www.bg3.co Open in urlscan Pro
84.17.37.44 Public Scan

Software

sffe /

Resource Hash

188e573bf1e6355ef4c477989d3871b5bad7e45ac71628ad3a3139284b1e0229

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Fri, 11 Nov 2022 04:46:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 72561
x-xss-protection: 0
server: sffe
etag: "8c5dc74afc4fee5e"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3000, stale-while-revalidate=1206600
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 11 Nov 2022 04:46:22 GMT

GET
H2 200 amp-sidebar-0.1.js Show response
cdn.ampproject.org/v0/ 31 KB
11 KB 822ms
274ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-sidebar-0.1.js

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a6b050dfbee40d9b3dec339c654771ddd057faa8cec3cb3ae9b5b03be10f50f

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Fri, 11 Nov 2022 04:46:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9659
x-xss-protection: 0
server: sffe
etag: "4254571f41355952"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=604800, stale-while-revalidate=604800
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 11 Nov 2022 04:46:22 GMT

GET
H2 200 amp-auto-ads-0.1.js Show response
cdn.ampproject.org/v0/ 24 KB
7 KB 1488ms
960ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-auto-ads-0.1.js

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ec587886fb7850e267d7d17b2c4611caa8b798b95fbacf7a3a6b77f42c848c65

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Fri, 11 Nov 2022 04:46:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7581
x-xss-protection: 0
server: sffe
etag: "39279299a806cd29"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=604800, stale-while-revalidate=604800
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 11 Nov 2022 04:46:22 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/v0/ 109 KB
31 KB 1375ms
847ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-analytics-0.1.js

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3e473d479b570c98cb31c0e98bb2d7ae6284dbfd0e2631bfa4718b9157fdf8d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Fri, 11 Nov 2022 04:46:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31984
x-xss-protection: 0
server: sffe
etag: "1fa26b097e24ff6d"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=604800, stale-while-revalidate=604800
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 11 Nov 2022 04:46:22 GMT

GET
H2

200

sdk Show response
cdn.aralego.net/ucfad/sdk/apac-sg/
Redirect Chain

https://ads.aralego.com/sdk
https://cdn.aralego.net/ucfad/sdk/apac-sg/sdk

43 KB
44 KB

442ms
150ms

Script
application/octet-stream

172.67.71.254
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.aralego.net/ucfad/sdk/apac-sg/sdk
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Server: 172.67.71.254 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 38684b802d56c90d11d131fcf8c291f934e69eaa38e55d8dc860244dde65462c

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:22 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4278
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44539
last-modified: Thu, 27 Oct 2022 03:15:18 GMT
server: cloudflare
etag: "6359f7c6-adfb"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4ySqyN1iBGv%2F8BZurnDGWFDQnBQ6Tuq%2B%2BkQEOmQ%2Bo0%2F%2Bz8%2FAFdT7LO%2BrKmI1CdDQvglPQjL5WlKPjzPQVpX%2B9D%2FnXaijybw80ZoxEjE1LVvcnty6iV%2BXw9yxBoEn7Pm9fg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream
cache-control: max-age=14400
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 768462406ac65527-SYD

Redirect headers

Location: https://cdn.aralego.net/ucfad/sdk/apac-sg/sdk
Connection: close
Content-length: 0

GET
H2 200 adRecover.js Show response
delivery.adrecover.com/43519/ 34 KB
9 KB 1421ms
363ms Script
application/javascript 42.99.140.201
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to

Full URL: https://delivery.adrecover.com/43519/adRecover.js
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 42.99.140.201 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),
Reverse DNS: ip-42-99-140-201.pacnet.net
Software: nginx/1.18.0 /
Resource Hash: 91e8bd3a37b3a0951444714dc07c68417ac878ebf22d8c7b0d10b1ce3fec1122

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: NZ
date: Fri, 11 Nov 2022 04:46:22 GMT
content-encoding: br
last-modified: Thu, 10 Nov 2022 07:00:33 GMT
server: nginx/1.18.0
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=2
x-cf-geodata: NZ
content-length: 9035
expires: Fri, 11 Nov 2022 05:46:22 GMT

GET
H2 200 adpushup.js Show response
cdn.adpushup.com/42753/ 867 KB
191 KB 1422ms
364ms Script
application/javascript 42.99.140.200
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/42753/adpushup.js
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 42.99.140.200 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),
Reverse DNS: ip-42-99-140-200.pacnet.net
Software: nginx/1.18.0 /
Resource Hash: 0e74fbb4c49a44d222a938012bf4284b6f9484ceb05c828d39b7c84828f1629e

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: NZ
date: Fri, 11 Nov 2022 04:46:22 GMT
content-encoding: br
last-modified: Thu, 03 Nov 2022 17:05:29 GMT
server: nginx/1.18.0
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=3
x-cf-geodata: NZ
content-length: 194623
expires: Fri, 11 Nov 2022 05:46:22 GMT

GET
H2 403 87c12c70fd389c55ad1838831f0a3095.jpg
static.bg3.co/imgs/202107/ 0
0 457ms
147ms Image
text/html 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202107/87c12c70fd389c55ad1838831f0a3095.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 f66c2d671ec974f90c0e6b12f16d3f47.jpg
static.bg3.co/imgs/202105/ 0
0 465ms
156ms Image
text/html 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/f66c2d671ec974f90c0e6b12f16d3f47.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 2903020e72dc7d1ad48c823b7463f689.jpg
static.bg3.co/imgs/202106/ 0
0 460ms
150ms Image
text/html 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202106/2903020e72dc7d1ad48c823b7463f689.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 a8cac3fb2652faad2976d7ffd0ee3df0.jpg
static.bg3.co/imgs/202105/ 0
0 484ms
175ms Image
text/html 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/a8cac3fb2652faad2976d7ffd0ee3df0.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 7c15b1e80afcf070b12fe085f029f54f.jpg
static.bg3.co/imgs/202204/ 0
0 459ms
162ms Image
text/html 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202204/7c15b1e80afcf070b12fe085f029f54f.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 d6fe192b9cc33d86bc57e31b4d8ff3e9.jpg
static.bg3.co/imgs/202105/ 0
0 465ms
169ms Image
text/html 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/d6fe192b9cc33d86bc57e31b4d8ff3e9.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 4fc60beee0b6caac8dd8a977c74d73fe.jpg
static.bg3.co/imgs/202105/ 0
0 479ms
182ms Image
text/html 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/4fc60beee0b6caac8dd8a977c74d73fe.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 b7cc00b0090729936c48b4532de0145f.jpg
static.bg3.co/imgs/202105/ 0
0 155ms
155ms Image
text/html 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/b7cc00b0090729936c48b4532de0145f.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 8e542c101e21ec7ab539d4ff2b0add65.jpg
static.bg3.co/imgs/202105/ 0
0 147ms
147ms Image
text/html 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/8e542c101e21ec7ab539d4ff2b0add65.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 e53bd81f14e73bd74c6ba8e824603466.jpg
static.bg3.co/imgs/202106/ 0
0 149ms
148ms Image
text/html 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202106/e53bd81f14e73bd74c6ba8e824603466.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 defc7eef0ebd633d9f0289e267c1d339.jpg
static.bg3.co/imgs/202105/ 0
0 160ms
160ms Image
text/html 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/defc7eef0ebd633d9f0289e267c1d339.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 38cd3c9eecc21692baf8a0249c94489d.jpg
static.bg3.co/imgs/202105/ 0
0 156ms
156ms Image
text/html 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/38cd3c9eecc21692baf8a0249c94489d.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 c70cc8e1522b948a18a40ce80ef37aab.jpg
static.bg3.co/imgs/202105/ 0
0 157ms
156ms Image
text/html 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/c70cc8e1522b948a18a40ce80ef37aab.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 98fbb2eeb1b755d609dff26cda8c0b25.jpg
static.bg3.co/imgs/202206/ 0
0 163ms
162ms Image
text/html 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202206/98fbb2eeb1b755d609dff26cda8c0b25.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 bb5f184c8e640e0f7708ae96311216ac.jpg
static.bg3.co/imgs/202105/ 0
0 169ms
169ms Image
text/html 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/bb5f184c8e640e0f7708ae96311216ac.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 82219b1028d85f81a4534c93afd6ecd9.jpg
static.bg3.co/imgs/202106/ 0
0 151ms
151ms Image
text/html 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202106/82219b1028d85f81a4534c93afd6ecd9.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 76423a2f11bd71e83f9b11c99073d9c3.jpg
static.bg3.co/imgs/202105/ 0
0 158ms
158ms Image
text/html 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/76423a2f11bd71e83f9b11c99073d9c3.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 453f1b8136a0c02db53d843688993b64.jpg
static.bg3.co/imgs/202106/ 0
0 159ms
158ms Image
text/html 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202106/453f1b8136a0c02db53d843688993b64.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 amp-auto-lightbox-0.1.js Show response
cdn.ampproject.org/rtv/012210272257000/v0/ 8 KB
3 KB 815ms
411ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012210272257000/v0/amp-auto-lightbox-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fda78dd6d350cd0f3175f0b9f88accd05c1a821199d84b63d9680553d501bc1f

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 11 Nov 2022 00:31:45 GMT
age: 15279
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2997
x-xss-protection: 0
server: sffe
etag: "b5d6bb1d52a8f322"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sat, 11 Nov 2023 00:31:45 GMT

GET
H3 200 amp-loader-0.1.js Show response
cdn.ampproject.org/rtv/012210272257000/v0/ 12 KB
4 KB 786ms
388ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012210272257000/v0/amp-loader-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9d10843b73211d37c1e21416b91114de626394eec8fdfd3ee51ad4de8de89107

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 11 Nov 2022 00:31:44 GMT
age: 15280
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3863
x-xss-protection: 0
server: sffe
etag: "409244e9f59114f0"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sat, 11 Nov 2023 00:31:44 GMT

GET
H2 200 jquery-2.2.2.min.js Show response
code.jquery.com/ 84 KB
30 KB 1174ms
603ms Script
application/javascript 69.16.175.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-2.2.2.min.js
Requested by: Host: delivery.adrecover.com
URL: https://delivery.adrecover.com/43519/adRecover.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.16.175.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: hwcdn.net
Software: nginx /
Resource Hash: dfa729d82a3effadab1000181cb99108f232721e3b0af74cfae4c12704b35a32

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:24 GMT
content-encoding: gzip
x-sp-metadata: HS256.CLDDt5sGEogBCiRlZWE1ZWVlMC1lYzExLTRkYjctYTljMy1hYmE5NDVkYTBiOGYQ6JCNkN3O+gIaBgigp7ebBiINMTE2LjkwLjc0LjE5NijajwMwAzgEQhZUTFNfQUVTXzEyOF9HQ01fU0hBMjU2WiAzZTliMjA2MTAwOThiNmM5YmZmOTUzODU2ZTU4MDE2YRosCAESJDMzZDFkZGZiLWJkNDctNGZhYi1hMDM1LTU4MGQxYTBmZjllMhi46QE=.oKJmztJsruYOYrYoqG9Nwe+jE/RQPLPBq5IKSET25P4=
last-modified: Wed, 16 Feb 2022 10:50:39 GMT
server: nginx
etag: W/"620cd6ff-14e98"
vary: Accept-Encoding
x-hw: 1668141984.dop212.la3.t,1668141984.cds242.la3.hn,1668141984.cds210.la3.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 29880

GET
H3 200 amp-ad-0.1.js Show response
cdn.ampproject.org/rtv/012210272257000/v0/ 81 KB
23 KB 540ms
285ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012210272257000/v0/amp-ad-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c1886ac9867da46d6c05ca1a0df4d0634b055826d142b12387e0b4fb483ae39

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 09 Nov 2022 15:15:56 GMT
age: 135028
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23047
x-xss-protection: 0
server: sffe
etag: "ba2717cd44fdea30"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 09 Nov 2023 15:15:56 GMT

GET
H2 200 ama Show response
pagead2.googlesyndication.com/getconfig/ 2 KB
894 B 840ms
282ms Fetch
application/json 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/ama?client=ca-pub-3216231935713038&plah=www.bg3.co&ama_t=amp&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&__amp_source_origin=https%3A%2F%2Fwww.bg3.co

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

89a3cd86231932c1f0588ac9327257c7e7102f9a4252fcaa4ad2269c486a53b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:23 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 453
x-xss-protection: 0

GET
H2 200 ucfad-formats.css
cdn.aralego.net/css/dev/ 975 B
641 B 150ms
149ms Stylesheet
text/css 172.67.71.254
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.aralego.net/css/dev/ucfad-formats.css
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.71.254 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1be00e223b2840fe8ac2d3a1aec0cf757088dd68f53a92275d0e1db6cb9afced

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:23 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3187
cf-polished: origSize=1191
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Fri, 16 Mar 2018 07:19:46 GMT
server: cloudflare
etag: W/"5aab7012-4a7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q0DW5sbJMFnE9OZP%2BHtgdGGOp0mb5o%2BBC79rf8dO5oUm5vnh9za4qvkZH6C8N2EaDCtraXd42ZsZZRZn%2B31YTrvjSf7OdBfhVvK82rcBN0v5bqBICvxsOumDJqv%2BUSJYVQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
access-control-allow-credentials: true
cf-ray: 768462424c315527-SYD

GET
H/1.1 200
OK idRequest Show response
sync.aralego.com/ 46 B
488 B 716ms
244ms XHR
text/html 23.108.102.145
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.aralego.com/idRequest?lang=en-US,en&deviceInfo=8416001200&pixRatio=1&font=16px%20sans-serif&
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.108.102.145 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG),
Reverse DNS
Software: /
Resource Hash: c5499edc44b7052b150461639014e70f28152a81378e7ed9c316723703625d87

