cand-te-opreste-2-1024x683.jpg
media.promotor.ro/nS3ebvMUjjBMIUNLNGQ9yCfnvrY=/250x150/smart/filters:contrast(5):format(webp):quality(80)/ 0
0 464ms
438ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/nS3ebvMUjjBMIUNLNGQ9yCfnvrY=/250x150/smart/filters:contrast(5):format(webp):quality(80)/https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2024%2F01%2Fpoti-fi-amendat-daca-circuli-cu-mai-mult-de-2-martori-de-bord-aprinsi-ce-verifica-politia-cand-te-opreste-2-1024x683.jpg
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2 503 https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2024%2F01%2Fnoul-audi-q8-e-tron-edition-dakar-mai-capabil-in-teren-dar-cu-un-pret-pe-masura-3-1024x683.jpg
media.promotor.ro/T0TFFAzSLLYqnhYy60gUnQCau-k=/250x150/smart/filters:contrast(5):format(webp):quality(80)/ 0
0 459ms
434ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/T0TFFAzSLLYqnhYy60gUnQCau-k=/250x150/smart/filters:contrast(5):format(webp):quality(80)/https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2024%2F01%2Fnoul-audi-q8-e-tron-edition-dakar-mai-capabil-in-teren-dar-cu-un-pret-pe-masura-3-1024x683.jpg
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2 503 https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2024%2F01%2Fdelivery-motorcycle-in-motion-motion-blur-2023-11-27-05-05-11-utc-1024x683.jpg
media.promotor.ro/bQLxfbG8AhFKk-Wa1sSZR_YmNF8=/250x150/smart/filters:contrast(5):format(webp):quality(80)/ 0
0 440ms
414ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/bQLxfbG8AhFKk-Wa1sSZR_YmNF8=/250x150/smart/filters:contrast(5):format(webp):quality(80)/https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2024%2F01%2Fdelivery-motorcycle-in-motion-motion-blur-2023-11-27-05-05-11-utc-1024x683.jpg
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2 503 69a554eb2b2ddf6eac4a44742811b109-o.jpg
media.promotor.ro/IWwdn3QkSpQnRlp0ESvG4SvYQJ8=/220x124/smart/filters:contrast(5):format(webp):quality(80)/https://bctser343grh.giize.com/wp-content/uploads/sfm/2024/01/1571297693/ 0
0 436ms
411ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/IWwdn3QkSpQnRlp0ESvG4SvYQJ8=/220x124/smart/filters:contrast(5):format(webp):quality(80)/https://bctser343grh.giize.com/wp-content/uploads/sfm/2024/01/1571297693/69a554eb2b2ddf6eac4a44742811b109-o.jpg
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2 503 a556f79c32633d74733b5d0f52588a05-o.png
media.promotor.ro/kZD5VVRfJPS-X6kPNxrvyAyE8Ec=/220x124/smart/filters:contrast(5):format(webp):quality(80)/https://bctser343grh.giize.com/wp-content/uploads/sfm/2024/01/1586957941/ 0
0 459ms
435ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/kZD5VVRfJPS-X6kPNxrvyAyE8Ec=/220x124/smart/filters:contrast(5):format(webp):quality(80)/https://bctser343grh.giize.com/wp-content/uploads/sfm/2024/01/1586957941/a556f79c32633d74733b5d0f52588a05-o.png
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2 503 https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2024%2F01%2Fyoung-woman-in-car-giving-driver-license-to-police-2023-11-27-04-58-47-utc-1024x600.jpg
media.promotor.ro/IiLU0Yl07T0l0GHXzpB4dDpIm0Y=/250x150/smart/filters:contrast(5):format(webp):quality(80)/ 0
0 451ms
426ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/IiLU0Yl07T0l0GHXzpB4dDpIm0Y=/250x150/smart/filters:contrast(5):format(webp):quality(80)/https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2024%2F01%2Fyoung-woman-in-car-giving-driver-license-to-police-2023-11-27-04-58-47-utc-1024x600.jpg
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2 503 https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2024%2F01%2Fshutterstock_76521943-1024x683.jpg
media.promotor.ro/PtclC0Ag9jQG5KX6cxikH6i3G5E=/250x150/smart/filters:contrast(5):format(webp):quality(80)/ 0
0 471ms
447ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/PtclC0Ag9jQG5KX6cxikH6i3G5E=/250x150/smart/filters:contrast(5):format(webp):quality(80)/https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2024%2F01%2Fshutterstock_76521943-1024x683.jpg
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2 503 https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2024%2F01%2Finmatricularile-de-autoturisme-in-romania-total-2023-top-3-branduri-apreciate-de-romani-1024x653.jpg
media.promotor.ro/v434FiG9plhXDacK2SNHlzegGJ4=/250x150/smart/filters:contrast(5):format(webp):quality(80)/ 0
0 455ms
432ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/v434FiG9plhXDacK2SNHlzegGJ4=/250x150/smart/filters:contrast(5):format(webp):quality(80)/https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2024%2F01%2Finmatricularile-de-autoturisme-in-romania-total-2023-top-3-branduri-apreciate-de-romani-1024x653.jpg
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2 503 https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2024%2F01%2Fpolitia-rutiera-1-1024x598.jpg
media.promotor.ro/YwXxIpUvxr1iyzHi10l4aRTjR40=/250x150/smart/filters:contrast(5):format(webp):quality(80)/ 0
0 462ms
439ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/YwXxIpUvxr1iyzHi10l4aRTjR40=/250x150/smart/filters:contrast(5):format(webp):quality(80)/https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2024%2F01%2Fpolitia-rutiera-1-1024x598.jpg
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2 503 https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2024%2F01%2Flandscape-DSP-1024x576.jpg
media.promotor.ro/5Kep7_WNeVRGDCuM4Eov0FMlN5I=/790x600/smart/filters:contrast(5):format(webp):quality(80)/ 0
0 458ms
436ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/5Kep7_WNeVRGDCuM4Eov0FMlN5I=/790x600/smart/filters:contrast(5):format(webp):quality(80)/https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2024%2F01%2Flandscape-DSP-1024x576.jpg
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2 503 https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2023%2F11%2Ftest-drive-bmw-seria-5-44-1024x578.jpg
media.promotor.ro/7vF0ZQ7yd76880XZ08sbB08lrtU=/460x260/smart/filters:contrast(5):format(webp):quality(80)/ 0
0 506ms
484ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/7vF0ZQ7yd76880XZ08sbB08lrtU=/460x260/smart/filters:contrast(5):format(webp):quality(80)/https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2023%2F11%2Ftest-drive-bmw-seria-5-44-1024x578.jpg
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2 503 https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2023%2F10%2Ftest-drive-peugeot-508-facelift-111-1024x576.jpg
media.promotor.ro/4UEyphBaDSXnDyBgCJ-4F0Cf0bI=/460x260/smart/filters:contrast(5):format(webp):quality(80)/ 0
0 464ms
442ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/4UEyphBaDSXnDyBgCJ-4F0Cf0bI=/460x260/smart/filters:contrast(5):format(webp):quality(80)/https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2023%2F10%2Ftest-drive-peugeot-508-facelift-111-1024x576.jpg
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2 503 https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2023%2F10%2Fo-legenda-americana-pe-meleaguri-romanesti-am-testat-noua-generatie-ford-bronco-in-romania-video-30-1024x683.jpg
media.promotor.ro/inlEXfckwUUghRr7mYioO5SO2N0=/460x260/smart/filters:contrast(5):format(webp):quality(80)/ 0
0 462ms
441ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/inlEXfckwUUghRr7mYioO5SO2N0=/460x260/smart/filters:contrast(5):format(webp):quality(80)/https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2023%2F10%2Fo-legenda-americana-pe-meleaguri-romanesti-am-testat-noua-generatie-ford-bronco-in-romania-video-30-1024x683.jpg
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2 503 https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2024%2F01%2Fnoul-smart-1-design-inedit-si-peste-400-km-de-autonomie-electrica-video-32-1024x576.jpg
media.promotor.ro/bhhENlcyefuKEoeVERRvMVg7iQI=/1170x600/smart/filters:contrast(5):format(webp):quality(80)/ 0
0 469ms
448ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/bhhENlcyefuKEoeVERRvMVg7iQI=/1170x600/smart/filters:contrast(5):format(webp):quality(80)/https%3A%2F%2Fbctser343grh.giize.com%2Fwp-content%2Fuploads%2F2024%2F01%2Fnoul-smart-1-design-inedit-si-peste-400-km-de-autonomie-electrica-video-32-1024x576.jpg
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2 503 09140ef88397734a4a589914b0b29596-o.jpg
media.promotor.ro/U9NNbDt2RjA8Xb3OXJ9gy3Taz00=/460x260/smart/filters:contrast(5):format(webp):quality(80)/https://bctser343grh.giize.com/wp-content/uploads/sfm/2024/01/1571297645/ 0
0 490ms
472ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/U9NNbDt2RjA8Xb3OXJ9gy3Taz00=/460x260/smart/filters:contrast(5):format(webp):quality(80)/https://bctser343grh.giize.com/wp-content/uploads/sfm/2024/01/1571297645/09140ef88397734a4a589914b0b29596-o.jpg
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2 503 5a4e4663e76ecc45bf152d5ec1ec8bfa-o.jpg
media.promotor.ro/i14SnXuCN0ta7urlsV8lXtCFPrA=/460x260/smart/filters:contrast(5):format(webp):quality(80)/https://bctser343grh.giize.com/wp-content/uploads/sfm/2023/12/1571297645/ 0
0 202ms
185ms Image
text/html 2606:4700:3036::ac43:b402
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.promotor.ro/i14SnXuCN0ta7urlsV8lXtCFPrA=/460x260/smart/filters:contrast(5):format(webp):quality(80)/https://bctser343grh.giize.com/wp-content/uploads/sfm/2023/12/1571297645/5a4e4663e76ecc45bf152d5ec1ec8bfa-o.jpg
Requested by: Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:b402 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
199 B 155ms
45ms XHR
text/plain 2620:100:a001::18
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.11.0&cb=84398024467&lsavail=0

Requested by

Host: bctser343grh.giize.com
URL: https://bctser343grh.giize.com/wp-content/plugins/strawberry-ads-manager/js/prebid7.11.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://nktbxm.erufhvdjxc.tk/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://nktbxm.erufhvdjxc.tk
date: Thu, 04 Jan 2024 18:28:32 GMT
strict-transport-security: max-age=31536000; preload;
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Kestrel
vary: Origin

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ 0
183 B 435ms
129ms XHR
text/plain 185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: bctser343grh.giize.com
URL: https://bctser343grh.giize.com/wp-content/plugins/strawberry-ads-manager/js/prebid7.11.0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://nktbxm.erufhvdjxc.tk/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://nktbxm.erufhvdjxc.tk
date: Thu, 04 Jan 2024 18:28:32 GMT
access-control-allow-credentials: true
vary: Origin
access-control-max-age: 3600
access-control-allow-methods: POST

GET
H2 200 arj Show response
gandul-d.openx.net/w/1.0/ 173 B
585 B 310ms
122ms XHR
application/json 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://gandul-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fbctser343grh.giize.com%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=600&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=7d82a6d2-6bcb-4cc7-94ef-5fdb09ad48f5%2C001a79af-89d3-4bf0-8b43-439c3387eda1%2C1508f8c8-aa56-42bc-8c20-c3e271ffd64d%2Cd468d04c-33da-4403-bcf5-7d87ffc564a9&nocache=1704392912337&aus=728x90%2C970x250%7C728x90%2C970x250%7C728x90%2C970x250%7C970x250&divids=div-gpt-ad-1570029933207-0%2Cdiv-gpt-ad-1570030043272-0%2Cdiv-gpt-ad-1570030144297-0%2Cdiv-gpt-ad-1570028615726-0&aucs=div-gpt-ad-1570029933207-0%2Cdiv-gpt-ad-1570030043272-0%2Cdiv-gpt-ad-1570030144297-0%2Cdiv-gpt-ad-1570028615726-0&auid=557742193%2C557742194%2C557742195%2C557742196
Requested by: Host: bctser343grh.giize.com
URL: https://bctser343grh.giize.com/wp-content/plugins/strawberry-ads-manager/js/prebid7.11.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e57d22b177dc45a33c9611ee5a7fa911c55e942d62da983a85a5aad5fd213a57

Request headers

Referer: https://nktbxm.erufhvdjxc.tk/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 04 Jan 2024 18:28:32 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://nktbxm.erufhvdjxc.tk
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 164
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 204 openrtb Show response
adx.adform.net/adx/ 0
536 B 943ms
168ms XHR
text/plain 37.157.6.243
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx.adform.net/adx/openrtb

Requested by

Host: bctser343grh.giize.com
URL: https://bctser343grh.giize.com/wp-content/plugins/strawberry-ads-manager/js/prebid7.11.0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.243 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://nktbxm.erufhvdjxc.tk/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 04 Jan 2024 18:28:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://nktbxm.erufhvdjxc.tk
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 496 B
1 KB 419ms
266ms XHR
application/json 68.67.160.114
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: bctser343grh.giize.com
URL: https://bctser343grh.giize.com/wp-content/plugins/strawberry-ads-manager/js/prebid7.11.0.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.114 Jersey City, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4e7ebcbc708f796366a0edf9f60dfb688fb929f216dfcc80976fba37707b71d5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://nktbxm.erufhvdjxc.tk/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 04 Jan 2024 18:28:32 GMT
an-x-request-uuid: bdb9d4e2-26ea-4a55-8838-54740bc927f6
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://nktbxm.erufhvdjxc.tk
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 96.9.249.44; 96.9.249.44; 672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 496
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/ 432 KB
135 KB 437ms
36ms Script
text/javascript 2607:f8b0:4004:c1d::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

013fc39efb38a28d8eccab58189059646847bc5c54e1c4b637e874b6109ee0ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 16:36:41 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6712
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138203
x-xss-protection: 0
server: cafe
etag: 14959461090202361603
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Fri, 03 Jan 2025 16:36:41 GMT

GET
H2 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 65 B
598 B 453ms
55ms XHR
application/json 2607:f8b0:4004:c1d::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=nktbxm.erufhvdjxc.tk

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a840e5ac262f7e0feb6ea91c576f2ca866781c54f51dcaffa90e00b6da623b24

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:28:33 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55
x-xss-protection: 0
expires: Thu, 04 Jan 2024 18:28:33 GMT

GET
H2 200 settings Show response
nktbxm.erufhvdjxc.tk/wp-json/svp/ 5 KB
2 KB 620ms
618ms Fetch
application/json 2606:4700:3030::ac43:9259
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nktbxm.erufhvdjxc.tk/wp-json/svp/settings

Requested by

Host: bctser343grh.giize.com
URL: https://bctser343grh.giize.com/wp-content/plugins/strawberry-video-pop/assets/scripts/dist/assets/index.js?ver=1651817729

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::ac43:9259 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b0bf906757b1cb51bcacdd3eda087bf5419de94878d41a5b67c04da738c7bc69

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://nktbxm.erufhvdjxc.tk/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type: application/json

Response headers

cf-edge-cache: cache,platform=wordpress
date: Thu, 04 Jan 2024 18:28:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-cacheable: yf
age: 149
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-served-by: web08
server: cloudflare
allow: GET
vary: Accept-Encoding, Origin
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS, POST, PURGE
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BzEqF%2FkjFFtPETNvymt%2BWsHWVoPDXtbWbKFfqvaqSXtipOEsh8tVSigPoDIUkYfilH%2B2htl%2BoExvnULCwz%2Bo4kPHBTVAA8LtkfgxgrZdOYnzKb1HuuILLpsnz458Df9Tols%3D"}],"group":"cf-nel","max_age":604800}
x-robots-tag: noindex
link: <https://www.promotor.ro/wp-json/>; rel="https://api.w.org/"
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
cf-ray: 84058ab8b9264bc9-BUF

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 260 KB
88 KB 54ms
53ms Script
application/javascript 2607:f8b0:4004:c17::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-WBWT7L8BYX&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-1684917-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

382d608657c74e3e25b4a8ef52d560c6cc02b3500fd7b06820fdf2e9de8665ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:28:32 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 90194
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 04 Jan 2024 18:28:32 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 388ms
38ms Script
text/javascript 2607:f8b0:4004:c17::65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-1684917-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 04 Jan 2024 16:40:25 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 6488
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Thu, 04 Jan 2024 18:40:25 GMT

GET
H/1.1 200
OK sp1.html Show response
cdn.cxense.com/ Frame ADB3 456 B
683 B 136ms
43ms Document
text/html 2600:141b:1c00:12a2::268b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cxense.com/sp1.html
Requested by: Host: scdn.cxense.com
URL: https://scdn.cxense.com/cx.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:12a2::268b Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 1643f549380aeab61b23502d9f260f7350d9c2bd34dbc3cb0af73644332b6ef5

Request headers

Referer: https://nktbxm.erufhvdjxc.tk/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Cache-Control: max-age=864000
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 289
Content-Type: text/html
Date: Thu, 04 Jan 2024 18:28:33 GMT
Expires: Sun, 14 Jan 2024 18:28:33 GMT
Last-Modified: Thu, 30 Nov 2023 11:55:50 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding
X-Check-Cacheable: YES

GET
H/1.1 200
OK push Show response
comcluster.cxense.com/dmp/ 49 B
619 B 346ms
35ms Script
text/javascript 145.40.89.32
PACKET

General

Check archive.org

Show headers Download Go to

Full URL

https://comcluster.cxense.com/dmp/push?callback=cXJsonpCB1&ver=2.8.44&persisted=fcadb0c22bec63a3e94af5a65644fc6b869880e0&glb=&json=%7B%22events%22%3A%5B%7B%22type%22%3A%22adBlockerDetection%22%2C%22rnd%22%3A%22lqzjj89zll09b2ls%22%2C%22siteId%22%3A%221135102062960807737%22%2C%22prnd%22%3A%22lqzjj869xzgcehu1%22%2C%22userIds%22%3A%5B%7B%22id%22%3A%22lqzjj869v54b7vtc%22%2C%22type%22%3A%22cx%22%7D%5D%2C%22origin%22%3A%22brt-adblock%22%2C%22customParameters%22%3A%5B%7B%22group%22%3A%22adBlockerDetected%22%2C%22item%22%3A%22No%22%2C%22type%22%3A%22string%22%7D%5D%7D%5D%7D

Requested by

Host: scdn.cxense.com
URL: https://scdn.cxense.com/cx.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

145.40.89.32 Ashburn, United States, ASN54825 (PACKET, US),

Reverse DNS

Software

Jetty(9.4.28.v20200408) /

Resource Hash

21fb96298942208516e544e8e38eddfe75f3fffc2e2946dfc397354d4b1f5181

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 Jan 2024 18:28:33 GMT
x-content-type-options: nosniff
server: Jetty(9.4.28.v20200408)
p3p: policyref="http://www.cxense.com/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: text/javascript;charset=utf-8
cache-control: no-store, no-cache, must-revalidate
content-length: 49
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 204 collect
analytics.google.com/g/ 0
258 B 115ms
43ms Ping
text/plain 2607:f8b0:4004:c1b::65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-WBWT7L8BYX&gtm=45je4130v870048749&_p=1704392911894&_gaz=1&gcd=11l1l1l1l1&dma=0&cid=917042226.1704392913&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AAAI&_s=1&sid=1704392913&sct=1&seg=0&dl=https%3A%2F%2Fnktbxm.erufhvdjxc.tk%2F&dt=%C8%98tiri%20despre%20industria%20auto%20%7C%20Nout%C4%83%C8%9Bi%20pentru%20pasiona%C8%9Bi%20%C8%99i%20teste%20auto%20%7C%20Promotor.ro&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=3609
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-WBWT7L8BYX&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c1b::65 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 Jan 2024 18:28:33 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://nktbxm.erufhvdjxc.tk
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
258 B 118ms
38ms Ping
text/plain 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-WBWT7L8BYX&cid=917042226.1704392913&gtm=45je4130v870048749&aip=1&dma=0&gcd=11l1l1l1l1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-WBWT7L8BYX&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 Jan 2024 18:28:33 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://nktbxm.erufhvdjxc.tk
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK cx.js Show response
cdn.cxense.com/ Frame ADB3 111 KB
37 KB 39ms
39ms Script
application/x-javascript 2600:141b:1c00:12a2::268b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cxense.com/cx.js
Requested by: Host: cdn.cxense.com
URL: https://cdn.cxense.com/sp1.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:12a2::268b Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: c024a500b6884e87cb923bdfab0b6303d5130c87bd4e00612ea410613e765faf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.cxense.com/sp1.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date: Thu, 04 Jan 2024 18:28:33 GMT
Content-Encoding: gzip
Last-Modified: Wed, 20 Dec 2023 12:22:49 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 37123
Expires: Thu, 04 Jan 2024 19:28:33 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
148 B 42ms
40ms XHR
text/plain 2607:f8b0:4004:c17::65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1285927578&t=pageview&_s=1&dl=https%3A%2F%2Fnktbxm.erufhvdjxc.tk%2F&ul=en-us&de=UTF-8&dt=%C8%98tiri%20despre%20industria%20auto%20%7C%20Nout%C4%83%C8%9Bi%20pentru%20pasiona%C8%9Bi%20%C8%99i%20teste%20auto%20%7C%20Promotor.ro&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=1979429653&gjid=1437611737&cid=917042226.1704392913&tid=UA-1684917-1&_gid=958181110.1704392913&_r=1&gtm=457e4130&gcd=11l1l1l1l1&dma=0&jsscut=1&z=1315570445