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:23 GMT
vary: Accept-Encoding
access-control-allow-methods: GET,POST,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.bg3.co
access-control-allow-credentials: true
connection: close
content-length: 46

GET
H/1.1 200
OK idRequest Show response
sync.aralego.com/ 46 B
488 B 707ms
236ms XHR
text/html 23.108.102.145
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.aralego.com/idRequest?lang=en-US,en&deviceInfo=8416001200&pixRatio=1&font=16px%20sans-serif&
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.108.102.145 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG),
Reverse DNS
Software: /
Resource Hash: c5499edc44b7052b150461639014e70f28152a81378e7ed9c316723703625d87

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:23 GMT
vary: Accept-Encoding
access-control-allow-methods: GET,POST,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.bg3.co
access-control-allow-credentials: true
connection: close
content-length: 46

GET
H/1.1 200
OK ad_request Show response
ads.aralego.com/ 412 B
1 KB 845ms
376ms XHR
text/html 103.254.153.160
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.aralego.com/ad_request?sw=1600&sh=1200&ifr=0&bl=en-US&je=1&dnt=0&host=www.bg3.co&u=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&adid=ad-627443DBE4283AB9F7A46EA83243447&w=336&h=280&ver=UCX_WEB-20200113&pos=1&seq=0&cb=0.14608312215164987&gdpr=1&euconsent-v2=%24%7BGDPR_CONSENT_607%7D&format=336%2C280%3B&lang=en-US%2Cen&deviceInfo=8416001200&pixRatio=1&font=16px%20sans-serif&uaMobile=%3F0
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 103.254.153.160 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG),
Reverse DNS
Software: /
Resource Hash: 43651d9987d330a8113243857b3e376194303e4ec962c2590676657b639ae99e

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:23 GMT
X-Width: 336
X-Height: 280
X-AdStyle: banner
Access-Control-Allow-Methods: GET,POST,OPTIONS
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: https://www.bg3.co
Access-Control-Expose-Headers: X-Width,X-Height,X-AdStyle,X-AdCap,X-AdWatchUrl,X-AdSource,X-SspId,X-Deal
Vary: Accept-Encoding
Access-Control-Allow-Credentials: true
X-AdSource: PSA
X-Adtype: html
Connection: close
Content-Length: 412

GET
H/1.1 200
OK ad_request Show response
ads.aralego.com/ 412 B
1 KB 835ms
367ms XHR
text/html 103.254.153.160
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.aralego.com/ad_request?sw=1600&sh=1200&ifr=0&bl=en-US&je=1&dnt=0&host=www.bg3.co&u=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&adid=ad-627443DBE4283AB9F7A46EA83243447&w=336&h=280&ver=UCX_WEB-20200113&pos=1&seq=1&cb=0.754041768765026&gdpr=1&euconsent-v2=%24%7BGDPR_CONSENT_607%7D&format=336%2C280%3B&lang=en-US%2Cen&deviceInfo=8416001200&pixRatio=1&font=16px%20sans-serif&uaMobile=%3F0
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 103.254.153.160 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG),
Reverse DNS
Software: /
Resource Hash: 43651d9987d330a8113243857b3e376194303e4ec962c2590676657b639ae99e

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:23 GMT
X-Width: 336
X-Height: 280
X-AdStyle: banner
Access-Control-Allow-Methods: GET,POST,OPTIONS
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: https://www.bg3.co
Access-Control-Expose-Headers: X-Width,X-Height,X-AdStyle,X-AdCap,X-AdWatchUrl,X-AdSource,X-SspId,X-Deal
Vary: Accept-Encoding
Access-Control-Allow-Credentials: true
X-AdSource: PSA
X-Adtype: html
Connection: close
Content-Length: 412

GET
H3 200 cookieSyncIframe.html Show response
cdn.aralego.net/ucfad/cookie/ Frame ADC3 714 B
798 B 156ms
156ms Document
text/html 172.67.71.254
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.aralego.net/ucfad/cookie/cookieSyncIframe.html
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.71.254 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 36a7d95f2760a813f3e782dfc125ea786174d581d6f6f896021d6994e9514bd6

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

access-control-allow-credentials: true
age: 1789
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 76846246caa7a8d1-SYD
content-encoding: br
content-type: text/html
date: Fri, 11 Nov 2022 04:46:23 GMT
last-modified: Wed, 09 Feb 2022 05:59:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=myxVkMx9wxTnLpwQFbWI8nHSuHNUsWI4jhR9JTt4zPYn5Zeu%2FreO36%2FsSOj6PSM51UmYLAFZ4sw4VHWOC5lyVPl5dNIQMlq5NSpF7o0%2F0tAUI0yiB7CD1NLva6%2F4umG0vA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H/1.1 200
OK idsync
sync.aralego.com/ 35 B
384 B 705ms
237ms Image
image/gif 23.108.102.145
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.aralego.com/idsync?gdpr=1&euconsent-v2=${GDPR_CONSENT_607}&
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.108.102.145 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:24 GMT
connection: close
content-length: 35
content-type: image/gif

GET
H2 200 jquery-3.6.0.min.js Show response
code.jquery.com/ 87 KB
31 KB 324ms
304ms Script
application/javascript 69.16.175.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/adpushup.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.16.175.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: hwcdn.net
Software: nginx /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:24 GMT
content-encoding: gzip
x-sp-metadata: HS256.CLDDt5sGEogBCiRiYjBhNDM0ZS03NTU3LTQwMDAtYWU3ZC1kMTUxNTUxMDVkNmQQ6JCNkN3O+gIaBgigp7ebBiINMTE2LjkwLjc0LjE5NijajwMwAzgEQhZUTFNfQUVTXzEyOF9HQ01fU0hBMjU2WiAzZTliMjA2MTAwOThiNmM5YmZmOTUzODU2ZTU4MDE2YRosCAESJGE1MTY1ODU3LTM3MzUtNGRkYi1iY2JhLTRlZjFkNzBhYTM3Yxib8QE=./UQ5catHcSGK1AuXU2riVrtkDZDVL6sVBXDvY+PE2J4=
last-modified: Wed, 16 Feb 2022 10:50:39 GMT
server: nginx
etag: W/"620cd6ff-15d9d"
vary: Accept-Encoding
x-hw: 1668141984.dop212.la3.t,1668141984.cds242.la3.hn,1668141984.cds267.la3.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30875

GET
H3 200 cookieSyncIframe.html Show response
cdn.aralego.net/ucfad/cookie/ Frame B216 714 B
765 B 157ms
156ms Document
text/html 172.67.71.254
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.aralego.net/ucfad/cookie/cookieSyncIframe.html
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.71.254 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 36a7d95f2760a813f3e782dfc125ea786174d581d6f6f896021d6994e9514bd6

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

access-control-allow-credentials: true
age: 1789
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 768462470ae3a8d1-SYD
content-encoding: br
content-type: text/html
date: Fri, 11 Nov 2022 04:46:23 GMT
last-modified: Wed, 09 Feb 2022 05:59:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=URR7%2B%2FR9g0LkKkIYdrZv3y5%2Fg%2BNp%2BKfMNo6KNNM6cy8NTOniGo4wEWnj64a7aXUxMLQ2NBIjtiRGCWjgfYM6b6d8VuMiWFJCVA5w7spHqe8N8wKMrPfU4uBaw%2F6SwYsjww%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H3 200 amp-sticky-ad-1.0.js Show response
cdn.ampproject.org/rtv/012210272257000/v0/ 40 KB
10 KB 277ms
276ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012210272257000/v0/amp-sticky-ad-1.0.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92ed147fc15d3c39f07e271e6f81abbc19e102bddfd92deea299d5b84bef38a1

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 09 Nov 2022 15:02:19 GMT
age: 135845
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10265
x-xss-protection: 0
server: sffe
etag: "23bc4ca8e6d97223"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 09 Nov 2023 15:02:19 GMT

GET
H2 200 init.js Show response
cdn.holmesmind.com/js/ Frame A293 6 KB
7 KB 827ms
248ms Script
application/javascript 13.227.254.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.holmesmind.com/js/init.js
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.254.22 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-254-22.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fb51fa018c951108a66acf0730199d329d887872947eb3940088ef734f026818

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: UdwMmUAM2dmZqopCO7YOeMhqjXQRxqvB
date: Fri, 11 Nov 2022 04:46:20 GMT
via: 1.1 db75d9999621c662b2eccf4f496b12aa.cloudfront.net (CloudFront)
last-modified: Fri, 04 Mar 2022 10:10:49 GMT
server: AmazonS3
x-amz-cf-pop: SIN52-C3
age: 17
etag: "439e160b698f1ec2efb45c3b6cd6b265"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 6552
x-amz-cf-id: FbTSfNH7nVszODEd-dPWzViQJsAYlZ6SEV5uLN4TR_w1v3fbIUCAOA==

GET
H2 200 init.js Show response
cdn.holmesmind.com/js/ Frame EDCB 6 KB
7 KB 662ms
265ms Script
application/javascript 13.227.254.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.holmesmind.com/js/init.js
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.254.22 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-254-22.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fb51fa018c951108a66acf0730199d329d887872947eb3940088ef734f026818

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: UdwMmUAM2dmZqopCO7YOeMhqjXQRxqvB
date: Fri, 11 Nov 2022 04:46:20 GMT
via: 1.1 db75d9999621c662b2eccf4f496b12aa.cloudfront.net (CloudFront)
last-modified: Fri, 04 Mar 2022 10:10:49 GMT
server: AmazonS3
x-amz-cf-pop: SIN52-C3
age: 17
etag: "439e160b698f1ec2efb45c3b6cd6b265"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 6552
x-amz-cf-id: 04_F-Be9ZlecIh4qVN7tPOGwtrx5ucNLR8jFYn7hwwbqy-V-V-U-iw==

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame ADC3 79 KB
27 KB 1148ms
581ms Script
text/javascript 74.125.68.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.aralego.net
URL: https://cdn.aralego.net/ucfad/cookie/cookieSyncIframe.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.68.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dc6a1b3fa4ab479d2f948bd544f140b93ffd51fd2a86a0143eae26023111a52f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27315
x-xss-protection: 0
server: sffe
etag: "1390 / 446 of 1000 / last-modified: 1668121631"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 11 Nov 2022 04:46:24 GMT

GET
H3 200 gtag.json Show response
cdn.ampproject.org/rtv/012210272257000/v0/analytics-vendors/ 2 KB
931 B 830ms
278ms Fetch
application/json 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012210272257000/v0/analytics-vendors/gtag.json

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a8993772c9eb591474f38d257bebc8c4286703e1af72d04c8c294be5fff7b649

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 09 Nov 2022 14:58:26 GMT
age: 136078
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 901
x-xss-protection: 0
server: sffe
etag: "0617c6e185be6e0c"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 09 Nov 2023 14:58:26 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame B216 79 KB
27 KB 810ms
282ms Script
text/javascript 74.125.68.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.aralego.net
URL: https://cdn.aralego.net/ucfad/cookie/cookieSyncIframe.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.68.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dc6a1b3fa4ab479d2f948bd544f140b93ffd51fd2a86a0143eae26023111a52f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27315
x-xss-protection: 0
server: sffe
etag: "1390 / 319 of 1000 / last-modified: 1668121631"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 11 Nov 2022 04:46:24 GMT

POST
H2 200 amp Show response
www.googletagmanager.com/gtag/ 610 B
808 B 836ms
278ms Fetch
application/json 74.125.24.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/amp?__amp_source_origin=https%3A%2F%2Fwww.bg3.co

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

8492f3fc13f89700f09e8a96308911979a6289be084af2c497ea54dbd7dd7f5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=utf-8

Response headers

date: Fri, 11 Nov 2022 04:46:25 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="amp.json"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 258
x-xss-protection: 0
pragma: no-cache
amp-access-control-allow-source-origin: https://www.bg3.co
server: Google Tag Manager
vary: *
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.bg3.co
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 amp-ad-network-adsense-impl-0.1.js Show response
cdn.ampproject.org/rtv/012210272257000/v0/ 214 KB
57 KB 277ms
276ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012210272257000/v0/amp-ad-network-adsense-impl-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b1748e516872d3ec44b5f5dd98131d5cf81f6e1821a7a6d0f886bc28720aa23

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 09 Nov 2022 14:56:32 GMT
age: 136193
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57848
x-xss-protection: 0
server: sffe
etag: "223b6842b827a21f"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 09 Nov 2023 14:56:32 GMT

GET
H2 200 pubads_impl_2022110801.js Show response
securepubads.g.doubleclick.net/gpt/ Frame B216 382 KB
129 KB 581ms
280ms Script
text/javascript 74.125.68.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110801.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.68.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

387dfc092f85b10bf8322f9f18a2b274e89eed297b9c02a336ad6b274552c1e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 11:58:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 233267
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131898
x-xss-protection: 0
last-modified: Tue, 08 Nov 2022 09:38:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 08 Nov 2023 11:58:38 GMT

GET
H2 200 pubads_impl_2022110801.js Show response
securepubads.g.doubleclick.net/gpt/ Frame ADC3 382 KB
129 KB 900ms
599ms Script
text/javascript 74.125.68.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110801.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.68.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

387dfc092f85b10bf8322f9f18a2b274e89eed297b9c02a336ad6b274552c1e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 11:58:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 233267
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131898
x-xss-protection: 0
last-modified: Tue, 08 Nov 2022 09:38:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 08 Nov 2023 11:58:38 GMT

GET
H2 200 pb.42753.1663912421366.js Show response
cdn.adpushup.com/prebid/ 342 KB
92 KB 1441ms
384ms Script
application/javascript 42.99.140.200
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/adpushup.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 42.99.140.200 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),
Reverse DNS: ip-42-99-140-200.pacnet.net
Software: nginx/1.18.0 /
Resource Hash: 1c479d0abecadc8d5fde30eeb515508b6148fa3d92dd617b427788d6c792b0a8

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: NZ
date: Fri, 11 Nov 2022 04:46:26 GMT
content-encoding: br
last-modified: Fri, 23 Sep 2022 05:54:31 GMT
server: nginx/1.18.0
etag: W/"632d4a17-5578b"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=31536000
server-timing: cdn-cache; desc=HIT, edge; dur=9
content-length: 94168
expires: Sat, 11 Nov 2023 04:46:26 GMT

GET
H2 200 quantcast.js Show response
cdn.adpushup.com/pbuseridscripts/ 450 B
505 B 1678ms
695ms Script
application/javascript 42.99.140.200
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/pbuseridscripts/quantcast.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/adpushup.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 42.99.140.200 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),
Reverse DNS: ip-42-99-140-200.pacnet.net
Software: nginx/1.18.0 /
Resource Hash: 26914004d3a8d5ddde2202b642d7936eb61c9f195b5cd3c87e44ef8ad4d57c16

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: NZ
date: Fri, 11 Nov 2022 04:46:26 GMT
content-encoding: br
last-modified: Mon, 28 Jun 2021 04:15:23 GMT
server: nginx/1.18.0
etag: W/"60d94cdb-1c2"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=31536000
server-timing: cdn-cache; desc=HIT, edge; dur=7
content-length: 211
expires: Sat, 11 Nov 2023 04:46:26 GMT

GET
H2 200 linkPreview.js Show response
cdn.adpushup.com/42753/ 72 KB
17 KB 1328ms
371ms Script
application/javascript 42.99.140.200
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/42753/linkPreview.js
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 42.99.140.200 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),
Reverse DNS: ip-42-99-140-200.pacnet.net
Software: nginx/1.18.0 /
Resource Hash: 968012b3a49390a10d31c6d36b2aab796ec167a83378b5f9787756ee7cb035c5

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: NZ
date: Fri, 11 Nov 2022 04:46:26 GMT
content-encoding: br
last-modified: Thu, 14 Jul 2022 19:44:27 GMT
server: nginx/1.18.0
etag: W/"62d0721b-11ed1"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=7
content-length: 17440
expires: Fri, 11 Nov 2022 05:46:26 GMT

GET
H2 204 log
aplogger.adpushup.com/ 0
54 B 858ms
281ms Image
text/plain 104.211.156.162
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aplogger.adpushup.com/log?event=PAGE_VIEW&data=eyJzaXRlSWQiOjQyNzUzfQ%3D%3D&pxRes=false
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 104.211.156.162 Mumbai, India, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:28 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 79 KB
27 KB 280ms
277ms Script
text/javascript 74.125.68.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/adpushup.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dc6a1b3fa4ab479d2f948bd544f140b93ffd51fd2a86a0143eae26023111a52f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27315
x-xss-protection: 0
server: sffe
etag: "1390 / 740 of 1000 / last-modified: 1668121631"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 11 Nov 2022 04:46:26 GMT

GET
H2 200 sync
e3.adpushup.com/AdPushupFeedbackWebService/user/ 70 B
538 B 705ms
232ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/user/sync
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:26 GMT
server: nginx/1.10.3 (Ubuntu)
ap-cookie-status: cookies ap_uid and ap_usid are set
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 integrator.json Show response
adservice.google.com/adsid/ 86 B
572 B 832ms
279ms Fetch
application/json 142.251.12.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.json?domain=www.bg3.co

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

14cfb5058acaf3af2f07088f1582f29941d7a4cc74fd1cea5050cecad862d154

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.bg3.co
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 83
x-xss-protection: 0

GET
H2 200 nameframe.html
d-5982684092072811116.ampproject.net/2210272257000/ 0
0 833ms
276ms Other
text/html 74.125.130.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://d-5982684092072811116.ampproject.net/2210272257000/nameframe.html
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.125.130.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sb-in-f94.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 testmode
e3.adpushup.com/AdPushupFeedbackWebService/feedback/ 70 B
317 B 709ms
236ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback/testmode?data=eyJjcmVhdGVkVFMiOjE2NjgxNDE5ODU1NDYsInBhY2tldElkIjoiMDAwMEE3MDEtYTE0ODBjNDItNjA0MC00NWY4LWEyOGUtZmM5N2FmZDQzOGNjIiwic2l0ZUlkIjo0Mjc1Mywic2l0ZURvbWFpbiI6Imh0dHBzOi8vYmczLmNvLyIsInVybCI6Imh0dHBzOi8vd3d3LmJnMy5jby9hL2RpLXFpdS1zaG91LXdlaS15aS16aGkteGluZy1qaS1mYW5nLWtlLWh1by1xdWUtcmVuLmh0bWwiLCJtb2RlIjo0LCJlcnJvckNvZGUiOjAsInJlZmVycmVyIjoiIiwicGFnZUdyb3VwIjoiQVJUSUNMRSIsInBhZ2VWYXJpYXRpb25JZCI6Ijk2NzUwMTI1LWI5MGMtNDk3YS04Njk5LTczMTcxZjdiNDkzNSIsInBhZ2VWYXJpYXRpb25OYW1lIjoiQWRQdXNodXAiLCJwYWdlVmFyaWF0aW9uVHlwZSI6MSwicGxhdGZvcm0iOiJERVNLVE9QIiwiaXNHZW5pZWUiOmZhbHNlLCJzZWN0aW9ucyI6bnVsbH0%3D&c_b=5495
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:26 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 testmode
e3.adpushup.com/AdPushupFeedbackWebService/feedback/ 70 B
317 B 708ms
235ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback/testmode?data=eyJjcmVhdGVkVFMiOjE2NjgxNDE5ODU1NDcsInBhY2tldElkIjoiMDAwMEE3MDEtYTE0ODBjNDItNjA0MC00NWY4LWEyOGUtZmM5N2FmZDQzOGNjIiwic2l0ZUlkIjo0Mjc1Mywic2l0ZURvbWFpbiI6Imh0dHBzOi8vYmczLmNvLyIsInVybCI6Imh0dHBzOi8vd3d3LmJnMy5jby9hL2RpLXFpdS1zaG91LXdlaS15aS16aGkteGluZy1qaS1mYW5nLWtlLWh1by1xdWUtcmVuLmh0bWwiLCJtb2RlIjo1LCJlcnJvckNvZGUiOjEsInJlZmVycmVyIjoiIiwicGFnZUdyb3VwIjoiQVJUSUNMRSIsInBhZ2VWYXJpYXRpb25JZCI6Ijk2NzUwMTI1LWI5MGMtNDk3YS04Njk5LTczMTcxZjdiNDkzNSIsInBhZ2VWYXJpYXRpb25OYW1lIjoiQWRQdXNodXAiLCJwYWdlVmFyaWF0aW9uVHlwZSI6MSwicGxhdGZvcm0iOiJERVNLVE9QIiwiaXNHZW5pZWUiOmZhbHNlLCJzZWN0aW9ucyI6bnVsbH0%3D&c_b=5495.60000038147
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:26 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 feedback
e3.adpushup.com/AdPushupFeedbackWebService/ 70 B
317 B 308ms
235ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback?data=eyJjcmVhdGVkVFMiOjE2NjgxNDE5ODU1NDcsInBhY2tldElkIjoiMDAwMEE3MDEtYTE0ODBjNDItNjA0MC00NWY4LWEyOGUtZmM5N2FmZDQzOGNjIiwic2l0ZUlkIjo0Mjc1Mywic2l0ZURvbWFpbiI6Imh0dHBzOi8vYmczLmNvLyIsInVybCI6Imh0dHBzOi8vd3d3LmJnMy5jby9hL2RpLXFpdS1zaG91LXdlaS15aS16aGkteGluZy1qaS1mYW5nLWtlLWh1by1xdWUtcmVuLmh0bWwiLCJtb2RlIjoxLCJlcnJvckNvZGUiOjEsInJlZmVycmVyIjoiIiwicGFnZUdyb3VwIjoiQVJUSUNMRSIsInBhZ2VWYXJpYXRpb25JZCI6Ijk2NzUwMTI1LWI5MGMtNDk3YS04Njk5LTczMTcxZjdiNDkzNSIsInBhZ2VWYXJpYXRpb25OYW1lIjoiQWRQdXNodXAiLCJwYWdlVmFyaWF0aW9uVHlwZSI6MSwicGxhdGZvcm0iOiJERVNLVE9QIiwiaXNHZW5pZWUiOmZhbHNlLCJzZWN0aW9ucyI6W3sic2VjdGlvbklkIjoiNzdhOWMyMmYtYWMwMi00NWRkLTk2YmMtYjA4OTZhOGE3ZDVhIiwic2VjdGlvbk5hbWUiOiJBUF9MX0RfQVJUSUNMRV83MjhYMjUwXzc3YTljIiwic3RhdHVzIjoxLCJuZXR3b3JrIjoiYWRwVGFncyIsIm5ldHdvcmtBZFVuaXRJZCI6IkFEUF80Mjc1M183MjhYMjUwXzc3YTljMjJmLWFjMDItNDVkZC05NmJjLWIwODk2YThhN2Q1YSIsInNlcnZpY2VzIjpbMSwzXSwiYWRVbml0VHlwZSI6MX1dfQ%3D%3D&c_b=5495.89999961853
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:26 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 adpushup-label.svg
campaign.adpushup.com/ads/ 8 KB
9 KB 593ms
144ms Image
image/svg+xml 152.199.39.108
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://campaign.adpushup.com/ads/adpushup-label.svg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.39.108 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (nwa/E7CA) /
Resource Hash: eb3577f46647f2e2db7307936038a47cc31c0ce75239496f6b7117282a47864c

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:27 GMT
last-modified: Thu, 12 Nov 2020 09:18:18 GMT
server: ECAcc (nwa/E7CA)
age: 3553
etag: "5facfdda-21e0"
x-cache: HIT
content-type: image/svg+xml
cache-control: max-age=14400
accept-ranges: bytes
content-length: 8672
expires: Fri, 11 Nov 2022 08:46:27 GMT

GET
H2 200 feedback
e3.adpushup.com/AdPushupFeedbackWebService/ 70 B
317 B 240ms
240ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback?data=eyJjcmVhdGVkVFMiOjE2NjgxNDE5ODU1NTIsInBhY2tldElkIjoiMDAwMEE3MDEtYTE0ODBjNDItNjA0MC00NWY4LWEyOGUtZmM5N2FmZDQzOGNjIiwic2l0ZUlkIjo0Mjc1Mywic2l0ZURvbWFpbiI6Imh0dHBzOi8vYmczLmNvLyIsInVybCI6Imh0dHBzOi8vd3d3LmJnMy5jby9hL2RpLXFpdS1zaG91LXdlaS15aS16aGkteGluZy1qaS1mYW5nLWtlLWh1by1xdWUtcmVuLmh0bWwiLCJtb2RlIjoxLCJlcnJvckNvZGUiOjEsInJlZmVycmVyIjoiIiwicGFnZUdyb3VwIjoiQVJUSUNMRSIsInBhZ2VWYXJpYXRpb25JZCI6Ijk2NzUwMTI1LWI5MGMtNDk3YS04Njk5LTczMTcxZjdiNDkzNSIsInBhZ2VWYXJpYXRpb25OYW1lIjoiQWRQdXNodXAiLCJwYWdlVmFyaWF0aW9uVHlwZSI6MSwicGxhdGZvcm0iOiJERVNLVE9QIiwiaXNHZW5pZWUiOmZhbHNlLCJzZWN0aW9ucyI6W3sic2VjdGlvbklkIjoiZDFjMTBhNzItMjdiNC00OTMxLThjZTctOTlhMThlYmJkYmFlIiwic2VjdGlvbk5hbWUiOiJBUF9JX0RfQVJUSUNMRV83MjhYOTBfZDFjMTAiLCJzdGF0dXMiOjEsIm5ldHdvcmsiOiJhZHBUYWdzIiwibmV0d29ya0FkVW5pdElkIjoiU1RJQ0tZX0FEUF80Mjc1M183MjhYOTBfZDFjMTBhNzItMjdiNC00OTMxLThjZTctOTlhMThlYmJkYmFlIiwic2VydmljZXMiOls1LDNdLCJhZFVuaXRUeXBlIjozfV19&c_b=5500.5
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:27 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 feedback
e3.adpushup.com/AdPushupFeedbackWebService/ 70 B
317 B 233ms
233ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback?data=eyJjcmVhdGVkVFMiOjE2NjgxNDE5ODU1NTQsInBhY2tldElkIjoiMDAwMEE3MDEtYTE0ODBjNDItNjA0MC00NWY4LWEyOGUtZmM5N2FmZDQzOGNjIiwic2l0ZUlkIjo0Mjc1Mywic2l0ZURvbWFpbiI6Imh0dHBzOi8vYmczLmNvLyIsInVybCI6Imh0dHBzOi8vd3d3LmJnMy5jby9hL2RpLXFpdS1zaG91LXdlaS15aS16aGkteGluZy1qaS1mYW5nLWtlLWh1by1xdWUtcmVuLmh0bWwiLCJtb2RlIjoxLCJlcnJvckNvZGUiOjEsInJlZmVycmVyIjoiIiwicGFnZUdyb3VwIjoiQVJUSUNMRSIsInBhZ2VWYXJpYXRpb25JZCI6Ijk2NzUwMTI1LWI5MGMtNDk3YS04Njk5LTczMTcxZjdiNDkzNSIsInBhZ2VWYXJpYXRpb25OYW1lIjoiQWRQdXNodXAiLCJwYWdlVmFyaWF0aW9uVHlwZSI6MSwicGxhdGZvcm0iOiJERVNLVE9QIiwiaXNHZW5pZWUiOmZhbHNlLCJzZWN0aW9ucyI6W3sic2VjdGlvbklkIjoiMTA0YjI4MmEtYmQxMS00ZDhkLWFkNjQtMDQ5MjA2M2I2Y2JhIiwic2VjdGlvbk5hbWUiOiJBUF9JX0RfQVJUSUNMRV8xMjBYNjAwXzEwNGIyIiwic3RhdHVzIjoxLCJuZXR3b3JrIjoiYWRwVGFncyIsIm5ldHdvcmtBZFVuaXRJZCI6IlNUSUNLWV9BRFBfNDI3NTNfMTIwWDYwMF8xMDRiMjgyYS1iZDExLTRkOGQtYWQ2NC0wNDkyMDYzYjZjYmEiLCJzZXJ2aWNlcyI6WzUsM10sImFkVW5pdFR5cGUiOjN9XX0%3D&c_b=5503
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:27 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 block.jpg
delivery.adrecover.com/ 631 B
915 B 352ms
352ms Image
image/jpeg 42.99.140.201
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://delivery.adrecover.com/block.jpg?ts=1668141985572
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 42.99.140.201 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),
Reverse DNS: ip-42-99-140-201.pacnet.net
Software: nginx/1.18.0 /
Resource Hash: 9284d948e86d2e99f31483b5f4b3a4c3e65e0a6fbca9a8d2db8c6095f82ac3f5