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://nktbxm.erufhvdjxc.tk/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 04 Jan 2024 18:28:33 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://nktbxm.erufhvdjxc.tk
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
194 B 33ms
33ms Image
image/gif 2607:f8b0:4004:c17::65
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1285927578&t=event&ni=1&_s=2&dl=https%3A%2F%2Fnktbxm.erufhvdjxc.tk%2F&ul=en-us&de=UTF-8&dt=%C8%98tiri%20despre%20industria%20auto%20%7C%20Nout%C4%83%C8%9Bi%20pentru%20pasiona%C8%9Bi%20%C8%99i%20teste%20auto%20%7C%20Promotor.ro&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=NTG%20adblock&ea=whitelisted&el=https%3A%2F%2Fnktbxm.erufhvdjxc.tk%2F&_u=YADAAUABAAAAACAAI~&jid=&gjid=&cid=917042226.1704392913&tid=UA-1684917-1&_gid=958181110.1704392913&gtm=457e4130&gcd=11l1l1l1l1&dma=0&jsscut=1&z=558255185

Requested by

Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 03 Jan 2024 20:11:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 80210
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 475 KB
54 KB 416ms
414ms Fetch
text/plain 2607:f8b0:4004:c1d::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1403791045230369&correlator=2296421451682098&hxva=1&scor=4126488526132370&eid=31079957%2C31079959%2C95320409&output=ldjh&gdfp_req=1&vrg=202312070101&ptt=17&impl=fifs&npa=1&iu_parts=119229185%2CPromotor_Nou%2CBillboard_300x250_1%2CBillboard_300x250_2%2CBillboard_300x250_3%2CBranding_970x250&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F3%2C%2F0%2F1%2F4%2C%2F0%2F1%2F5&prev_iu_szs=728x90%7C970x250%2C728x90%7C970x250%2C728x90%7C970x250%2C970x250&ifi=1&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1704392913566&lmt=1704392913&adxs=436%2C436%2C436%2C315&adys=1261%2C1852%2C2700%2C109&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1%7C2%7C3%7C0&ucis=1%7C2%7C3%7C4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fnktbxm.erufhvdjxc.tk%2F&vis=1&psz=1150x10%7C1150x20%7C1150x20%7C1560x-1&msz=1150x0%7C1150x0%7C1150x0%7C1560x-1&fws=0%2C0%2C0%2C0&ohw=0%2C0%2C0%2C0&ga_vid=917042226.1704392913&ga_sid=1704392914&ga_hid=1285927578&ga_fc=true&dlt=1704392910664&idt=2754&cust_params=cat_cancan%3Dhomepage&adks=1569812337%2C944352759%2C3360288363%2C3781322237&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

26891d81ed5023072cc7542ae6e6d534ab63daa958e3bd7d1c723cdf8bdbfbeb

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CKuetrGuxIMDFd0SswAddeQMrA&gqi=&layout=/sadbundle/%24csp%253Der3%24/16508777165672677376/index.html,child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10679853082638024704/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10679853082638024704/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CKqetrGuxIMDFd0SswAddeQMrA&gqi=&layout=/sadbundle/%24csp%253Der3%24/10679853082638024704/index.html,child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CKmetrGuxIMDFd0SswAddeQMrA&gqi=&layout=/sadbundle/%24csp%253Der3%24/16508777165672677376/index.html,child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CKyetrGuxIMDFd0SswAddeQMrA&gqi=&layout=/sadbundle/%24csp%253Der3%24/16508777165672677376/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CKuetrGuxIMDFd0SswAddeQMrA&gqi=&layout=/sadbundle/%24csp%253Der3%24/16508777165672677376/index.html,child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10679853082638024704/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10679853082638024704/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CKqetrGuxIMDFd0SswAddeQMrA&gqi=&layout=/sadbundle/%24csp%253Der3%24/10679853082638024704/index.html,child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CKmetrGuxIMDFd0SswAddeQMrA&gqi=&layout=/sadbundle/%24csp%253Der3%24/16508777165672677376/index.html,child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CKyetrGuxIMDFd0SswAddeQMrA&gqi=&layout=/sadbundle/%24csp%253Der3%24/16508777165672677376/index.html
date: Thu, 04 Jan 2024 18:28:34 GMT
x-content-type-options: nosniff
content-encoding: br
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52838
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://nktbxm.erufhvdjxc.tk
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 856D 6 KB
3 KB 173ms
31ms Document
text/html 2607:f8b0:4004:c17::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nktbxm.erufhvdjxc.tk/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 04 Jan 2024 18:28:33 GMT
expires: Fri, 03 Jan 2025 18:28:33 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK p1.js Show response
p1cluster.cxense.com/ Frame ADB3 47 B
636 B 104ms
28ms Script
text/javascript 145.40.89.32
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://p1cluster.cxense.com/p1.js
Requested by: Host: cdn.cxense.com
URL: https://cdn.cxense.com/cx.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 145.40.89.32 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: Jetty(9.4.28.v20200408) /
Resource Hash: 2d51939b8fdbc0ba4293fb00098873e855b47059929637d873f2b95a4b189d77

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.cxense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:28:33 GMT
last-modified: Tue, 04 Jul 2023 18:28:33 GMT
server: Jetty(9.4.28.v20200408)
etag: 3tg7wwtaq48jr2ymk2psvv1n7t
p3p: policyref="http://www.cxense.com/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: text/javascript;charset=utf-8
cache-control: private, proxy-revalidate
content-length: 47
expires: Sat, 04 Jan 2025 18:28:33 GMT

GET
H/1.1 200
OK rep.gif
comcluster.cxense.com/Repo/ Frame ADB3 43 B
468 B 31ms
31ms Image
image/gif 145.40.89.32
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://comcluster.cxense.com/Repo/rep.gif?ver=2.8.44&typ=pgv&rnd=lqzjj869xzgcehu1&sid=1135102062960807737&loc=https%3A%2F%2Fnktbxm.erufhvdjxc.tk%2F&new=1&arf=0&ltm=1704392912679&ref=&tzo=600&wsz=1600x1200&res=1600x1200&dpr=1&col=24&bln=en-US&chs=UTF-8&cks=lqzjj89bvx825k3b&ckp=lqzjj869v54b7vtc&glb=&cp_userState=anon&cst=3tg7wwtaq48jr2ymk2psvv1n7t
Requested by: Host: cdn.cxense.com
URL: https://cdn.cxense.com/sp1.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 145.40.89.32 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: Jetty(9.4.28.v20200408) /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.cxense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

p3p: policyref="http://www.cxense.com/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
date: Thu, 04 Jan 2024 18:28:33 GMT
server: Jetty(9.4.28.v20200408)
content-length: 43
content-type: image/gif

GET
H/1.1 200
OK id Show response
id.cxense.com/public/user/ 103 B
692 B 172ms
35ms Script
text/javascript 145.40.89.32
PACKET

General

Check archive.org

Show headers Download Go to

Full URL

https://id.cxense.com/public/user/id?json=%7B%22identities%22%3A%5B%7B%22type%22%3A%22ckp%22%2C%22id%22%3A%22lqzjj869v54b7vtc%22%7D%2C%7B%22type%22%3A%22lst%22%2C%22id%22%3A%223tg7wwtaq48jr2ymk2psvv1n7t%22%7D%2C%7B%22type%22%3A%22cst%22%2C%22id%22%3A%223tg7wwtaq48jr2ymk2psvv1n7t%22%7D%5D%2C%22siteId%22%3A%221135102062960807737%22%2C%22location%22%3A%22https%3A%2F%2Fnktbxm.erufhvdjxc.tk%2F%22%7D&callback=cXJsonpCB2

Requested by

Host: scdn.cxense.com
URL: https://scdn.cxense.com/cx.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

145.40.89.32 Ashburn, United States, ASN54825 (PACKET, US),

Reverse DNS

Software

Jetty(9.4.28.v20200408) /

Resource Hash

6c38d4d47f5cd9ae747a5db55a4a27b811639ab2feba4092769fdb877d4239ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 Jan 2024 18:28:33 GMT
x-content-type-options: nosniff
server: Jetty(9.4.28.v20200408)
content-type: text/javascript;charset=utf-8
p3p: policyref="http://www.cxense.com/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-store, no-cache, must-revalidate
content-length: 103
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 1101ms
0ms XHR
application/json 2607:f8b0:4004:c1b::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202312070101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9c Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e512ba146f7c97bf511aa145e417821b1a0285e557b501c6060691e5cff2aca0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:28:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12246
x-xss-protection: 0

GET
H2 200 container.html Show response
6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 6253 6 KB
3 KB 114ms
25ms Document
text/html 2607:f8b0:4004:c17::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nktbxm.erufhvdjxc.tk/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 04 Jan 2024 18:28:33 GMT
expires: Fri, 03 Jan 2025 18:28:33 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 76B1 6 KB
3 KB 100ms
16ms Document
text/html 2607:f8b0:4004:c17::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nktbxm.erufhvdjxc.tk/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 04 Jan 2024 18:28:33 GMT
expires: Fri, 03 Jan 2025 18:28:33 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 6293 6 KB
3 KB 144ms
63ms Document
text/html 2607:f8b0:4004:c17::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nktbxm.erufhvdjxc.tk/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 04 Jan 2024 18:28:33 GMT
expires: Fri, 03 Jan 2025 18:28:33 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 1EB3 6 KB
3 KB 110ms
33ms Document
text/html 2607:f8b0:4004:c17::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nktbxm.erufhvdjxc.tk/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 04 Jan 2024 18:28:33 GMT
expires: Fri, 03 Jan 2025 18:28:33 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK user Show response
admp-tc-sati.adtlgc.com/ 63 B
315 B 840ms
108ms Script
application/javascript 54.73.185.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://admp-tc-sati.adtlgc.com/user?nw=0&cm=1&sg=1&callback=adapt_dataRequest_sati_admp.campaignCallback&cb=1704392914394&evid=&v=2.39
Requested by: Host: code3.adtlgc.com
URL: https://code3.adtlgc.com/js/sati_init.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.73.185.95 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-73-185-95.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: baee049272b23bef0a1a5f69bec303a844dc431d25607426aba9f49161e69be5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

P3P: policyref="http://code.adtlgc.com/w3c/p3p.xml",CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND COM NAV INT"
Date: Thu, 04 Jan 2024 18:28:35 GMT
Connection: keep-alive
Content-Length: 63
Content-Type: application/javascript

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 186ms
76ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:28:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 04 Jan 2024 18:28:35 GMT

GET
H2 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10679853082638024704/ Frame 2F77 63 KB
18 KB 107ms
61ms Document
text/html 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10679853082638024704/index.html