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: NZ
date: Fri, 11 Nov 2022 04:46:27 GMT
last-modified: Wed, 23 Jun 2021 06:37:54 GMT
server: nginx/1.18.0
etag: "60d2d6c2-277"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 631
expires: Fri, 11 Nov 2022 05:46:27 GMT

GET
H2 200 capmapping.htm Show response
cdn.holmesmind.com/js/ Frame F890 5 KB
5 KB 242ms
242ms Document
text/html 13.227.254.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.254.22 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-254-22.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cc37fba2e98f49c4d9551f72176d3aff72eacd798e5e85436837847e6b967c36

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 10
content-length: 4730
content-type: text/html
date: Fri, 11 Nov 2022 04:46:25 GMT
etag: "c36f5eb091d6195fe8b68f3b263f999b"
last-modified: Mon, 22 Aug 2022 03:00:17 GMT
server: AmazonS3
via: 1.1 db75d9999621c662b2eccf4f496b12aa.cloudfront.net (CloudFront)
x-amz-cf-id: niFNBhOMKtSirQpJB0TETIwpS8qzu5bntGinsIeYDz4jT38IJCEHmg==
x-amz-cf-pop: SIN52-C3
x-amz-version-id: 9jVaRQ2pP3sbT47ouwg8zArcPp2ddVmt
x-cache: Hit from cloudfront

GET
H2 200 edmp_init.js Show response
cdn.holmesmind.com/js/ Frame A293 662 B
1011 B 238ms
238ms Script
application/javascript 13.227.254.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.holmesmind.com/js/edmp_init.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.254.22 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-254-22.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 28248d4886fe85d725c1a6d3b2340a1bde6a7ffcadfac53ada50f78a9e707d5c

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: null
date: Fri, 11 Nov 2022 04:46:27 GMT
via: 1.1 db75d9999621c662b2eccf4f496b12aa.cloudfront.net (CloudFront)
last-modified: Fri, 12 Mar 2021 02:45:40 GMT
server: AmazonS3
x-amz-cf-pop: SIN52-C3
age: 2
etag: "f58f8a90686f8ffb3325107e8a788b71"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 662
x-amz-cf-id: -LAEGhtyjjf3N7hlFpeT4QbQsd8cnxdb-TSaLEO26s6CuX6A3H21pA==

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame BDE3 9 KB
10 KB 256ms
256ms Script
application/javascript 13.227.254.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.254.22 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-254-22.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9d50879eaa5642b8cf7aa54a56c90c91beb7c08132e76be852929263a5df7df7

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: VaSpewhnvI6bFcTAqatFk5SqvLFpxvJd
date: Fri, 11 Nov 2022 04:46:27 GMT
via: 1.1 db75d9999621c662b2eccf4f496b12aa.cloudfront.net (CloudFront)
last-modified: Thu, 20 Oct 2022 05:58:48 GMT
server: AmazonS3
x-amz-cf-pop: SIN52-C3
age: 53
etag: "760acffabe0db50f11b07aec24b247c5"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 9628
x-amz-cf-id: ubQbt589qo2LAJAeKlfjSNio4PyCuDFkUe6OdbKtNBMlUJkq90cTfw==

GET
H2 200 capmapping.htm Show response
cdn.holmesmind.com/js/ Frame D4C0 5 KB
5 KB 242ms
242ms Document
text/html 13.227.254.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.254.22 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-254-22.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cc37fba2e98f49c4d9551f72176d3aff72eacd798e5e85436837847e6b967c36

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 10
content-length: 4730
content-type: text/html
date: Fri, 11 Nov 2022 04:46:25 GMT
etag: "c36f5eb091d6195fe8b68f3b263f999b"
last-modified: Mon, 22 Aug 2022 03:00:17 GMT
server: AmazonS3
via: 1.1 db75d9999621c662b2eccf4f496b12aa.cloudfront.net (CloudFront)
x-amz-cf-id: hYQp5h976w9ZeubR4x8GigW5xCAwpT180O6T6iv1hIk3A-yW-Jj0GA==
x-amz-cf-pop: SIN52-C3
x-amz-version-id: 9jVaRQ2pP3sbT47ouwg8zArcPp2ddVmt
x-cache: Hit from cloudfront

GET
H2 200 edmp_init.js Show response
cdn.holmesmind.com/js/ Frame EDCB 662 B
1002 B 236ms
236ms Script
application/javascript 13.227.254.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.holmesmind.com/js/edmp_init.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.254.22 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-254-22.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 28248d4886fe85d725c1a6d3b2340a1bde6a7ffcadfac53ada50f78a9e707d5c

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: null
date: Fri, 11 Nov 2022 04:46:27 GMT
via: 1.1 db75d9999621c662b2eccf4f496b12aa.cloudfront.net (CloudFront)
last-modified: Fri, 12 Mar 2021 02:45:40 GMT
server: AmazonS3
x-amz-cf-pop: SIN52-C3
age: 4
etag: "f58f8a90686f8ffb3325107e8a788b71"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 662
x-amz-cf-id: tUeiSGxdLl5cO5EXXUoLAgeiAX2-AND1Q_pgNtY_PLe2cRP8TZaNbA==

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame 3F32 9 KB
10 KB 259ms
258ms Script
application/javascript 13.227.254.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.254.22 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-254-22.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9d50879eaa5642b8cf7aa54a56c90c91beb7c08132e76be852929263a5df7df7

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: VaSpewhnvI6bFcTAqatFk5SqvLFpxvJd
date: Fri, 11 Nov 2022 04:46:27 GMT
via: 1.1 db75d9999621c662b2eccf4f496b12aa.cloudfront.net (CloudFront)
last-modified: Thu, 20 Oct 2022 05:58:48 GMT
server: AmazonS3
x-amz-cf-pop: SIN52-C3
age: 55
etag: "760acffabe0db50f11b07aec24b247c5"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 9628
x-amz-cf-id: zsCXY4rl2b2QFDpnGz2bmJd-Bf7IGdMB3QwG38gcWkmRvobEzoFBvw==

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
396 B 836ms
278ms Image
image/gif 142.250.4.138
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=a1&ds=AMP&aip&_s=1&dt=%E5%9C%B0%E7%90%83%E9%A6%96%E4%BD%8D%E5%B7%B2%E7%9F%A5%E6%98%9F%E9%9A%9B%E8%A8%AA%E5%AE%A2%E7%8D%B2%E7%A2%BA%E8%AA%8D%20-%20%E5%A4%A9%E5%A4%A9%E8%A6%81%E8%81%9E&sr=1600x1200&cid=amp-AAp9dXD6Zm2nR1d2DAAlKg&tid=UA-172083736-2&dl=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&dr=&sd=24&ul=en-us&de=UTF-8&t=pageview&jid=0.6967392420588481&gjid=0.7175575025725647&_r=1&a=7888&z=0.21625652289513142&gtm=2pu000

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f138.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:30 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm.php Show response
fcm.holmesmind.com/ Frame 2A85 39 B
191 B 628ms
341ms Document
text/html 34.95.67.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://fcm.holmesmind.com/cm.php
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.67.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.67.95.34.bc.googleusercontent.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: d51ae4a1096fac36fe9055d5c3f4daa85de0120b567636c89327b544a2a6a795

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39
content-type: text/html; charset=UTF-8
date: Fri, 11 Nov 2022 04:46:26 GMT
server: Apache/2.4.29 (Ubuntu)
via: 1.1 google

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame F890 5 KB
2 KB 867ms
287ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL

https://t.ssp.hinet.net/utag.js

Requested by

Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

7484befc556b76b2da474fc9af0f8ac34a97d18a5ef62b9f7c4ea79e47bd29ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.holmesmind.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:26 GMT
strict-transport-security: max-age=0
content-encoding: gzip
last-modified: Mon, 25 Jul 2022 06:51:32 GMT
server: nginx
etag: W/"62de3d74-134a"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=600
expires: Fri, 11 Nov 2022 04:56:26 GMT

GET
H3

200

cm
c.holmesmind.com/ Frame F890
Redirect Chain

https://c.holmesmind.com/cm
https://c.holmesmind.com/cm?tc=getIn&

0
16 B

461ms
319ms

Image
text/html

35.201.76.93
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.holmesmind.com/cm?tc=getIn&
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H3
Server: 35.201.76.93 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 93.76.201.35.bc.googleusercontent.com
Software: nginx/1.10.3 (Ubuntu) / PHP/7.0.18-0ubuntu0.17.04.1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.holmesmind.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:27 GMT
via: 1.1 google
server: nginx/1.10.3 (Ubuntu)
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type: text/html; charset=UTF-8

Redirect headers

location: https://c.holmesmind.com/cm?tc=getIn&
date: Fri, 11 Nov 2022 04:46:27 GMT
via: 1.1 google
server: nginx/1.10.3 (Ubuntu)
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type: text/html; charset=UTF-8

GET
H3

200

cm
c.holmesmind.com/ Frame D4C0
Redirect Chain

https://c.holmesmind.com/cm
https://c.holmesmind.com/cm?tc=getIn&

0
16 B

464ms
320ms

Image
text/html

35.201.76.93
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.holmesmind.com/cm?tc=getIn&
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H3
Server: 35.201.76.93 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 93.76.201.35.bc.googleusercontent.com
Software: nginx/1.10.3 (Ubuntu) / PHP/7.0.18-0ubuntu0.17.04.1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.holmesmind.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:27 GMT
via: 1.1 google
server: nginx/1.10.3 (Ubuntu)
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type: text/html; charset=UTF-8

Redirect headers

location: https://c.holmesmind.com/cm?tc=getIn&
date: Fri, 11 Nov 2022 04:46:27 GMT
via: 1.1 google
server: nginx/1.10.3 (Ubuntu)
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type: text/html; charset=UTF-8

GET
H2 200 cm.php Show response
fcm.holmesmind.com/ Frame BB7B 39 B
97 B 613ms
342ms Document
text/html 34.95.67.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://fcm.holmesmind.com/cm.php
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.67.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.67.95.34.bc.googleusercontent.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: d51ae4a1096fac36fe9055d5c3f4daa85de0120b567636c89327b544a2a6a795

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39
content-type: text/html; charset=UTF-8
date: Fri, 11 Nov 2022 04:46:26 GMT
server: Apache/2.4.29 (Ubuntu)
via: 1.1 google

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame D4C0 5 KB
2 KB 851ms
287ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL

https://t.ssp.hinet.net/utag.js

Requested by

Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

7484befc556b76b2da474fc9af0f8ac34a97d18a5ef62b9f7c4ea79e47bd29ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.holmesmind.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:26 GMT
strict-transport-security: max-age=0
content-encoding: gzip
last-modified: Mon, 25 Jul 2022 06:51:32 GMT
server: nginx
etag: W/"62de3d74-134a"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=600
expires: Fri, 11 Nov 2022 04:56:26 GMT