Requested by

Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f9bc53e00bea99757a28663cf200943e80220b83c9029d8da0058a7e9e10095e

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 573756
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 17246
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
cross-origin-resource-policy: cross-origin
date: Fri, 29 Dec 2023 03:05:59 GMT
expires: Sat, 28 Dec 2024 03:05:59 GMT
last-modified: Fri, 15 Dec 2023 15:01:32 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240102/r20110914/ Frame 76B1 23 KB
9 KB 93ms
42ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240102/r20110914/abg_lite_fy2021.js

Requested by

Host: 6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
URL: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

428f4d59e61cdf9887ad4cd7c4592a24b214d2d9c0ba09db01c4cfde66a3cd11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 19:23:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 83126
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9276
x-xss-protection: 0
server: cafe
etag: 3558958386372919956
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 17 Jan 2024 19:23:09 GMT

GET
H2 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 1AD5 143 B
247 B 43ms
31ms Document
text/html 2607:f8b0:4004:c17::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: 6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
URL: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::9c Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 1380
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 04 Jan 2024 18:05:35 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240102/r20110914/client/ Frame 76B1 3 KB
1 KB 91ms
43ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240102/r20110914/client/window_focus_fy2021.js

Requested by

Host: 6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
URL: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 19:23:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 83126
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 17 Jan 2024 19:23:09 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240102/r20110914/client/ Frame 76B1 20 KB
9 KB 86ms
39ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240102/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
URL: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2f764c969a82705ba7838239087f5ff9b33e978b6bae2657e299b6b14c30ad7f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 19:23:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 83126
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8523
x-xss-protection: 0
server: cafe
etag: 16500369019378894752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 17 Jan 2024 19:23:09 GMT

GET
H2 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/ Frame 7A27 66 KB
17 KB 46ms
41ms Document
text/html 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/index.html

Requested by

Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

90bf3920115ff68bd3d9dbec6ca7a1a1365dc185a95d9cd7e076dd84c35968ba

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 10157
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 17479
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
cross-origin-resource-policy: cross-origin
date: Thu, 04 Jan 2024 15:39:18 GMT
expires: Fri, 03 Jan 2025 15:39:18 GMT
last-modified: Thu, 03 Aug 2023 15:09:12 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240102/r20110914/ Frame 6253 23 KB
9 KB 34ms
31ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240102/r20110914/abg_lite_fy2021.js

Requested by

Host: 6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
URL: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

428f4d59e61cdf9887ad4cd7c4592a24b214d2d9c0ba09db01c4cfde66a3cd11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 19:23:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 83126
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9276
x-xss-protection: 0
server: cafe
etag: 3558958386372919956
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 17 Jan 2024 19:23:09 GMT

GET
H2 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame A054 143 B
200 B 36ms
32ms Document
text/html 2607:f8b0:4004:c17::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: 6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
URL: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::9c Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 1380
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 04 Jan 2024 18:05:35 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240102/r20110914/client/ Frame 6253 3 KB
1 KB 52ms
51ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240102/r20110914/client/window_focus_fy2021.js

Requested by

Host: 6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
URL: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 19:23:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 83126
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 17 Jan 2024 19:23:09 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240102/r20110914/client/ Frame 6253 20 KB
8 KB 37ms
36ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240102/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
URL: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2f764c969a82705ba7838239087f5ff9b33e978b6bae2657e299b6b14c30ad7f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 19:23:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 83126
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8523
x-xss-protection: 0
server: cafe
etag: 16500369019378894752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 17 Jan 2024 19:23:09 GMT

GET
H2 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/ Frame 2649 66 KB
17 KB 34ms
31ms Document
text/html 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/index.html

Requested by

Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

90bf3920115ff68bd3d9dbec6ca7a1a1365dc185a95d9cd7e076dd84c35968ba

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 10157
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 17479
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
cross-origin-resource-policy: cross-origin
date: Thu, 04 Jan 2024 15:39:18 GMT
expires: Fri, 03 Jan 2025 15:39:18 GMT
last-modified: Thu, 03 Aug 2023 15:09:12 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240102/r20110914/ Frame 1EB3 23 KB
9 KB 42ms
33ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240102/r20110914/abg_lite_fy2021.js

Requested by

Host: 6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
URL: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

428f4d59e61cdf9887ad4cd7c4592a24b214d2d9c0ba09db01c4cfde66a3cd11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 19:23:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 83126
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9276
x-xss-protection: 0
server: cafe
etag: 3558958386372919956
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 17 Jan 2024 19:23:09 GMT

GET
H2 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 4903 143 B
200 B 32ms
31ms Document
text/html 2607:f8b0:4004:c17::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: 6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
URL: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::9c Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 1380
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 04 Jan 2024 18:05:35 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240102/r20110914/client/ Frame 1EB3 3 KB
1 KB 48ms
42ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240102/r20110914/client/window_focus_fy2021.js

Requested by

Host: 6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
URL: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 19:23:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 83126
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 17 Jan 2024 19:23:09 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240102/r20110914/client/ Frame 1EB3 20 KB
8 KB 40ms
36ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240102/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
URL: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2f764c969a82705ba7838239087f5ff9b33e978b6bae2657e299b6b14c30ad7f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 19:23:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 83126
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8523
x-xss-protection: 0
server: cafe
etag: 16500369019378894752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 17 Jan 2024 19:23:09 GMT

GET
H3 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/ Frame A3B8 66 KB
17 KB 34ms
33ms Document
text/html 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/index.html

Requested by

Host: nktbxm.erufhvdjxc.tk
URL: https://nktbxm.erufhvdjxc.tk/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

90bf3920115ff68bd3d9dbec6ca7a1a1365dc185a95d9cd7e076dd84c35968ba

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 10157
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 17479
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
cross-origin-resource-policy: cross-origin
date: Thu, 04 Jan 2024 15:39:18 GMT
expires: Fri, 03 Jan 2025 15:39:18 GMT
last-modified: Thu, 03 Aug 2023 15:09:12 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240102/r20110914/ Frame 6293 23 KB
9 KB 32ms
30ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240102/r20110914/abg_lite_fy2021.js

Requested by

Host: 6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
URL: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

428f4d59e61cdf9887ad4cd7c4592a24b214d2d9c0ba09db01c4cfde66a3cd11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 19:23:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 83126
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9276
x-xss-protection: 0
server: cafe
etag: 3558958386372919956
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 17 Jan 2024 19:23:09 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame C2AC 143 B
166 B 49ms
47ms Document
text/html 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: 6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
URL: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 1380
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 04 Jan 2024 18:05:35 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240102/r20110914/client/ Frame 6293 3 KB
1 KB 63ms
62ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240102/r20110914/client/window_focus_fy2021.js

Requested by

Host: 6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
URL: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 19:23:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 83126
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 17 Jan 2024 19:23:09 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240102/r20110914/client/ Frame 6293 20 KB
8 KB 59ms
58ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240102/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
URL: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2f764c969a82705ba7838239087f5ff9b33e978b6bae2657e299b6b14c30ad7f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 19:23:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 83126
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8523
x-xss-protection: 0
server: cafe
etag: 16500369019378894752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 17 Jan 2024 19:23:09 GMT

GET
H2 200 publishertag.prebid.123.js Show response
static.criteo.net/js/ld/ 87 KB
28 KB 158ms
46ms Script
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.123.js

Requested by

Host: bctser343grh.giize.com
URL: https://bctser343grh.giize.com/wp-content/plugins/strawberry-ads-manager/js/prebid7.11.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

3af1a442285e2530e69db134638ec9305ab0abf88e5ef5248bb9b8f1903a8bd4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:28:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 06 Apr 2023 09:31:17 GMT
server: nginx
etag: W/"642e9165-15b5c"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 05 Jan 2024 18:28:35 GMT

GET
H3 200 Enabler.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 2F77 16 KB
6 KB 62ms
60ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/Enabler.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10679853082638024704/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5f0207bbbd69497c7a37284c0b6f9bdcc9f83c574a4cda737e00a390d0ed268f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 08:13:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 36910
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5660
x-xss-protection: 0
server: cafe
etag: 544157900006238945
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Fri, 05 Jan 2024 08:13:25 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 2F77 34 KB
13 KB 53ms
52ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10679853082638024704/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fee86fd46a67912ffd9ae2997c583f59abe6e11c532496c52759e94136837d48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 10:03:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30298
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13035
x-xss-protection: 0
server: cafe
etag: 2319883687766034370
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Fri, 05 Jan 2024 10:03:37 GMT

GET
H3 200 Enabler.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 7A27 16 KB
6 KB 34ms
31ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/Enabler.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5f0207bbbd69497c7a37284c0b6f9bdcc9f83c574a4cda737e00a390d0ed268f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 08:13:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 36910
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5660
x-xss-protection: 0
server: cafe
etag: 544157900006238945
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Fri, 05 Jan 2024 08:13:25 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 7A27 34 KB
13 KB 37ms
35ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fee86fd46a67912ffd9ae2997c583f59abe6e11c532496c52759e94136837d48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 10:03:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30298
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13035
x-xss-protection: 0
server: cafe
etag: 2319883687766034370
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Fri, 05 Jan 2024 10:03:37 GMT

GET
H3 200 Enabler.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 2649 16 KB
6 KB 42ms
36ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/Enabler.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5f0207bbbd69497c7a37284c0b6f9bdcc9f83c574a4cda737e00a390d0ed268f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 08:13:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 36910
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5660
x-xss-protection: 0
server: cafe
etag: 544157900006238945
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Fri, 05 Jan 2024 08:13:25 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 2649 34 KB
13 KB 42ms
39ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fee86fd46a67912ffd9ae2997c583f59abe6e11c532496c52759e94136837d48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 10:03:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30298
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13035
x-xss-protection: 0
server: cafe
etag: 2319883687766034370
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Fri, 05 Jan 2024 10:03:37 GMT

GET
H3 200 Enabler.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame A3B8 16 KB
6 KB 34ms
30ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/Enabler.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5f0207bbbd69497c7a37284c0b6f9bdcc9f83c574a4cda737e00a390d0ed268f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 08:13:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 36910
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5660
x-xss-protection: 0
server: cafe
etag: 544157900006238945
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Fri, 05 Jan 2024 08:13:25 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame A3B8 34 KB
13 KB 41ms
33ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fee86fd46a67912ffd9ae2997c583f59abe6e11c532496c52759e94136837d48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 10:03:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30298
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13035
x-xss-protection: 0
server: cafe
etag: 2319883687766034370
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Fri, 05 Jan 2024 10:03:37 GMT