GET
H2 200 integrator.js Show response
adservice.google.co.nz/adsid/ Frame B216 107 B
792 B 819ms
273ms Script
application/javascript 142.251.12.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.nz/adsid/integrator.js?domain=cdn.aralego.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame B216 107 B
196 B 279ms
279ms Script
application/javascript 142.251.12.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=cdn.aralego.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame B216 492 B
265 B 303ms
302ms XHR
text/plain 74.125.68.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1260345923607549&correlator=4300357160861644&eid=31070746%2C31070789%2C31069102&output=ldjh&gdfp_req=1&vrg=2022110801&ptt=17&impl=fifs&iu_parts=18087395%2Ccookie&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=1&adks=64515409&sfv=1-0-39&sc=1&cdm=cdn.aralego.net&abxe=1&dt=1668141986142&lmt=1644386353&dlt=1668141983935&idt=2186&adxs=-12245933&adys=-12245933&biw=-12245933&bih=-12245933&scr_x=-12245933&scr_y=-12245933&ucis=plpn15orwv65&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&nhd=1&url=https%3A%2F%2Fcdn.aralego.net%2Fucfad%2Fcookie%2FcookieSyncIframe.html&ref=https%3A%2F%2Fwww.bg3.co%2F&top=https%3A%2F%2Fwww.bg3.co%2F&frm=24&vis=1&psz=0x0&msz=0x-1&fws=256&ohw=0&ea=0&ga_vid=471173982.1668141986&ga_sid=1668141986&ga_hid=2081374885&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

19ff5b04bbcfd2e53a7c97c80536f5ae547934907ed4344482f552add4c8e747

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:26 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 235
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://cdn.aralego.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
17646c402d303e08712c249a9a3e637d.safeframe.googlesyndication.com/safeframe/1-0-39/html/ Frame 2D43 6 KB
3 KB 840ms
278ms Document
text/html 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://17646c402d303e08712c249a9a3e637d.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 2988
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 11 Nov 2022 04:46:26 GMT
expires: Sat, 11 Nov 2023 04:46:26 GMT
last-modified: Tue, 25 Oct 2022 18:59:17 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.co.nz/adsid/ Frame ADC3 107 B
165 B 601ms
276ms Script
application/javascript 142.251.12.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.nz/adsid/integrator.js?domain=cdn.aralego.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame ADC3 107 B
165 B 278ms
277ms Script
application/javascript 142.251.12.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=cdn.aralego.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame ADC3 492 B
264 B 307ms
306ms XHR
text/plain 74.125.68.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4377299375855441&correlator=4043489387499469&output=ldjh&gdfp_req=1&vrg=2022110801&ptt=17&impl=fifs&iu_parts=18087395%2Ccookie&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=1&adks=64515409&sfv=1-0-39&sc=1&cdm=cdn.aralego.net&abxe=1&dt=1668141986362&lmt=1644386353&dlt=1668141983896&idt=2455&adxs=-12245933&adys=-12245933&biw=-12245933&bih=-12245933&scr_x=-12245933&scr_y=-12245933&ucis=o36z4dec13x9&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&nhd=1&url=https%3A%2F%2Fcdn.aralego.net%2Fucfad%2Fcookie%2FcookieSyncIframe.html&ref=https%3A%2F%2Fwww.bg3.co%2F&top=https%3A%2F%2Fwww.bg3.co%2F&frm=24&vis=1&psz=0x0&msz=0x-1&fws=256&ohw=0&ea=0&ga_vid=374168970.1668141986&ga_sid=1668141986&ga_hid=1411223860&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8628fec2e0ec18ab64160d7f13bd92107ada0dd4ad13bb0870ba79ea17a65ca2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:26 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 234
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://cdn.aralego.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
b62d5cd7b1c795de1a31bc172fc2471e.safeframe.googlesyndication.com/safeframe/1-0-39/html/ Frame 1B38 6 KB
3 KB 841ms
279ms Document
text/html 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b62d5cd7b1c795de1a31bc172fc2471e.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 2988
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 11 Nov 2022 04:46:27 GMT
expires: Sat, 11 Nov 2023 04:46:27 GMT
last-modified: Tue, 25 Oct 2022 18:59:17 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 6656 603 B
627 B 1028ms
476ms Document
text/html 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3216231935713038&format=1600x250&w=1600&h=250&ptt=12&adk=2733026255&output=html&bc=7&to=ampa&pv=1&wgl=1&asnt=0-2481623961037259489&dff=sans-serif&prev_fmts=1600x96&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&ifi=2&pfx=0&pwprc=1037897477&adf=470780615&nhd=0&adx=0&ady=3030&oid=2&is_amp=5&amp_v=2210272257000&d_imp=1&c=96212007888&ga_cid=amp-AAp9dXD6Zm2nR1d2DAAlKg&ga_hid=7888&dt=1668141985677&biw=1600&bih=1200&u_aw=1600&u_ah=1200&u_cd=24&u_w=1600&u_h=1200&u_tz=0&u_his=2&vis=1&scr_x=0&scr_y=0&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&bdt=4241&dtd=702&__amp_source_origin=https%3A%2F%2Fwww.bg3.co

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012210272257000/v0/amp-ad-0.1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 11 Nov 2022 04:46:27 GMT
expires: Fri, 11 Nov 2022 04:46:27 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame F890 37 B
407 B 290ms
289ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

b0ab688c82efa334d2f54e834db49c2c250405f024fe08540c60e7209fc76dab

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.holmesmind.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:26 GMT
strict-transport-security: max-age=0
content-encoding: gzip
server: nginx
vary: Accept-Encoding, Origin
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://cdn.holmesmind.com
cache-control: no-cache, private
access-control-allow-credentials: true

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame D4C0 37 B
409 B 291ms
290ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

5b1b5cc49d9a1e2a646e453d630f5263beccfb25809377e59ef6a1678999c329

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.holmesmind.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:26 GMT
strict-transport-security: max-age=0
content-encoding: gzip
server: nginx
vary: Accept-Encoding, Origin
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://cdn.holmesmind.com
cache-control: no-cache, private
access-control-allow-credentials: true

GET
H3 200 pubads_impl_2022110801.js Show response
securepubads.g.doubleclick.net/gpt/ 382 KB
129 KB 275ms
274ms Script
text/javascript 74.125.68.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110801.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

387dfc092f85b10bf8322f9f18a2b274e89eed297b9c02a336ad6b274552c1e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 11:58:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 233271
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131898
x-xss-protection: 0
last-modified: Tue, 08 Nov 2022 09:38:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 08 Nov 2023 11:58:38 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 109 B
97 B 826ms
276ms XHR
application/json 74.125.68.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.bg3.co

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57ba9c79273602051bd0fa9f6dcd52a3f199dc59f134308efeeaad35424b8311

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:27 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 72
x-xss-protection: 0
expires: Fri, 11 Nov 2022 04:46:27 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame B216 16 KB
12 KB 589ms
288ms XHR
application/json 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022110801&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

018ffd4b84a849fb30fa5ed673543057274e2160a9b8b5ee998978aa8c964928

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:27 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12524
x-xss-protection: 0

GET
H2 200 emome2 Show response
t.ssp.hinet.net/ Frame F890 30 B
278 B 292ms
292ms XHR
application/json 203.75.214.136
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL

https://t.ssp.hinet.net/emome2?u=b1c3b7bd-95f7-4c3b-bbda-6cc6e59d0a66

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

365fc555dbd2149871a77b9485dbb0cbd487a0553f7a90163444349fee756f60

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.holmesmind.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:27 GMT
strict-transport-security: max-age=0
content-encoding: gzip
server: nginx
vary: Accept-Encoding, Origin
content-type: application/json
access-control-allow-origin: https://cdn.holmesmind.com
cache-control: no-cache, private
access-control-allow-credentials: true

GET
H2 200 emome2 Show response
t.ssp.hinet.net/ Frame D4C0 30 B
278 B 291ms
291ms XHR
application/json 203.75.214.136
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL

https://t.ssp.hinet.net/emome2?u=edce82ca-49f3-4338-a029-73e3c0c320f3

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

365fc555dbd2149871a77b9485dbb0cbd487a0553f7a90163444349fee756f60

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.holmesmind.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:27 GMT
strict-transport-security: max-age=0
content-encoding: gzip
server: nginx
vary: Accept-Encoding, Origin
content-type: application/json
access-control-allow-origin: https://cdn.holmesmind.com
cache-control: no-cache, private
access-control-allow-credentials: true

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame ADC3 16 KB
12 KB 600ms
299ms XHR
application/json 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022110801&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d9eb5273909f69b02cf3a2e1aefaf82cda998976ca0e190d11b4a71041dae5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:27 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12556
x-xss-protection: 0

GET
H2 200 quant.js Show response
secure.quantserve.com/ 25 KB
10 KB 733ms
252ms Script
application/javascript 103.229.10.247
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/pbuseridscripts/quantcast.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.229.10.247 , Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: d3eb4ba7978b0c89ef74df200f23f3fd1f4eddc5889a9976cdb9aebef14ec67e

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:30 GMT
content-encoding: gzip
etag: "dGMVEkJqMDGUKmTNQCF+Mg=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Fri, 18 Nov 2022 04:46:30 GMT

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 2 KB
2 KB 441ms
150ms XHR
application/json 104.16.86.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20221111

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.86.20 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc2ce7f1079431f6f9178fd0a22eb376265c6aee52f88f05e5e3c9e98757266b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 11 Nov 2022 04:46:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 33691
x-jsd-version: 1.0.1520
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra-eddf8230021-FRA, cache-yyz4533-YYZ
x-jsd-version-type: version
server: cloudflare
etag: W/"66c-IXg0MJuBeSvQUhRbLGa222iWzxk"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S9yhUEG%2Fide4F9HDo%2B0ZM7hlKVzwgBJyj9JdCK3O%2FUqJ1z1dzyh26ylTyZIotjs12%2FNPdG25PFQFQnnk4NuzkRnggrmjZW03vCGamWEHJABBKtNwyoHtAaRVnN%2BNSwaBrAU%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 7684625f1ed7a808-SYD

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 376 B
1 KB 1405ms
434ms XHR
application/json 68.67.179.87
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.87 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

b3c91ea586c21fa06d824942d5f99aae73d35870e54a8c988e74c6139eed2e51

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:28 GMT
AN-X-Request-Uuid: 948d7c26-054e-4161-994e-3d3e614b8772
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.bg3.co
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 116.90.74.196; 116.90.74.196; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 376
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
547 B 1023ms
550ms XHR
application/json 51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

ec2-18-142-152-49.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
access-control-allow-origin: https://www.bg3.co
content-type: application/json
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900

POST
H2 200 adreq Show response
ads.servenobid.com/ 717 B
672 B 1228ms
405ms XHR
application/json 34.252.126.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=3034
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.252.126.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-252-126-43.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 037192b727defa55cc176629db61c9c71c1126decfae405ffc3b0fb355a0d705

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 11 Nov 2022 04:46:28 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://www.bg3.co
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
520 B 1214ms
380ms XHR
application/json 104.71.49.155
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.71.49.155 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-71-49-155.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:28 GMT
content-encoding: gzip
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Fri, 11 Nov 2022 04:46:28 GMT

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
212 B 1004ms
300ms XHR
text/plain 182.161.73.145
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=6.19.0&cb=41599498260

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.145 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 11 Nov 2022 04:46:27 GMT
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
access-control-allow-origin: https://www.bg3.co
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *

GET
H2 200 arj Show response
adpushup-d.openx.net/w/1.0/ 34 KB
5 KB 869ms
580ms XHR
application/json 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://adpushup-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=9c888016-5238-4cfb-a17c-592a2878b3cd%2Cfc32401f-40be-4c70-a18a-30540eaf0d18%2Cdff2c0cf-1306-4b05-91a9-06359bf633d3&nocache=1668141987362&pubcid=150614db-b978-43b2-a628-5714d0838f70&schain=1.0%2C1!adpushup.com%2C062d9a21f747ddee7c25d4297776e0aa%2C1%2C%2C%2C&aus=728x250%2C728x90%2C690x90%2C690x250%2C675x90%2C675x250%2C670x90%2C670x250%2C650x90%2C650x250%2C650x150%2C630x90%2C630x250%2C602x100%2C600x90%2C600x250%2C580x90%2C570x90%2C550x150%2C468x60%2C320x50%2C320x100%2C300x50%2C300x100%2C300x75%2C300x250%2C250x250%2C200x200%7C728x90%2C690x90%2C675x90%2C670x90%2C650x90%2C630x90%2C600x90%2C580x90%2C570x90%2C468x60%2C320x50%2C300x50%2C300x75%7C120x600&divids=ADP_42753_728X250_77a9c22f-ac02-45dd-96bc-b0896a8a7d5a%2CSTICKY_ADP_42753_728X90_d1c10a72-27b4-4931-8ce7-99a18ebbdbae%2CSTICKY_ADP_42753_120X600_104b282a-bd11-4d8d-ad64-0492063b6cba&aucs=%2C%2C&auid=545618347%2C545618347%2C545618347
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 44afb83e10456954924eeaac27c6f920ac32889db0924cd2c00ff2a589bdaff4

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:28 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.bg3.co
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4879
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET avjp
adpushup-d.openx.net/v/1.0/ 0
0

GET
H2 200 avjp Show response
adpushup-d.openx.net/v/1.0/ 106 B
297 B 532ms
244ms XHR
application/json 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://adpushup-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=5061e15d-ab95-4d88-9dd4-25340de71af5&nocache=1668141987363&pubcid=150614db-b978-43b2-a628-5714d0838f70&schain=1.0%2C1!adpushup.com%2C062d9a21f747ddee7c25d4297776e0aa%2C1%2C%2C%2C&openrtb=%7B%22imp%22%3A%5B%7B%22video%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A300%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22api%22%3A%5B2%5D%2C%22playbackmethod%22%3A6%2C%22linearity%22%3A1%7D%7D%5D%7D&auid=545618481&vwd=728&vht=90&vos=101&vmimes=video%2Fmp4%2Cvideo%2Fwebm
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:27 GMT
via: 1.1 google
server: OXGW/0.0.0
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.bg3.co
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 106
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 avjp Show response
adpushup-d.openx.net/v/1.0/ 106 B
505 B 530ms
242ms XHR
application/json 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://adpushup-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=2873d229-782c-4551-9b59-36770534d9ff&nocache=1668141987363&pubcid=150614db-b978-43b2-a628-5714d0838f70&schain=1.0%2C1!adpushup.com%2C062d9a21f747ddee7c25d4297776e0aa%2C1%2C%2C%2C&openrtb=%7B%22imp%22%3A%5B%7B%22video%22%3A%7B%22w%22%3A400%2C%22h%22%3A225%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A300%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22api%22%3A%5B2%5D%2C%22playbackmethod%22%3A6%2C%22linearity%22%3A1%7D%7D%5D%7D&auid=545618481&vwd=400&vht=225&vos=101&vmimes=video%2Fmp4%2Cvideo%2Fwebm
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:27 GMT
via: 1.1 google
server: OXGW/0.0.0
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.bg3.co
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 106
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 185 B
406 B 2154ms
318ms XHR
application/json 13.114.196.220
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.114.196.220 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-114-196-220.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: a69f4fdec421ee9bc88e5aa7d7e6578f431340fa7ea6f4e3abbbb8676c2e4279

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:29 GMT
content-encoding: gzip
x-prebid: pbs-java/1.104.0
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 174
expires: 0

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 185 B
407 B 2150ms
315ms XHR
application/json 13.114.196.220
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.114.196.220 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-114-196-220.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 92d0b34e55e74e517fcfef09ad750c4c488f96def632400127a669664c58b28b

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:29 GMT
content-encoding: gzip
x-prebid: pbs-java/1.104.0
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 174
expires: 0

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 185 B
406 B 2401ms
566ms XHR
application/json 13.114.196.220
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.114.196.220 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-114-196-220.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 2840f5c0abb6c321372bdf03302c2b3cbc041cba630d4a63b427b885484766b4

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:29 GMT
content-encoding: gzip
x-prebid: pbs-java/1.104.0
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 174
expires: 0

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 472 B
2 KB 1411ms
415ms XHR
application/json 69.173.158.65
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=20616&site_id=395958&zone_id=2209398&size_id=15%3B2%3B8&alt_size_ids=2%2C1%2C13%2C14%2C19%2C43%2C44%2C117%3B1%2C43%2C44%3B&rp_schain=1.0,1!adpushup.com,062d9a21f747ddee7c25d4297776e0aa,1,,,&eid_pubcid.org=150614db-b978-43b2-a628-5714d0838f70%5E1&rf=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&tk_flint=pbjs_lite_v6.19.0&x_source.tid=7a807f16-cb14-488b-8215-06336fe82c27%3Bf917a147-adeb-4c11-b871-1c2af8bbce55%3B687d02f4-39bd-4ba3-b01e-feef01ca1369&l_pb_bid_id=297fefd7a70fbee%3B309c27aa8a683ce%3B3171fe43246c9f9&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=3&rand=0.4559117966974924
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.158.65 Ashburn, United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 16530982df920afef0a97bfd6ce11107a5fcc59caf8679a182bf13eef01058a1

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:28 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.bg3.co
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 37 B
564 B 587ms
345ms XHR
application/json 104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=693656&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%2232c4613f1fc4d8b%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A7%2C%22msi%22%3A7%2C%22mfu%22%3A3%2C%22bu%22%3A3%2C%22iu%22%3A0%2C%22nu%22%3A3%2C%22ou%22%3A3%2C%22allu%22%3A3%2C%22ren%22%3Atrue%2C%22version%22%3A%226.19.0%22%2C%22userIds%22%3A%5B%5D%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2239c24d0f473c7dc%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22320x50%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22300x50%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22300x250%22%7D%7D%2C%7B%22w%22%3A250%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22250x250%22%7D%7D%5D%7D%7D%2C%7B%22id%22%3A%224263ee27f31ff44%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A320%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22320x50%22%7D%7D%2C%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22300x50%22%7D%7D%5D%7D%7D%2C%7B%22id%22%3A%2243470949c17e1e8%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A120%2C%22h%22%3A600%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22120x600%22%7D%7D%5D%7D%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22adpushup.com%22%2C%22sid%22%3A%22062d9a21f747ddee7c25d4297776e0aa%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22150614db-b978-43b2-a628-5714d0838f70%22%7D%5D%7D%5D%7D%7D
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.18.126 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eb91fc11f15aa1c57668b4eef231c2d180e7e5860214ac8788101fb4f500d325

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:27 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FLGTKZEuo6bYPwsRg21C30eZ7yzbS8iVgP%2BK46EWXInF28XxPa6ckgMyk%2BIxcfuvpdb4Uifg4AyvYqF6iej9%2FkAaP1MbgNGr%2BSnWYi7WpdZd8V54GBeojKyb0zMGx4b1rrvuLJRe"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7684625efb72ee96-AKL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 37
expires: 0

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 37 B
311 B 597ms
355ms XHR
application/json 104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=693656&v=8.1&ac=j&sd=1&nf=1&r=%7B%22id%22%3A%2232c4613f1fc4d8b%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A0%2C%22msi%22%3A0%2C%22mfu%22%3A3%2C%22bu%22%3A3%2C%22iu%22%3A0%2C%22nu%22%3A3%2C%22ou%22%3A3%2C%22allu%22%3A3%2C%22ren%22%3Atrue%2C%22version%22%3A%226.19.0%22%2C%22userIds%22%3A%5B%5D%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%224263ee27f31ff44%22%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22728x90%22%7D%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A300%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22playerSize%22%3A%5B%5B728%2C90%5D%5D%2C%22api%22%3A%5B2%5D%2C%22linearity%22%3A1%2C%22placement%22%3A4%2C%22w%22%3A728%2C%22h%22%3A90%7D%7D%2C%7B%22id%22%3A%2243470949c17e1e8%22%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22120x600%22%7D%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A300%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22playerSize%22%3A%5B%5B120%2C600%5D%5D%2C%22api%22%3A%5B2%5D%2C%22linearity%22%3A1%2C%22placement%22%3A4%2C%22w%22%3A120%2C%22h%22%3A600%7D%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22adpushup.com%22%2C%22sid%22%3A%22062d9a21f747ddee7c25d4297776e0aa%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22150614db-b978-43b2-a628-5714d0838f70%22%7D%5D%7D%5D%7D%7D
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.18.126 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eb91fc11f15aa1c57668b4eef231c2d180e7e5860214ac8788101fb4f500d325

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:27 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z8Wj5zeGpgJ5QvI54I8c9ZsusisGbfyah5duWD5aWbVytLVu9AM%2BBbLyCtKbRhHHERlUWz6Auqo37pN74SWZDSsCJg8%2F70E9q58XS1N8kJpsF62FL8Iy%2F7yzRdbIpnNJ%2FDT2kQNQ"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7684625efb74ee96-AKL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 37
expires: 0

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
167 B 1303ms
340ms XHR
text/plain 145.40.89.200
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 145.40.89.200 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

x-nbr: 8
date: Fri, 11 Nov 2022 04:46:28 GMT
server: envoy
vary: origin, Accept-Encoding
access-control-allow-origin: https://www.bg3.co
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1

POST
H2 200 auction Show response
tlx.3lift.com/header/ 11 KB
6 KB 826ms
351ms XHR
application/json 18.142.152.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=6.19.0&referrer=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&tmax=3000

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.142.152.49 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

782a6a6b4fe222c4256d6d5378e6588a51e296dcba5389d5ca7bb49e2b45959c

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:28 GMT
content-encoding: gzip
accept-ch: sec-ch-downlink,user-agent,sec-ch-ect,sec-ch-width,sec-ch-prefers-color-scheme,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-arch,sec-ch-rtt,sec-ch-viewport-height,sec-ch-ua-platform,sec-ch-viewport-width,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-dpr,sec-ch-device-memory,sec-ch-save-data,sec-ch-ua-mobile
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 5148
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 3 B
518 B 926ms
317ms XHR
application/json 52.41.101.164
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&CanonicalUrl=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&PublisherDomain=https%3A%2F%2Fbg3.co%2F

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.41.101.164 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-41-101-164.us-west-2.compute.amazonaws.com

Software

Resource Hash

37517e5f3dc66819f61f5a7bb8ace1921282415f10551d2defa5c3eb0985b570

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 11 Nov 2022 04:46:28 GMT
via: kong/2.8.1
x-content-type-options: nosniff
x-kong-proxy-latency: 0
p3p: CP="CAO PSA OUR"
x-kong-upstream-latency: 16
content-length: 3
pragma: no-cache
access-control-max-age: 3600
access-control-allow-methods: OPTIONS, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Accept-Encoding
access-control-allow-headers: Accept-Encoding, Content-Type
expires: 0

POST
H/1.1 200
OK hbjson Show response
grid.bidswitch.net/ 24 B
361 B 889ms
304ms XHR
application/json 35.213.117.18
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://grid.bidswitch.net/hbjson
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.213.117.18 Tokyo, Japan, ASN15169 (GOOGLE, US),
Reverse DNS: 18.117.213.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 66b45831513cf443b6cea96243c7821b5da3374b8bb492ff067beec10deb1a2f

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 11 Nov 2022 04:46:28 GMT
Content-Encoding: gzip
Server: nginx
Content-Type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
Connection: keep-alive
Content-Length: 49

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 1 KB
925 B 636ms
338ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUPEPKI9
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 5c5563507c376285447a841c5f6fe535632fa9b7ca3c141a4d0337cb9678c73b

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:27 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 101
alt-svc: clear

GET
H2 200 Preset.js Show response
adcdn.holmesmind.com/adserver/ Frame BDE3 1 KB
775 B 726ms
237ms Script
text/html 13.35.8.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://adcdn.holmesmind.com/adserver/Preset.js?z=14006
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.8.47 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-8-47.sin5.r.cloudfront.net
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: dcb59ec730a35ac2bdbeb1c87a33264a515c890bcafa7f942fbd3c7c48991f8f

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:39:22 GMT
content-encoding: gzip
via: 1.1 91085d9a0810fca6dacd51dae7dd6a32.cloudfront.net (CloudFront)
server: nginx/1.14.0 (Ubuntu)
x-amz-cf-pop: SIN5-C1
age: 428
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://www.bg3.co
access-control-allow-credentials: true
x-amz-cf-id: EPn3pebOTufBfDWMVDFm_2A3-duKq2fb6ZpYot3x-6k-Gint68pBBg==

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame B216 17 KB
7 KB 1302ms
747ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 11 Nov 2022 04:46:28 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame ADC3 17 KB
6 KB 1095ms
771ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 11 Nov 2022 04:46:28 GMT

POST
H2 204 log
aplogger.adpushup.com/ 0
53 B 298ms
298ms Ping
text/plain 104.211.156.162
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://aplogger.adpushup.com/log?event=glimpse_pageView&data=eyJzZXNzaW9uSWQiOiI3NzQzNzZfMTY2ODE0MTk4Nzk1OSIsInVzZXJJZCI6IjM4MjkxNl8xNjY4MTQxOTg3OTU5Iiwic2l0ZUlkIjo0Mjc1MywicGxhdGZvcm0iOiJERVNLVE9QIiwicGFnZUlkIjoiODg4NjQxXzE2NjgxNDE5ODc5NTkiLCJwYWdlUGF0aCI6IiUyRmElMkZkaS1xaXUtc2hvdS13ZWkteWktemhpLXhpbmctamktZmFuZy1rZS1odW8tcXVlLXJlbi5odG1sIiwiaG9zdG5hbWUiOiJ3d3cuYmczLmNvIiwidXJsIjoiaHR0cHMlM0ElMkYlMkZ3d3cuYmczLmNvJTJGYSUyRmRpLXFpdS1zaG91LXdlaS15aS16aGkteGluZy1qaS1mYW5nLWtlLWh1by1xdWUtcmVuLmh0bWwiLCJwaGFzZSI6MCwidXNlclR5cGUiOiJORVciLCJwcmV2aWV3VmFyaWF0aW9uIjoibm9QcmV2aWV3UGFnZSIsImV4cGVyaW1lbnRQYWdlIjpmYWxzZSwidGltZXN0YW1wIjoxNjY4MTQxOTg3OTU5fQ==
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/linkPreview.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 104.211.156.162 Mumbai, India, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:31 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 404 L2EvZGktcWl1LXNob3Utd2VpLXlpLXpoaS14aW5nLWppLWZhbmcta2UtaHVvLXF1ZS1yZW4uaHRtbA==.json Show response
cdn.adpushup.com/42753/ 555 B
819 B 662ms
662ms XHR
text/html 42.99.140.200
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/42753/L2EvZGktcWl1LXNob3Utd2VpLXlpLXpoaS14aW5nLWppLWZhbmcta2UtaHVvLXF1ZS1yZW4uaHRtbA==.json
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/linkPreview.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 42.99.140.200 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),
Reverse DNS: ip-42-99-140-200.pacnet.net
Software: nginx/1.18.0 /
Resource Hash: 6d83b77c3d8c5c0ccc7078540a1fb0bd9fa43eeb82b89f83264d469aa100c088

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: NZ
date: Fri, 11 Nov 2022 04:46:28 GMT
server: nginx/1.18.0
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=3600
server-timing: cdn-cache; desc=MISS, edge; dur=106, origin; dur=203
content-length: 555
expires: Fri, 11 Nov 2022 05:46:28 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 223 KB
77 KB 581ms
279ms Script
application/javascript 74.125.24.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Z0TZ7TDHS1