GET
H/1.1 200
OK user Show response
admp-tc-sati.adtlgc.com/ 98 B
538 B 110ms
106ms Script
application/javascript 54.73.185.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://admp-tc-sati.adtlgc.com/user?nw=1&cm=0&sg=0&callback=adapt_dataRequest_sati_admp.validateCallback&cb=1704392915653&evid=cx:1c7yisw2i9n5q2gwu5ad0esx5c:3uwfou0dga871&v=2.39
Requested by: Host: code3.adtlgc.com
URL: https://code3.adtlgc.com/js/sati_init.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.73.185.95 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-73-185-95.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 1b1e0f89cc3654e768379dc0c8274f2f7839d26538d723e2689b8a7b4dc6fbec

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

P3P: policyref="http://code.adtlgc.com/w3c/p3p.xml",CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND COM NAV INT"
Date: Thu, 04 Jan 2024 18:28:35 GMT
Connection: keep-alive
Content-Length: 98
Content-Type: application/javascript

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame AD57 13 KB
5 KB 45ms
30ms Document
text/html 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nktbxm.erufhvdjxc.tk/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 18608
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 04 Jan 2024 13:18:27 GMT
expires: Fri, 03 Jan 2025 13:18:27 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame BDA9 829 B
1 KB 134ms
46ms Document
text/html 2607:f8b0:4004:c1b::67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::67 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

6ab3f1cc53fa2efd00fa4e6309337750fcb31a38d37db1ff03fda0df92064f40

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-65b1Nn96uRvGsjRUJIGbFg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://nktbxm.erufhvdjxc.tk/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-65b1Nn96uRvGsjRUJIGbFg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 04 Jan 2024 18:28:35 GMT
expires: Thu, 04 Jan 2024 18:28:35 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 76B1 204 KB
64 KB 49ms
47ms Script
text/javascript 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
URL: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8941597d26275d5e8775ac804bffb1d86f749d0cfe471777800a4543e4b65603

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:28:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65775
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1704286440049996"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 04 Jan 2024 18:28:35 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 1AD5
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

48ms
45ms

Document
text/html

2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: 6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
URL: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 04 Jan 2024 18:28:35 GMT
expires: Thu, 04 Jan 2024 18:28:35 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 04 Jan 2024 18:28:35 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6253 204 KB
64 KB 49ms
48ms Script
text/javascript 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
URL: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8941597d26275d5e8775ac804bffb1d86f749d0cfe471777800a4543e4b65603

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:28:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65775
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1704286440049996"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 04 Jan 2024 18:28:35 GMT

GET
DATA 200
OK truncated
/ Frame 6253 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3f9aa834f19088c2d976814bc53000102936354d3e3d438e63faa174c6bbb6aa

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame A054
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

54ms
51ms

Document
text/html

2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: 6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
URL: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 04 Jan 2024 18:28:35 GMT
expires: Thu, 04 Jan 2024 18:28:35 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 04 Jan 2024 18:28:35 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1EB3 204 KB
64 KB 43ms
35ms Script
text/javascript 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
URL: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8941597d26275d5e8775ac804bffb1d86f749d0cfe471777800a4543e4b65603

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:28:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65775
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1704286440049996"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 04 Jan 2024 18:28:35 GMT

GET
H2 200 jvU_Nce4LjU Show response
www.youtube.com/embed/ Frame 69C8 92 KB
41 KB 224ms
109ms Document
text/html 2607:f8b0:4004:c06::5d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/jvU_Nce4LjU?feature=oembed&rel=0&controls=0&showinfo=0&modestbranding=1&

Requested by

Host: bctser343grh.giize.com
URL: https://bctser343grh.giize.com/wp-content/plugins/strawberry-video-pop/assets/scripts/dist/assets/index.js?ver=1651817729

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::5d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e789cce2ee346a905104fbaba5ebc72923bd0303a896ac1d7f9850c43db6a318

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nktbxm.erufhvdjxc.tk/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: br
content-security-policy-report-only: base-uri 'self';default-src 'self' https: blob:;font-src https: data:;img-src https: data: android-webview-video-poster:;media-src blob: https:;object-src 'none';report-uri /cspreport/common;script-src 'report-sample' 'nonce-T2FMC7pWhPE-viC0DIqafg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';style-src https: 'unsafe-inline'
content-type: text/html; charset=utf-8
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
cross-origin-resource-policy: cross-origin
date: Thu, 04 Jan 2024 18:28:36 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
origin-trial: AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma: no-cache
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
server: ESF
strict-transport-security: max-age=31536000
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 39ms
34ms Image
image/gif 2607:f8b0:4004:c17::65
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1285927578&t=event&ni=1&_s=3&dl=https%3A%2F%2Fnktbxm.erufhvdjxc.tk%2F&ul=en-us&de=UTF-8&dt=%C8%98tiri%20despre%20industria%20auto%20%7C%20Nout%C4%83%C8%9Bi%20pentru%20pasiona%C8%9Bi%20%C8%99i%20teste%20auto%20%7C%20Promotor.ro&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=VideoPopup&ea=website&el=initialized&_u=aADAAUABAAAAACAAI~&jid=&gjid=&cid=917042226.1704392913&tid=UA-1684917-1&_gid=958181110.1704392913&gtm=457e4130&gcd=11l1l1l1l1&dma=0&jsscut=1&z=1189093540

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 03 Jan 2024 22:03:28 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 73507
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 4903
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

50ms
40ms

Document
text/html

2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: 6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
URL: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 04 Jan 2024 18:28:35 GMT
expires: Thu, 04 Jan 2024 18:28:35 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 04 Jan 2024 18:28:35 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6293 204 KB
64 KB 41ms
38ms Script
text/javascript 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
URL: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8941597d26275d5e8775ac804bffb1d86f749d0cfe471777800a4543e4b65603

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:28:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65775
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1704286440049996"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 04 Jan 2024 18:28:35 GMT

GET
DATA 200
OK truncated
/ Frame 76B1 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 526d74352d2daecca39c1ac61b16bbe7c7092fdf2ef07ddc0da4c4855476c369

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 6293 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e08610d4aad24b733cbcf8a9a9e7593354f3aab7a81b7b189b06a6ece4baf44b

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 1EB3 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e05d91b04735fbf9e5f05d330647147b0d9a6048a69e8a06d3f483bc9b63587c

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame C2AC
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

50ms
45ms

Document
text/html

2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: 6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
URL: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 04 Jan 2024 18:28:36 GMT
expires: Thu, 04 Jan 2024 18:28:36 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 04 Jan 2024 18:28:35 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame A1D4 14 KB
6 KB 138ms
38ms Document
text/html 2620:100:a001::c
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=nktbxm.erufhvdjxc.tk

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.123.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

c9a726fb5e408c905af5fa916e23740a283b9ab6f8adfa955a0b3b40e7c6cdf9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://nktbxm.erufhvdjxc.tk/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 04 Jan 2024 18:28:36 GMT
server: Kestrel
server-processing-duration-in-ticks: 637568
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 publishertag.prebid.123.js Show response
static.criteo.net/js/ld/ 87 KB
28 KB 176ms
78ms XHR
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.123.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.123.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

3af1a442285e2530e69db134638ec9305ab0abf88e5ef5248bb9b8f1903a8bd4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:28:36 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 06 Apr 2023 09:31:17 GMT
server: nginx
etag: W/"642e9165-15b5c"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 05 Jan 2024 18:28:36 GMT

GET
H/1.1 200
OK pagestat Show response
admp-tc-sati.adtlgc.com/event/v3/ 0
283 B 837ms
471ms XHR
image/jpeg 54.73.185.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://admp-tc-sati.adtlgc.com/event/v3/pagestat?location=https%3A%2F%2Fnktbxm.erufhvdjxc.tk%2F&cb=1704392916221&evid=cx:1c7yisw2i9n5q2gwu5ad0esx5c:3uwfou0dga871&v=2.39
Requested by: Host: code3.adtlgc.com
URL: https://code3.adtlgc.com/js/sati_init.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.73.185.95 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-73-185-95.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date: Thu, 04 Jan 2024 18:28:36 GMT
XDomainRequestAllowed: 1
Access-Control-Allow-Methods: *
Content-Type: image/jpeg
Access-Control-Allow-Origin: https://nktbxm.erufhvdjxc.tk
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0

GET
H2 200 segment Show response
api.cxense.com/profile/user/ 62 B
587 B 197ms
50ms Script
text/javascript 86.109.7.56
PACKET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.cxense.com/profile/user/segment?callback=cXJsonpCB3&persisted=993f7e91f41899181a61f3b6fa338bd436cdd1b7&json=%7B%22identities%22%3A%5B%7B%22id%22%3A%22lqzjj869v54b7vtc%22%2C%22type%22%3A%22cx%22%7D%5D%7D

Requested by

Host: scdn.cxense.com
URL: https://scdn.cxense.com/cx.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

86.109.7.56 Ashburn, United States, ASN54825 (PACKET, US),

Reverse DNS

Software

Jetty(9.4.28.v20200408) /

Resource Hash

776b93b99396bd35a9bc62f2ffe2cd9462e9f47296b99d49b39d6d1a4ade1d7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 Jan 2024 18:28:36 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
server: Jetty(9.4.28.v20200408)
content-type: text/javascript;charset=utf-8
p3p: policyref="http://www.cxense.com/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-store, no-cache, must-revalidate
content-length: 62
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 www-player.css
www.youtube.com/s/player/da154528/ Frame 69C8 358 KB
47 KB 46ms
39ms Stylesheet
text/css 2607:f8b0:4004:c06::5d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/da154528/www-player.css

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/jvU_Nce4LjU?feature=oembed&rel=0&controls=0&showinfo=0&modestbranding=1&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::5d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af17d4cff542b33c97ee3a95f82a21d8993c87fd3472dff534fa855828a3b615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.youtube.com/embed/jvU_Nce4LjU?feature=oembed&rel=0&controls=0&showinfo=0&modestbranding=1&
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:06:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1335
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 47436
x-xss-protection: 0
last-modified: Mon, 18 Dec 2023 02:48:13 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Fri, 03 Jan 2025 18:06:21 GMT

GET
H2 200 embed.js Show response
www.youtube.com/s/player/da154528/player_ias.vflset/en_US/ Frame 69C8 52 KB
16 KB 116ms
114ms Script
text/javascript 2607:f8b0:4004:c06::5d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/da154528/player_ias.vflset/en_US/embed.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/jvU_Nce4LjU?feature=oembed&rel=0&controls=0&showinfo=0&modestbranding=1&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::5d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

234595572b74d58cd52917208142b3131ad7992126358ee0d917a40cd1240e83

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.youtube.com/embed/jvU_Nce4LjU?feature=oembed&rel=0&controls=0&showinfo=0&modestbranding=1&
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:04:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1449
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16296
x-xss-protection: 0
last-modified: Mon, 18 Dec 2023 02:48:13 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Fri, 03 Jan 2025 18:04:27 GMT