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/linkPreview.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

ee9d22e68afdc9d7a1ee37853adf6d921110e52b1a85efb73eeba8d936200196

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:30 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 78326
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Fri, 11 Nov 2022 04:46:30 GMT

POST
H2 204 log
aplogger.adpushup.com/ 0
53 B 281ms
281ms Ping
text/plain 104.211.156.162
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://aplogger.adpushup.com/log?event=linkPreview_failed_JSONRequest&data=eyJzaXRlSWQiOjQyNzUzLCJ1cmwiOiIvYS9kaS1xaXUtc2hvdS13ZWkteWktemhpLXhpbmctamktZmFuZy1rZS1odW8tcXVlLXJlbi5odG1sIiwidGltZSI6MTY2ODE0MTk4ODYyNX0=
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/linkPreview.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 104.211.156.162 Mumbai, India, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:31 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame F4D3 13 KB
5 KB 577ms
275ms Document
text/html 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 103273
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 10 Nov 2022 00:05:16 GMT
expires: Fri, 10 Nov 2023 00:05:16 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame FA58 783 B
1 KB 828ms
278ms Document
text/html 142.251.12.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.147 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f147.1e100.net

Software

GSE /

Resource Hash

cfe09976db12ddb1103b6438b854b4f80f361dd89b0185a8ff75ab02cc87a6c5

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-EU1keYYzumFi4jZfCrLHfg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-EU1keYYzumFi4jZfCrLHfg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 11 Nov 2022 04:46:29 GMT
expires: Fri, 11 Nov 2022 04:46:29 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame BA16 13 KB
5 KB 577ms
275ms Document
text/html 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 103273
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 10 Nov 2022 00:05:16 GMT
expires: Fri, 10 Nov 2023 00:05:16 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 6905 783 B
740 B 788ms
279ms Document
text/html 142.251.12.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.147 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f147.1e100.net

Software

GSE /

Resource Hash

4b354fda1133a7c90b0c34af3a51c269bfd35e4da60731137d7215b89db2b17f

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ve9WOL9IQbTIHDcTfhvv2g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-ve9WOL9IQbTIHDcTfhvv2g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 11 Nov 2022 04:46:29 GMT
expires: Fri, 11 Nov 2022 04:46:29 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js Show response
pagead2.googlesyndication.com/bg/ Frame F4D3 36 KB
16 KB 926ms
374ms Script
text/javascript 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a98bdefd73410963a41036b4bc4d25b080aaec85db7ebd132a12d3aa17e8586

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 10 Nov 2022 00:36:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 101374
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 10 Nov 2023 00:36:56 GMT

GET
H3 200 api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js Show response
pagead2.googlesyndication.com/bg/ Frame BA16 36 KB
16 KB 790ms
277ms Script
text/javascript 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a98bdefd73410963a41036b4bc4d25b080aaec85db7ebd132a12d3aa17e8586

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 10 Nov 2022 00:36:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 101374
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 10 Nov 2023 00:36:56 GMT

GET
H2 200 Preset.js Show response
adcdn.holmesmind.com/adserver/ Frame 3F32 1 KB
767 B 238ms
237ms Script
text/html 13.35.8.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://adcdn.holmesmind.com/adserver/Preset.js?z=14006
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.8.47 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-8-47.sin5.r.cloudfront.net
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: dcb59ec730a35ac2bdbeb1c87a33264a515c890bcafa7f942fbd3c7c48991f8f

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:39:22 GMT
content-encoding: gzip
via: 1.1 91085d9a0810fca6dacd51dae7dd6a32.cloudfront.net (CloudFront)
server: nginx/1.14.0 (Ubuntu)
x-amz-cf-pop: SIN5-C1
age: 428
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://www.bg3.co
access-control-allow-credentials: true
x-amz-cf-id: -Eqf2NRsdZU2iExZZgpBbcSZT3OsKdTGXov4k-tscYfHIICQbVw_Nw==

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame FA58 0
0 669ms
372ms Image
text/html 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022110801&jk=1260345923607549&rc=
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.200.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sa-in-f154.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 6905 0
0 765ms
469ms Image
text/html 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022110801&jk=4377299375855441&rc=
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.200.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sa-in-f154.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 publishertag.prebid.117.js Show response
static.criteo.net/js/ld/ 87 KB
28 KB 945ms
468ms Script
text/javascript 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.117.js

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

90c9017a8a6447588520f38cd94ba14cdb9839c92626aa06bb8a4a1052c2ab7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 29 Dec 2021 12:30:46 GMT
server: nginx
etag: W/"61cc54f6-15c19"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 12 Nov 2022 04:46:30 GMT

GET
H2 200 integrator.js Show response
adservice.google.co.nz/adsid/ 107 B
165 B 576ms
273ms Script
application/javascript 142.251.12.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.nz/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 580ms
278ms Script
application/javascript 142.251.12.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 91 KB
27 KB 856ms
855ms XHR
text/plain 74.125.68.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=108919251062736&correlator=407543131472121&eid=31070790%2C31070117&output=ldjh&gdfp_req=1&vrg=2022110801&ptt=17&impl=fifs&iu_parts=103512698%3A22574853003%2C22477626096%2C22479095528%2C22579309510&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3&prev_iu_szs=320x50%7C728x250%7C728x90%7C690x90%7C690x250%7C675x90%7C675x250%7C670x90%7C670x250%7C650x90%7C650x250%7C650x150%7C630x90%7C630x250%7C602x100%7C600x90%7C600x250%7C580x90%7C570x90%7C550x150%7C468x60%7C320x50%7C320x100%7C300x50%7C300x100%7C300x75%7C300x250%7C250x250%7C200x200%2C320x50%7C728x90%7C690x90%7C675x90%7C670x90%7C650x90%7C630x90%7C600x90%7C580x90%7C570x90%7C468x60%7C320x50%7C300x50%7C300x75%2C320x50%7C120x600&fluid=height%2Cheight%2Cheight&ifi=1&adks=1420297610%2C2857874404%2C4082231052&sfv=1-0-39&prev_scp=adpushup_ran%3D1%26hb_ap_siteid%3D42753%26hb_ap_ran%3D1%26fluid%3D0%26refreshcount%3D0%26refreshrate%3D30%26hb_ap_format%3Dbanner%26hb_ap_pb%3D0.01%26hb_ap_adid%3D76ec515cd384a03%26hb_ap_bidder%3Dopenx%7Cadpushup_ran%3D1%26hb_ap_siteid%3D42753%26hb_ap_ran%3D1%26fluid%3D0%26refreshcount%3D0%26refreshrate%3D30%26hb_ap_format%3Dbanner%26hb_ap_pb%3D0.01%26hb_ap_adid%3D771105c405593ba%26hb_ap_bidder%3Dopenx%7Cadpushup_ran%3D1%26hb_ap_siteid%3D42753%26hb_ap_ran%3D1%26fluid%3D0%26refreshcount%3D0%26refreshrate%3D30&eri=1&cust_params=da%3Dadx%26outbrain%3Dtrue&sc=1&cookie_enabled=1&arp=1&abxe=1&dt=1668141990546&lmt=1668141990&dlt=1668141981436&idt=9087&adxs=236%2C436%2C5&adys=60%2C1110%2C300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0&ucis=1%7C2%7C3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&frm=20&vis=1&psz=728x-1%7C728x-1%7C120x-1&msz=728x-1%7C728x-1%7C120x-1&fws=4%2C516%2C516&ohw=728%2C1600%2C1600&ga_vid=1042930634.1668141991&ga_sid=1668141991&ga_hid=7888&ga_fc=false&ga_cid=amp-AAp9dXD6Zm2nR1d2DAAlKg

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cf1f26cebe1fab9cff848784ed1cf5dcdebc04ab94712e085127029af094232b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:31 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27557
x-xss-protection: 0
google-lineitem-id: -1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.bg3.co
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/ Frame A31C 6 KB
3 KB 284ms
279ms Document
text/html 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 2988
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 11 Nov 2022 04:46:30 GMT
expires: Sat, 11 Nov 2023 04:46:30 GMT
last-modified: Tue, 25 Oct 2022 18:59:17 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame BDE3 2 KB
1 KB 782ms
282ms Script
text/html 52.196.174.187
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=14006&rf=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&n=883&o=1&d=1&b=2&ts=1&ii=2&FPCK=3302-XjJVpHJmOewoiMYXi0wErpQlJ2hUUO19&initver=210830P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.196.174.187 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-196-174-187.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 7eb7c412d3535d51096ed78fd47351100334c3e94ad903234167b38f85422de6

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: https://www.bg3.co
date: Fri, 11 Nov 2022 04:46:31 GMT
content-encoding: gzip
access-control-allow-credentials: true
server: nginx/1.14.0 (Ubuntu)
vary: Accept-Encoding
content-type: text/html; charset=UTF-8

GET
H2 200 rtbhouseV2.js Show response
cdn.holmesmind.com/js/ Frame BDE3 3 KB
3 KB 242ms
241ms Script
application/javascript 13.227.254.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.254.22 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-254-22.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d5ae5049686cf9a5ef6e9ceeae1c67619f218fd1694d39648b13607db871a3bc

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: null
date: Fri, 11 Nov 2022 04:46:31 GMT
via: 1.1 db75d9999621c662b2eccf4f496b12aa.cloudfront.net (CloudFront)
last-modified: Tue, 04 Aug 2020 09:25:10 GMT
server: AmazonS3
x-amz-cf-pop: SIN52-C3
age: 38
etag: "6a605eea47197fa280f27aaf1fa1521d"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 2773
x-amz-cf-id: Ar8QZo7er3t7HB4ZkUDRYcMJnH6g1rQAYComZyxFqcBFdO8rW077jw==

GET
H2 200 publishertag.js Show response
static.criteo.net/js/ld/ Frame BDE3 121 KB
40 KB 265ms
264ms Script
text/javascript 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.js

Requested by

Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

87f31cded62015a1d11cce6be7a32b77405de2fb36f4b8a7c2c5a4ccabd6a403

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:31 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Mon, 24 Oct 2022 11:21:19 GMT
server: nginx
etag: W/"6356752f-1e444"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 12 Nov 2022 04:46:31 GMT

GET
H2 200 criteoV2.js Show response
cdn.holmesmind.com/js/ Frame BDE3 2 KB
3 KB 250ms
249ms Script
application/javascript 13.227.254.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.holmesmind.com/js/criteoV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.254.22 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-254-22.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e2db1774aabd2443e6c741954f5e1071912a7a99f6e4151bc83d342554976d32

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: null
date: Fri, 11 Nov 2022 04:46:31 GMT
via: 1.1 db75d9999621c662b2eccf4f496b12aa.cloudfront.net (CloudFront)
last-modified: Tue, 04 Aug 2020 09:25:12 GMT
server: AmazonS3
x-amz-cf-pop: SIN52-C3
age: 45
etag: "e8f33fcb581483ced4a09b3c8e7550e4"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 2443
x-amz-cf-id: x3ec7rlNzGbJpC3QpSsnaLkXTRXC4a7HqRYOXiUq_uwO1IPJU8wjbA==

GET
H2 200 bridgewellV3.js Show response
cdn.holmesmind.com/js/ Frame BDE3 4 KB
5 KB 240ms
240ms Script
application/javascript 13.227.254.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.254.22 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-254-22.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c03c604cd89b4ab78da516a6271fbc1b4027e9d232ee55e09e0f43e49e2c169b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: null
date: Fri, 11 Nov 2022 04:45:34 GMT
via: 1.1 db75d9999621c662b2eccf4f496b12aa.cloudfront.net (CloudFront)
last-modified: Tue, 20 Apr 2021 06:25:23 GMT
server: AmazonS3
x-amz-cf-pop: SIN52-C3
age: 57
etag: "c3b948e5a48dd0ec20c265d6d8da7add"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 4530
x-amz-cf-id: 8JCiXToVjl99RbuxsmFyLsmNhRTV8aJI-43bKwE0Hiqn9FxmJ4kxTw==

GET
H2 200 appierV2.js Show response
cdn.holmesmind.com/js/ Frame BDE3 3 KB
3 KB 255ms
251ms Script
application/javascript 13.227.254.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.holmesmind.com/js/appierV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.254.22 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-254-22.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8d0f249f244376cc817d2c8ddd435cf01b4ecbeca604946c5ae81ef0c8bb5834

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: null
date: Fri, 11 Nov 2022 04:46:32 GMT
via: 1.1 db75d9999621c662b2eccf4f496b12aa.cloudfront.net (CloudFront)
last-modified: Thu, 11 Mar 2021 07:54:26 GMT
server: AmazonS3
x-amz-cf-pop: SIN52-C3
age: 42
etag: "548ed610a8571343fb3022f543174735"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 3177
x-amz-cf-id: nmMwfWoMMIBzJemPe0cyIX21NixIbXShj9gOKS7SU6JmNDgnIbZpLA==

GET
H2 200 appier_mainV3.js Show response
cdn.holmesmind.com/js/ Frame BDE3 6 KB
6 KB 255ms
250ms Script
application/javascript 13.227.254.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.holmesmind.com/js/appier_mainV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.254.22 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-254-22.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fe209c42003e23036615034182bbd3d224e3948a61e192953636b89c8a9ea458

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: QNf_HVa__9WDJ9903hLaQWAhMnzhWu2z
date: Fri, 11 Nov 2022 04:45:57 GMT
via: 1.1 db75d9999621c662b2eccf4f496b12aa.cloudfront.net (CloudFront)
last-modified: Tue, 18 Oct 2022 09:50:43 GMT
server: AmazonS3
x-amz-cf-pop: SIN52-C3
age: 43
etag: "b678af4b54f33f8ef194167ea87bc296"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 5925
x-amz-cf-id: F7cJIBhhptYQaHIy2oNYYmH0cS4z1b-WS1OWNTk9bkOVIg5HC7JmNQ==