GET
H2 200 www-embed-player.js Show response
www.youtube.com/s/player/da154528/www-embed-player.vflset/ Frame 69C8 322 KB
97 KB 71ms
69ms Script
text/javascript 2607:f8b0:4004:c06::5d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/da154528/www-embed-player.vflset/www-embed-player.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/jvU_Nce4LjU?feature=oembed&rel=0&controls=0&showinfo=0&modestbranding=1&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::5d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d854531f9c3833536d6971b4fd7617dafe1a2c6fd0bbed9469122e73ff3b13a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.youtube.com/embed/jvU_Nce4LjU?feature=oembed&rel=0&controls=0&showinfo=0&modestbranding=1&
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:15:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 771
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 98735
x-xss-protection: 0
last-modified: Mon, 18 Dec 2023 02:48:13 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Fri, 03 Jan 2025 18:15:45 GMT

GET
H2 200 base.js Show response
www.youtube.com/s/player/da154528/player_ias.vflset/en_US/ Frame 69C8 2 MB
767 KB 111ms
109ms Script
text/javascript 2607:f8b0:4004:c06::5d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/da154528/player_ias.vflset/en_US/base.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/jvU_Nce4LjU?feature=oembed&rel=0&controls=0&showinfo=0&modestbranding=1&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::5d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fd8d118fe8ac283b6e6ece58b4bcbbc06cd734f11761faa7c46ff08069f711f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.youtube.com/embed/jvU_Nce4LjU?feature=oembed&rel=0&controls=0&showinfo=0&modestbranding=1&
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 16:28:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7226
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 785283
x-xss-protection: 0
last-modified: Mon, 18 Dec 2023 02:48:13 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Fri, 03 Jan 2025 16:28:10 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://us-u.openx.net/w/1.0/pd?plm=6&ph=d59e8a19-e066-4bc5-b769-dabf5d619da8&gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDUxtGWeKrtMDgr3lQ_DgYA&google_cver=1

43 B
105 B

36ms
31ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDUxtGWeKrtMDgr3lQ_DgYA&google_cver=1
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nktbxm.erufhvdjxc.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 Jan 2024 18:28:36 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 04 Jan 2024 18:28:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDUxtGWeKrtMDgr3lQ_DgYA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 76B1
Redirect Chain

https://securepubads.g.doubleclick.net/pagead/adview?ai=ChjQu0fiWZerxKd2lzLUP9ciz4ArW0omRdejKjcLMEtzZHhABINnWrTtgye6Oi8CkjBCgAe3C2bUCyAEJ4AIAqAMByAMCqgSYAk_Q6eb_3kePxDG3TPZ13XlbkxghcxWYOxNvJwn_aYJW...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xc79023c585a0fdb50000000000000000%22,%222%22:%220x9315d12267a02030000000000000000%22,%223%22:%220x2312f51...

0
0

148ms
59ms

Fetch
text/css

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xc79023c585a0fdb50000000000000000%22,%222%22:%220x9315d12267a02030000000000000000%22,%223%22:%220x2312f51fe6dd93670000000000000000%22,%224%22:%220x3324e0a9a7c0a0390000000000000000%22,%225%22:%220xffdec4b2be5b32c90000000000000000%22},%22debug_key%22:%22305089656930691067%22,%22debug_reporting%22:true,%22destination%22:%22https://muscle-booster.io%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22649486701%22],%2222%22:[%22true%22],%224%22:[%2201-04%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2216597111550560931857%22}&andc=true

Protocol

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:28:37 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0xc79023c585a0fdb50000000000000000","2":"0x9315d12267a02030000000000000000","3":"0x2312f51fe6dd93670000000000000000","4":"0x3324e0a9a7c0a0390000000000000000","5":"0xffdec4b2be5b32c90000000000000000"},"debug_key":"305089656930691067","debug_reporting":true,"destination":"https://muscle-booster.io","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["649486701"],"22":["true"],"4":["01-04"],"6":["true"]},"priority":"500","source_event_id":"16597111550560931857"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: null
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 04 Jan 2024 18:28:37 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 04 Jan 2024 18:28:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0xc79023c585a0fdb50000000000000000","2":"0x9315d12267a02030000000000000000","3":"0x2312f51fe6dd93670000000000000000","4":"0x3324e0a9a7c0a0390000000000000000","5":"0xffdec4b2be5b32c90000000000000000"},"debug_key":"305089656930691067","debug_reporting":true,"destination":"https://muscle-booster.io","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["649486701"],"22":["true"],"4":["01-04"],"6":["true"]},"priority":"500","source_event_id":"16597111550560931857"}&andc=true
access-control-allow-origin: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

OPTIONS
H2 204 adview
securepubads.g.doubleclick.net/pagead/ Frame 0
0 60ms
58ms Preflight
text/html 2607:f8b0:4004:c1d::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/adview?ai=ChjQu0fiWZerxKd2lzLUP9ciz4ArW0omRdejKjcLMEtzZHhABINnWrTtgye6Oi8CkjBCgAe3C2bUCyAEJ4AIAqAMByAMCqgSYAk_Q6eb_3kePxDG3TPZ13XlbkxghcxWYOxNvJwn_aYJWI7Gk75Y7Rynhi-CN1AhgIj4I7i0FNHXMJKzJKdDgPZEylCm2LbpL9-NkROre6dk3lmSweAW9Cx8pni3zXC-a-LwOGj0jYsM92AZznInN0AFyrr9EJ0xbJn-XMKwwJtmlpcLYd0Wt0K0T-GugjSe1_24bt6bNtYktIwkKGRIQbxAyX8mSjOWLdQmfDUWVXbKn3Cin3o_gTmOhiaC7x-55ykBK46UF_uyKT2jmz4vl99zRzdPuUokLlAW_AVYHK9k99p-topS_jPkKzs_U1wMPPXZd-mh7o6SwXTzLrfIgE0TDy_kykawbqkML3dBvozk-GrXNG5vwGGjABIvZ0srDBOAEAYgF1bvwu02SBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGXYAH-7ymygGoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAfIHBBDkyAbSCCEIgOGAYBABGB0yAssCOgSAQIBASL39wTpYs_2zsa7EgwOaCcoBaHR0cHM6Ly9tdXNjbGUtYm9vc3Rlci5pbz9icmFuY2gtbmFtZT1nb29nbGUmdGVzdC1uYW1lPWdvNHRpayZ1dG1fc291cmNlPWdvb2dsZSZ1dG1fbWVkaXVtPWNwYyZjYW1wYWlnbl9pZD0yMDc5NTEwNDcyNSZhZGdyb3VwX2lkPTE1NTU4MDY3MzE2MyZhZF9pZD02ODU4NDk4MDIxMzkmdXRtX3Rlcm09JnBsYWNlbWVudD1ua3RieG0uZXJ1Zmh2ZGp4Yy50a4AKA8gLAaIMECoOCgzktLEC7rWxArW4sQLaDBEKCxDA0Nebw--oj8cBEgIBA-INEwigvrSxrsSDAxXdErMAHXXkDKzYEwzQFQGYFgGAFwGyFx4KHAgAEhRwdWItODgyOTU0OTc2OTY4MTc3ORjxkiA&sigh=lwcstGvUIg8&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTwAvHhf_03XVYoYsak87JzCU8oDVAPBqvoCkBGGvhfce9nAOcgH5EFjWLb5BjvtLM3ui09PAfsd-sHvWsrk_dlPFsmse9eL1IK1hGXe77xoYAQ&cbvp=2&vis=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 04 Jan 2024 18:28:36 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 69C8 15 KB
15 KB 33ms
31ms Font
font/woff2 2607:f8b0:4004:c09::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/jvU_Nce4LjU?feature=oembed&rel=0&controls=0&showinfo=0&modestbranding=1&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
Origin: https://www.youtube.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 00:55:49 GMT
x-content-type-options: nosniff
age: 149567
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 02 Jan 2025 00:55:49 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 69C8 15 KB
15 KB 47ms
46ms Font
font/woff2 2607:f8b0:4004:c09::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/jvU_Nce4LjU?feature=oembed&rel=0&controls=0&showinfo=0&modestbranding=1&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
Origin: https://www.youtube.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 06:43:14 GMT
x-content-type-options: nosniff
age: 128722
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15552
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 02 Jan 2025 06:43:14 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame BDA9 0
0 132ms
50ms Image
text/html 2607:f8b0:4004:c1b::9c
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202312070101&jk=1403791045230369&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c1b::9c Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

GET
H2

200

sid Show response
mug.criteo.com/ Frame A1D4
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=erufhvdjxc.tk&sn=ChromeSyncframe&so=0&topUrl=nktbxm.erufhvdjxc.tk&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=pIupdHxOYkhFNFA4WmdpQW1YS0tJeExwWEZJWE9aVFoyOUNWSHhmRTBpSndCTFdhSXQxVU5GTklpUE9wcUFCOEdvYzJoNzRUNmZWYVluSTBQck5uSmVMRzBzcjJLOFJFOTJYUE9PcTFCenZqNzlxQnJNaUVaSDRaKzVmbm...

446 B
1 KB

166ms
35ms

Fetch
application/json

74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=pIupdHxOYkhFNFA4WmdpQW1YS0tJeExwWEZJWE9aVFoyOUNWSHhmRTBpSndCTFdhSXQxVU5GTklpUE9wcUFCOEdvYzJoNzRUNmZWYVluSTBQck5uSmVMRzBzcjJLOFJFOTJYUE9PcTFCenZqNzlxQnJNaUVaSDRaKzVmbmh0N1RXWDIxdmErMmFkRlhXMmdaYXZhODZISCttN01iSklxNmxCdStrM2x3ZlI3TTRYSlhkSlVPNDVRcFhzY2h0RDN6MmMzcm9KeEU2UFFQbnF4eE5YWmVUZGNTUTJFaksrUHFJU3hneWROK1B1TmNIbkd4eThGRUJVbmZOZWN0bEFUcnhFQWZmUElCbm54Si9sdG93UkVlOFZ4MExXY0xmaURKVHpCUnJOOTdXRnBYckdnTT18&cppv=2

Protocol

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

ce715dabfdf44dc6261eae55024ae94b99205de63bd16f0994378dd105a25a35

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 Jan 2024 18:28:35 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1568382
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 04 Jan 2024 18:28:36 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=pIupdHxOYkhFNFA4WmdpQW1YS0tJeExwWEZJWE9aVFoyOUNWSHhmRTBpSndCTFdhSXQxVU5GTklpUE9wcUFCOEdvYzJoNzRUNmZWYVluSTBQck5uSmVMRzBzcjJLOFJFOTJYUE9PcTFCenZqNzlxQnJNaUVaSDRaKzVmbmh0N1RXWDIxdmErMmFkRlhXMmdaYXZhODZISCttN01iSklxNmxCdStrM2x3ZlI3TTRYSlhkSlVPNDVRcFhzY2h0RDN6MmMzcm9KeEU2UFFQbnF4eE5YWmVUZGNTUTJFaksrUHFJU3hneWROK1B1TmNIbkd4eThGRUJVbmZOZWN0bEFUcnhFQWZmUElCbm54Si9sdG93UkVlOFZ4MExXY0xmaURKVHpCUnJOOTdXRnBYckdnTT18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 272450
content-length: 0
expires: 0

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 6253
Redirect Chain

https://securepubads.g.doubleclick.net/pagead/adview?ai=CYMFL0fiWZenxKd2lzLUP9ciz4ArW0omRdfiaw5TpEdzZHhABINnWrTtgye6Oi8CkjBCgAe3C2bUCyAEJ4AIAqAMByAMCqgSVAk_QpkPdIMknIs5wj7IdMBVDG8HCFfnLWyWdkelDe17j...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xc79023c585a0fdb50000000000000000%22,%222%22:%220x9315d12267a02030000000000000000%22,%223%22:%220x2312f51...