GET
H2 200 rules-p-54Nt-1NAaEEe0.js Show response
rules.quantcount.com/ 160 B
634 B 726ms
235ms Script
application/javascript 13.227.254.2
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-54Nt-1NAaEEe0.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.254.2 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-254-2.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: edc30a0e05622f71d52d07a0b7b5e94e654ee06854f893be1954336730eb0db6

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:24:05 GMT
via: 1.1 a8c2772b03befab22b97b650361ac508.cloudfront.net (CloudFront)
x-amz-cf-pop: SIN52-C3
age: 1348
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 160
last-modified: Thu, 13 Oct 2022 15:29:19 GMT
server: AmazonS3
etag: "05b131079c67d484167fd1b1f6c79577"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: tuOh4f6Dc_QgDBkEqQPga79D5ltlvZnT5EsmXGExnmdrLrtfpXmIMQ==

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame 3F32 2 KB
1 KB 301ms
301ms Script
text/html 52.196.174.187
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=14006&rf=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&n=981&o=1&d=1&b=2&ts=1&ii=2&FPCK=3302-XjJVpHJmOewoiMYXi0wErpQlJ2hUUO19&initver=210830P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.196.174.187 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-196-174-187.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 7e2f3447682227acdd8a2a13fb8cb53e5409e3a329793367198fe5e54e5ccaa1

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: https://www.bg3.co
date: Fri, 11 Nov 2022 04:46:35 GMT
content-encoding: gzip
access-control-allow-credentials: true
server: nginx/1.14.0 (Ubuntu)
vary: Accept-Encoding
content-type: text/html; charset=UTF-8

GET
H2 200 rtbhouseV2.js Show response
cdn.holmesmind.com/js/ Frame 3F32 3 KB
3 KB 242ms
241ms Script
application/javascript 13.227.254.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.254.22 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-254-22.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d5ae5049686cf9a5ef6e9ceeae1c67619f218fd1694d39648b13607db871a3bc

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: null
date: Fri, 11 Nov 2022 04:46:31 GMT
via: 1.1 db75d9999621c662b2eccf4f496b12aa.cloudfront.net (CloudFront)
last-modified: Tue, 04 Aug 2020 09:25:10 GMT
server: AmazonS3
x-amz-cf-pop: SIN52-C3
age: 41
etag: "6a605eea47197fa280f27aaf1fa1521d"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 2773
x-amz-cf-id: yuNIpuEPXd6TJaTXhhVylL2CR1X24rtuibDSzmiKAV-KIabd0ovf7g==

GET
H2 200 publishertag.js Show response
static.criteo.net/js/ld/ Frame 3F32 121 KB
40 KB 236ms
235ms Script
text/javascript 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.js

Requested by

Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

87f31cded62015a1d11cce6be7a32b77405de2fb36f4b8a7c2c5a4ccabd6a403

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Mon, 24 Oct 2022 11:21:19 GMT
server: nginx
etag: W/"6356752f-1e444"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 12 Nov 2022 04:46:35 GMT

GET
H2 200 criteoV2.js Show response
cdn.holmesmind.com/js/ Frame 3F32 2 KB
3 KB 242ms
241ms Script
application/javascript 13.227.254.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.holmesmind.com/js/criteoV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.254.22 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-254-22.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e2db1774aabd2443e6c741954f5e1071912a7a99f6e4151bc83d342554976d32

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: null
date: Fri, 11 Nov 2022 04:46:31 GMT
via: 1.1 db75d9999621c662b2eccf4f496b12aa.cloudfront.net (CloudFront)
last-modified: Tue, 04 Aug 2020 09:25:12 GMT
server: AmazonS3
x-amz-cf-pop: SIN52-C3
age: 49
etag: "e8f33fcb581483ced4a09b3c8e7550e4"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 2443
x-amz-cf-id: rgiD-3fUc339un3MLCrTGTLzdd5R-h0cnYLogL_ZbdSYkz_OlwQwBg==

GET
H2 200 bridgewellV3.js Show response
cdn.holmesmind.com/js/ Frame 3F32 4 KB
5 KB 589ms
589ms Script
application/javascript 13.227.254.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.254.22 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-254-22.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c03c604cd89b4ab78da516a6271fbc1b4027e9d232ee55e09e0f43e49e2c169b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: null
date: Fri, 11 Nov 2022 04:46:36 GMT
via: 1.1 db75d9999621c662b2eccf4f496b12aa.cloudfront.net (CloudFront)
last-modified: Tue, 20 Apr 2021 06:25:23 GMT
server: AmazonS3
x-amz-cf-pop: SIN52-C3
etag: "c3b948e5a48dd0ec20c265d6d8da7add"
x-cache: RefreshHit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 4530
x-amz-cf-id: JAqApJg2Xb4VaZagyc-HHU93cveYjNi_WKI6uJKhoAWMReEo6NmB_w==

GET
H2 200 appierV2.js Show response
cdn.holmesmind.com/js/ Frame 3F32 3 KB
3 KB 242ms
241ms Script
application/javascript 13.227.254.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.holmesmind.com/js/appierV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.254.22 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-254-22.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8d0f249f244376cc817d2c8ddd435cf01b4ecbeca604946c5ae81ef0c8bb5834

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: null
date: Fri, 11 Nov 2022 04:46:32 GMT
via: 1.1 db75d9999621c662b2eccf4f496b12aa.cloudfront.net (CloudFront)
last-modified: Thu, 11 Mar 2021 07:54:26 GMT
server: AmazonS3
x-amz-cf-pop: SIN52-C3
age: 45
etag: "548ed610a8571343fb3022f543174735"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 3177
x-amz-cf-id: vJA-wJ8igjWW-bGluJmdrU1q01o2Bu02h_F-g5Q5fSdQZAVEf7V0uA==

GET
H2 200 appier_mainV3.js Show response
cdn.holmesmind.com/js/ Frame 3F32 6 KB
6 KB 257ms
257ms Script
application/javascript 13.227.254.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.holmesmind.com/js/appier_mainV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.254.22 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-254-22.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fe209c42003e23036615034182bbd3d224e3948a61e192953636b89c8a9ea458

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: QNf_HVa__9WDJ9903hLaQWAhMnzhWu2z
date: Fri, 11 Nov 2022 04:45:57 GMT
via: 1.1 db75d9999621c662b2eccf4f496b12aa.cloudfront.net (CloudFront)
last-modified: Tue, 18 Oct 2022 09:50:43 GMT
server: AmazonS3
x-amz-cf-pop: SIN52-C3
age: 46
etag: "b678af4b54f33f8ef194167ea87bc296"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 5925
x-amz-cf-id: HMjvvTHAxtbmTUC2kg76znOAEsBt5y715REWW1vn-MsDdhanhb1s4w==

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame BA16 0
10 B 274ms
273ms Image
text/plain 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?_eR9TA
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.200.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sa-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:30 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame F4D3 0
10 B 273ms
273ms Image
text/plain 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?UGGJKQ
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.200.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sa-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:30 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H2 502 landing.php Show response
fp.holmesmind.com/ Frame 43F3 332 B
482 B 9799ms
9274ms Document
text/html 34.117.219.39
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://fp.holmesmind.com/landing.php?CFFPCKUUIDMAIN=1854-1rrzahWCu6AIS59nm5OKx2miLWnjqAHD&CFFPCKUUID=3302-XjJVpHJmOewoiMYXi0wErpQlJ2hUUO19&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&maindomain=www.bg3.co
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.219.39 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 39.219.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 8128514a9917b6dcdf20f7ee24d6b00a27b2a6aa0f971acb988f358f25ac4005

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 332
content-type: text/html; charset=UTF-8
date: Fri, 11 Nov 2022 04:46:40 GMT
referrer-policy: no-referrer

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame BDE3 5 KB
2 KB 287ms
287ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL

https://t.ssp.hinet.net/utag.js

Requested by

Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

7484befc556b76b2da474fc9af0f8ac34a97d18a5ef62b9f7c4ea79e47bd29ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:35 GMT
strict-transport-security: max-age=0
content-encoding: gzip
last-modified: Mon, 25 Jul 2022 06:51:32 GMT
server: nginx
etag: W/"62de3d74-134a"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=600
expires: Fri, 11 Nov 2022 04:56:35 GMT

GET
H2 502 landing.php Show response
fp.holmesmind.com/ Frame 492F 332 B
392 B 9727ms
9274ms Document
text/html 34.117.219.39
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://fp.holmesmind.com/landing.php?CFFPCKUUIDMAIN=1854-1rrzahWCu6AIS59nm5OKx2miLWnjqAHD&CFFPCKUUID=3302-XjJVpHJmOewoiMYXi0wErpQlJ2hUUO19&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&maindomain=www.bg3.co
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.219.39 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 39.219.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 8128514a9917b6dcdf20f7ee24d6b00a27b2a6aa0f971acb988f358f25ac4005

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 332
content-type: text/html; charset=UTF-8
date: Fri, 11 Nov 2022 04:46:40 GMT
referrer-policy: no-referrer

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame 3F32 5 KB
2 KB 288ms
288ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL

https://t.ssp.hinet.net/utag.js

Requested by

Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

7484befc556b76b2da474fc9af0f8ac34a97d18a5ef62b9f7c4ea79e47bd29ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:35 GMT
strict-transport-security: max-age=0
content-encoding: gzip
last-modified: Mon, 25 Jul 2022 06:51:32 GMT
server: nginx
etag: W/"62de3d74-134a"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=600
expires: Fri, 11 Nov 2022 04:56:35 GMT

POST
H2 204 collect
www.google-analytics.com/g/ 0
106 B 580ms
278ms Ping
text/plain 142.250.4.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-Z0TZ7TDHS1&gtm=2oeb90&_p=7888&cid=1042930634.1668141991&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1668141990&sct=1&seg=0&dl=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&dt=%E5%9C%B0%E7%90%83%E9%A6%96%E4%BD%8D%E5%B7%B2%E7%9F%A5%E6%98%9F%E9%9A%9B%E8%A8%AA%E5%AE%A2%E7%8D%B2%E7%A2%BA%E8%AA%8D%20-%20%E5%A4%A9%E5%A4%A9%E8%A6%81%E8%81%9E&en=link_preview&_fv=1&_ss=1&_ee=1&epn.value=1&epn.siteid=42753&ep.error_msg=no_mapping_success
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-Z0TZ7TDHS1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.4.138 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sm-in-f138.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:37 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 89 KB
29 KB 941ms
470ms XHR
text/javascript 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.117.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

61c1317e433c125a2ebbbdaf22fc3a0b3606bcb0c9cfea151425adf7b5195f48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:31 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Mon, 24 Oct 2022 11:21:19 GMT
server: nginx
etag: W/"6356752f-16294"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 12 Nov 2022 04:46:31 GMT

POST
H2 204 bids Show response
prebid-asia.creativecdn.com/bidder/prebid/ Frame BDE3 0
172 B 709ms
235ms XHR
text/plain 103.132.192.30
RTBHOUSE-AS-AP RT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-asia.creativecdn.com/bidder/prebid/bids
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.132.192.30 , Singapore, ASN138552 (RTBHOUSE-AS-AP RTB HOUSE PTE. LTD., SG),
Reverse DNS: ip-103-132-192-30.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://www.bg3.co
date: Fri, 11 Nov 2022 04:46:31 GMT
access-control-allow-credentials: true
vary: Origin
access-control-max-age: 3600
access-control-allow-methods: POST

GET
H2 200 container.html Show response
4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/ Frame E64B 6 KB
3 KB 580ms
278ms Document
text/html 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 2988
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 11 Nov 2022 04:46:30 GMT
expires: Sat, 11 Nov 2023 04:46:30 GMT
last-modified: Tue, 25 Oct 2022 18:59:17 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 204
No Content log
bi.adpushup.com/ 0
119 B 722ms
236ms Image
text/plain 20.212.157.225
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bi.adpushup.com/log?pxRes=false&event=GAM_RESPONSE&c_b=11367.699999809265&data=eyJsaW5lSXRlbVR5cGUiOiJBZHgiLCJhdWN0aW9uSWQiOiJlODE5ZjQ2NS1mZDFjLTRhNGYtYWE0MC05ZDA3YzkzZTQ3MWEiLCJjb21wdXRhdGlvbklkIjpudWxsLCJzbG90SWQiOiJBRFBfNDI3NTNfNzI4WDI1MF83N2E5YzIyZi1hYzAyLTQ1ZGQtOTZiYy1iMDg5NmE4YTdkNWEiLCJwYWNrZXRJZCI6IjAwMDBBNzAxLWExNDgwYzQyLTYwNDAtNDVmOC1hMjhlLWZjOTdhZmQ0MzhjYyIsImNvdW50cnkiOiJOWiIsInNpdGVJZCI6NDI3NTMsInRpbWVTdGFtcCI6MTY2ODE0MTk5MTQxOX0%3D
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 20.212.157.225 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Connection: keep-alive
Date: Fri, 11 Nov 2022 04:46:36 GMT
Server: nginx/1.18.0 (Ubuntu)

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012210191347000/ Frame F992 221 KB
60 KB 574ms
273ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012210191347000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a79519048901b32cc426ca69b2e305b5644bcd0373f21995c27d19997e627c04

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 11 