0
0

149ms
60ms

Fetch
text/css

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xc79023c585a0fdb50000000000000000%22,%222%22:%220x9315d12267a02030000000000000000%22,%223%22:%220x2312f51fe6dd93670000000000000000%22,%224%22:%220x3324e0a9a7c0a0390000000000000000%22,%225%22:%220xffdec4b2be5b32c90000000000000000%22},%22debug_key%22:%224050891642713061786%22,%22debug_reporting%22:true,%22destination%22:%22https://muscle-booster.io%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22649486701%22],%2222%22:[%22true%22],%224%22:[%2201-04%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2216619391764554755425%22}&andc=true

Protocol

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:28:37 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0xc79023c585a0fdb50000000000000000","2":"0x9315d12267a02030000000000000000","3":"0x2312f51fe6dd93670000000000000000","4":"0x3324e0a9a7c0a0390000000000000000","5":"0xffdec4b2be5b32c90000000000000000"},"debug_key":"4050891642713061786","debug_reporting":true,"destination":"https://muscle-booster.io","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["649486701"],"22":["true"],"4":["01-04"],"6":["true"]},"priority":"500","source_event_id":"16619391764554755425"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: null
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 04 Jan 2024 18:28:37 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 04 Jan 2024 18:28:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0xc79023c585a0fdb50000000000000000","2":"0x9315d12267a02030000000000000000","3":"0x2312f51fe6dd93670000000000000000","4":"0x3324e0a9a7c0a0390000000000000000","5":"0xffdec4b2be5b32c90000000000000000"},"debug_key":"4050891642713061786","debug_reporting":true,"destination":"https://muscle-booster.io","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["649486701"],"22":["true"],"4":["01-04"],"6":["true"]},"priority":"500","source_event_id":"16619391764554755425"}&andc=true
access-control-allow-origin: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

OPTIONS
H3 204 adview
securepubads.g.doubleclick.net/pagead/ Frame 0
0 51ms
47ms Preflight
text/html 2607:f8b0:4004:c1d::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/adview?ai=CYMFL0fiWZenxKd2lzLUP9ciz4ArW0omRdfiaw5TpEdzZHhABINnWrTtgye6Oi8CkjBCgAe3C2bUCyAEJ4AIAqAMByAMCqgSVAk_QpkPdIMknIs5wj7IdMBVDG8HCFfnLWyWdkelDe17j5N8Nnt9OR7zNH0WxtxZl0f2IX0SKF9g0MvQHUAuheK0lHkCLArXoKLDb0BQzYH1TFFBL8smsef99z6KvQlbB-jExYWOe3X_1ATXGzmmmlNP3edoFCqjTasXVKWxy3BmoqMzc8ltTRrTrrte7g1AB83-Ka_7OgDSMph9nHRbxOJEDTCa-MuCYrf91x5TdC7Qh_LVglW6CtmOIAHFRVJ9ayJmS4ILoL5tIDFF3CP5w9nierUIF5JziRFCFQxQJ5H67RSJT1VHURhRh_UXKUq_eesdeMm_GfRfJ--uaBF838rpPoWZAsnpCsJYR1VPXZSFpD3UY9e_ABIvZ0srDBOAEAYgF1bvwu02SBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGXYAH-7ymygGoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAfIHBBDYlQfSCCEIgOGAYBABGB0yAssCOgSAQIBASL39wTpYs_2zsa7EgwOaCcoBaHR0cHM6Ly9tdXNjbGUtYm9vc3Rlci5pbz9icmFuY2gtbmFtZT1nb29nbGUmdGVzdC1uYW1lPWdvNHRpayZ1dG1fc291cmNlPWdvb2dsZSZ1dG1fbWVkaXVtPWNwYyZjYW1wYWlnbl9pZD0yMDc5NTEwNDcyNSZhZGdyb3VwX2lkPTE1NTU4MDY3MzE2MyZhZF9pZD02ODIwODgzODAyODUmdXRtX3Rlcm09JnBsYWNlbWVudD1ua3RieG0uZXJ1Zmh2ZGp4Yy50a4AKA8gLAaIMECoOCgzktLEC7rWxArW4sQLaDBEKCxCA_5eMvJymwosBEgIBA-INEwifvrSxrsSDAxXdErMAHXXkDKzYEwyIFAHQFQGYFgGAFwGyFx4KHAgAEhRwdWItODgyOTU0OTc2OTY4MTc3ORjxkiA&sigh=MrWjfjMs-I4&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTwAvHhf_03XVYoYsak87JzCU8oDVAPBqvoCkBGGvhfce9nAOcgH5EFjWLb5BjvtLM3ui09PAfsd-sHvWsrk_dlPFsmse9eL1IK1hGXe77xoYAQ&cbvp=2&vis=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1d::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 04 Jan 2024 18:28:36 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H3 204 adview
securepubads.g.doubleclick.net/pagead/ Frame 0
0 53ms
51ms Preflight
text/html 2607:f8b0:4004:c1d::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/adview?ai=C5l6e0fiWZezxKd2lzLUP9ciz4ArW0omRdfiaw5TpEdzZHhABINnWrTtgye6Oi8CkjBCgAe3C2bUCyAEJ4AIAqAMByAMCqgSVAk_Qt4asT_dxTEmf6GzmIHTpyrone6_kDTb8bXUiGwA3jyWd3841PAXz_fa-ms4sXyFvUDwvi68Pr_txe3POmfNPYeCPwO5_KQeX6Rue8A3KJMNoA96dSFUgWxrvAj6GEPvneyAHl9EGa-0maNzn_m5XGOT3CKoc_P-B2eBRmGKxgGYTDQrhsKZLDBooq8Mylj_dxoIddgehWo8aoaz0AQ6BLMW9XK20h9vsgMK4-j9iZWERKrEAPKboVWdd3--avmHwhYuh4u_Y3sUE0DgSNEhwOqlBOlPMedCj31nV2_F-oQZLc8RQlSrnXek1agnKx3-zkTpPywOy5kfZrOcWi6QhxCUqa9ugkdC91xBPDF3DQ6xwCMDABIvZ0srDBOAEAYgF1bvwu02SBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGXYAH-7ymygGoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAfIHBBCs0QfSCCEIgOGAYBABGB0yAssCOgSAQIBASL39wTpYs_2zsa7EgwOaCcoBaHR0cHM6Ly9tdXNjbGUtYm9vc3Rlci5pbz9icmFuY2gtbmFtZT1nb29nbGUmdGVzdC1uYW1lPWdvNHRpayZ1dG1fc291cmNlPWdvb2dsZSZ1dG1fbWVkaXVtPWNwYyZjYW1wYWlnbl9pZD0yMDc5NTEwNDcyNSZhZGdyb3VwX2lkPTE1NTU4MDY3MzE2MyZhZF9pZD02ODIwODgzODAyODUmdXRtX3Rlcm09JnBsYWNlbWVudD1ua3RieG0uZXJ1Zmh2ZGp4Yy50a4AKA8gLAaIMECoOCgzktLEC7rWxArW4sQLaDBEKCxCQ35qwuLaG49IBEgIBA-INEwiivrSxrsSDAxXdErMAHXXkDKzYEwyIFAHQFQGYFgGAFwGyFx4KHAgAEhRwdWItODgyOTU0OTc2OTY4MTc3ORjxkiA&sigh=qz2c5t0n0hg&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTwAvHhf_03XVYoYsak87JzCU8oDVAPBqvoCkBGGvhfce9nAOcgH5EFjWLb5BjvtLM3ui09PAfsd-sHvWsrk_dlPFsmse9eL1IK1hGXe77xoYAQ&cbvp=2&vis=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1d::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 04 Jan 2024 18:28:36 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 1EB3
Redirect Chain

https://securepubads.g.doubleclick.net/pagead/adview?ai=C5l6e0fiWZezxKd2lzLUP9ciz4ArW0omRdfiaw5TpEdzZHhABINnWrTtgye6Oi8CkjBCgAe3C2bUCyAEJ4AIAqAMByAMCqgSVAk_Qt4asT_dxTEmf6GzmIHTpyrone6_kDTb8bXUiGwA3...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xc79023c585a0fdb50000000000000000%22,%222%22:%220x9315d12267a02030000000000000000%22,%223%22:%220x2312f51...

0
0

150ms
61ms

Fetch
text/css

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xc79023c585a0fdb50000000000000000%22,%222%22:%220x9315d12267a02030000000000000000%22,%223%22:%220x2312f51fe6dd93670000000000000000%22,%224%22:%220x3324e0a9a7c0a0390000000000000000%22,%225%22:%220xffdec4b2be5b32c90000000000000000%22},%22debug_key%22:%2210289492195848903407%22,%22debug_reporting%22:true,%22destination%22:%22https://muscle-booster.io%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22649486701%22],%2222%22:[%22true%22],%224%22:[%2201-04%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2218176101466545602129%22}&andc=true

Protocol

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:28:37 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0xc79023c585a0fdb50000000000000000","2":"0x9315d12267a02030000000000000000","3":"0x2312f51fe6dd93670000000000000000","4":"0x3324e0a9a7c0a0390000000000000000","5":"0xffdec4b2be5b32c90000000000000000"},"debug_key":"10289492195848903407","debug_reporting":true,"destination":"https://muscle-booster.io","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["649486701"],"22":["true"],"4":["01-04"],"6":["true"]},"priority":"500","source_event_id":"18176101466545602129"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: null
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 04 Jan 2024 18:28:37 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 04 Jan 2024 18:28:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0xc79023c585a0fdb50000000000000000","2":"0x9315d12267a02030000000000000000","3":"0x2312f51fe6dd93670000000000000000","4":"0x3324e0a9a7c0a0390000000000000000","5":"0xffdec4b2be5b32c90000000000000000"},"debug_key":"10289492195848903407","debug_reporting":true,"destination":"https://muscle-booster.io","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["649486701"],"22":["true"],"4":["01-04"],"6":["true"]},"priority":"500","source_event_id":"18176101466545602129"}&andc=true
access-control-allow-origin: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 6293
Redirect Chain

https://securepubads.g.doubleclick.net/pagead/adview?ai=C2iWK0fiWZevxKd2lzLUP9ciz4ArW0omRdfiaw5TpEdzZHhABINnWrTtgye6Oi8CkjBCgAe3C2bUCyAEJ4AIAqAMByAMCqgSYAk_QqQYg6uKpbNZkF_QKMs8CF85esnjR-NidpVWuye1-...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xc79023c585a0fdb50000000000000000%22,%222%22:%220x9315d12267a02030000000000000000%22,%223%22:%220x2312f51...

0
0

147ms
57ms

Fetch
text/css

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xc79023c585a0fdb50000000000000000%22,%222%22:%220x9315d12267a02030000000000000000%22,%223%22:%220x2312f51fe6dd93670000000000000000%22,%224%22:%220x3324e0a9a7c0a0390000000000000000%22,%225%22:%220xffdec4b2be5b32c90000000000000000%22},%22debug_key%22:%225471005407814811956%22,%22debug_reporting%22:true,%22destination%22:%22https://muscle-booster.io%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22649486701%22],%2222%22:[%22true%22],%224%22:[%2201-04%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%226901389392985416289%22}&andc=true

Protocol

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 18:28:37 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0xc79023c585a0fdb50000000000000000","2":"0x9315d12267a02030000000000000000","3":"0x2312f51fe6dd93670000000000000000","4":"0x3324e0a9a7c0a0390000000000000000","5":"0xffdec4b2be5b32c90000000000000000"},"debug_key":"5471005407814811956","debug_reporting":true,"destination":"https://muscle-booster.io","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["649486701"],"22":["true"],"4":["01-04"],"6":["true"]},"priority":"500","source_event_id":"6901389392985416289"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: null
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 04 Jan 2024 18:28:37 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 04 Jan 2024 18:28:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0xc79023c585a0fdb50000000000000000","2":"0x9315d12267a02030000000000000000","3":"0x2312f51fe6dd93670000000000000000","4":"0x3324e0a9a7c0a0390000000000000000","5":"0xffdec4b2be5b32c90000000000000000"},"debug_key":"5471005407814811956","debug_reporting":true,"destination":"https://muscle-booster.io","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["649486701"],"22":["true"],"4":["01-04"],"6":["true"]},"priority":"500","source_event_id":"6901389392985416289"}&andc=true
access-control-allow-origin: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

OPTIONS
H3 204 adview
securepubads.g.doubleclick.net/pagead/ Frame 0
0 50ms
49ms Preflight
text/html 2607:f8b0:4004:c1d::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/adview?ai=C2iWK0fiWZevxKd2lzLUP9ciz4ArW0omRdfiaw5TpEdzZHhABINnWrTtgye6Oi8CkjBCgAe3C2bUCyAEJ4AIAqAMByAMCqgSYAk_QqQYg6uKpbNZkF_QKMs8CF85esnjR-NidpVWuye1-R_muwtDT8JLZ8-YJjhKwS3XHAyKjq3ONEOuzekqihxeK4NwNp3DrHWo2d5b-ve6EEfuKXJVl5nKJwCvQSDA1OCx9JoTbu21yxWsmhh5yxCwDBqx5zIqrxzlc4g5dK04KEFS5BeEfX35Liq7IcGyWemXlWeq0z2bb5N5DIbkh_kAv6X93-3OwfcmilbWVaTdaxrapBpyvYo_mFnCORw6l_rAW4V6TKENyttos1uMMANTyYUGzoCaVesn1ZckQeSA19eQCKcUMAyckRGFwXbqW0dEiiQ6lO9leSUkVmNooTKdFTbo4pQ5JB1yIbw_pEbMlPv1F4Ogjb47ABIvZ0srDBOAEAYgF1bvwu02SBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGXYAH-7ymygGoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAfIHBBDzvgXSCCEIgOGAYBABGB0yAssCOgSAQIBASL39wTpYs_2zsa7EgwOaCcoBaHR0cHM6Ly9tdXNjbGUtYm9vc3Rlci5pbz9icmFuY2gtbmFtZT1nb29nbGUmdGVzdC1uYW1lPWdvNHRpayZ1dG1fc291cmNlPWdvb2dsZSZ1dG1fbWVkaXVtPWNwYyZjYW1wYWlnbl9pZD0yMDc5NTEwNDcyNSZhZGdyb3VwX2lkPTE1NTU4MDY3MzE2MyZhZF9pZD02ODIwODgzODAyODUmdXRtX3Rlcm09JnBsYWNlbWVudD1ua3RieG0uZXJ1Zmh2ZGp4Yy50a4AKA8gLAaIMECoOCgzktLEC7rWxArW4sQLaDBEKCxCg37O27eiKlfoBEgIBA-INEwihvrSxrsSDAxXdErMAHXXkDKzYEwyIFAHQFQGYFgGAFwGyFx4KHAgAEhRwdWItODgyOTU0OTc2OTY4MTc3ORjxkiA&sigh=5Lj-rME3Za0&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTwAvHhf_03XVYoYsak87JzCU8oDVAPBqvoCkBGGvhfce9nAOcgH5EFjWLb5BjvtLM3ui09PAfsd-sHvWsrk_dlPFsmse9eL1IK1hGXe77xoYAQ&cbvp=2&vis=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1d::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://6380550cde79a911b66683613c85c4de.safeframe.googlesyndication.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 04 Jan 2024 18:28:36 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame AD57 39 KB
15 KB 36ms
35ms Script
text/javascript 2607:f8b0:4004:c1b::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9c Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 16:13:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8084
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 03 Jan 2025 16:13:52 GMT

GET
H3 200 Gif_580x400.gif
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/ Frame 2649 112 KB
112 KB 44ms
37ms Image
image/gif 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/Gif_580x400.gif

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f1f705868d07c3fd89763a188a28939b4d6ce1cc378baedfb6b0e31730af6b15

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

expires: Sat, 28 Dec 2024 04:19:47 GMT
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Fri, 29 Dec 2023 04:19:47 GMT
x-content-type-options: nosniff
age: 569329
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 114570
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 15:09:12 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 Gif_300x600.gif
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/ Frame 2649 86 KB
86 KB 76ms
71ms Image
image/gif 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/Gif_300x600.gif

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

17e9a80fc037a2de2e346c9ac9f254ab40ae062e40c3752f18602f1bcd35ee0d

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

expires: Sun, 29 Dec 2024 04:34:38 GMT
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Sat, 30 Dec 2023 04:34:38 GMT
x-content-type-options: nosniff
age: 482038
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 87580
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 15:09:12 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 Gif_300x250.gif
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/ Frame 2649 84 KB
84 KB 61ms
58ms Image
image/gif 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/Gif_300x250.gif

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f4ba52df6ac4bb8f27313558b0efe12978b26f91c3111c658209811be4c7fa53

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

expires: Thu, 02 Jan 2025 00:55:55 GMT
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Wed, 03 Jan 2024 00:55:55 GMT
x-content-type-options: nosniff
age: 149561
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 86332
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 15:09:12 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 Gif_970x250.gif
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/ Frame 2649 114 KB
114 KB 37ms
33ms Image
image/gif 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/Gif_970x250.gif

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f4d2291cc51c536e5ca55c1496e5284297881904ebe5846df665bf60d1ed50cf

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

expires: Tue, 31 Dec 2024 01:19:36 GMT
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Mon, 01 Jan 2024 01:19:36 GMT
x-content-type-options: nosniff
age: 320940
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 117050
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 15:09:12 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 Gif_728x90.gif
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/ Frame 2649 72 KB
72 KB 63ms
60ms Image
image/gif 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/Gif_728x90.gif

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

634189abf2e5670bc5d195312c5b9b6ab113473b6391f04d30f3e1805e71b565

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

expires: Wed, 01 Jan 2025 20:17:11 GMT
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Tue, 02 Jan 2024 20:17:11 GMT
x-content-type-options: nosniff
age: 166285
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 73875
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 15:09:12 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 Gif_320x480.gif
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/ Frame 2649 109 KB
109 KB 54ms
51ms Image
image/gif 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16508777165672677376/Gif_320x480.gif

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5bfa45b76a6f62ecfe2700d20f02dddc25eb5ab086e1cd9b2194ee8c9ddfe880

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

expires: Fri, 03 Jan 2025 00:51:34 GMT
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Thu, 04 Jan 2024 00:51:34 GMT
x-content-type-options: nosniff
age: 63422
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 111587
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 15:09:12 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 170ms
55ms Preflight
text/html 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 04 Jan 2024 18:28:36 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 101ms
59ms Preflight
text/html 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xc79023c585a0fdb50000000000000000%22,%222%22:%220x9315d12267a02030000000000000000%22,%223%22:%220x2312f51fe6dd93670000000000000000%22,%224%22:%220x3324e0a9a7c0a0390000000000000000%22,%225%22:%220xffdec4b2be5b32c90000000000000000%22},%22debug_key%22:%2210289492195848903407%22,%22debug_reporting%22:true,%22destination%22:%22https://muscle-booster.io%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22649486701%22],%2222%22:[%22true%22],%224%22:[%2201-04%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2218176101466545602129%22}&andc=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 04 Jan 2024 18:28:36 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 97ms
55ms Preflight
text/html 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xc79023c585a0fdb50000000000000000%22,%222%22:%220x9315d12267a02030000000000000000%22,%223%22:%220x2312f51fe6dd93670000000000000000%22,%224%22:%220x3324e0a9a7c0a0390000000000000000%22,%225%22:%220xffdec4b2be5b32c90000000000000000%22},%22debug_key%22:%224050891642713061786%22,%22debug_reporting%22:true,%22destination%22:%22https://muscle-booster.io%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22649486701%22],%2222%22:[%22true%22],%224%22:[%2201-04%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2216619391764554755425%22}&andc=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 04 Jan 2024 18:28:36 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 93ms
53ms Preflight
text/html 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xc79023c585a0fdb50000000000000000%22,%222%22:%220x9315d12267a02030000000000000000%22,%223%22:%220x2312f51fe6dd93670000000000000000%22,%224%22:%220x3324e0a9a7c0a0390000000000000000%22,%225%22:%220xffdec4b2be5b32c90000000000000000%22},%22debug_key%22:%225471005407814811956%22,%22debug_reporting%22:true,%22destination%22:%22https://muscle-booster.io%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22649486701%22],%2222%22:[%22true%22],%224%22:[%2201-04%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%226901389392985416289%22}&andc=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS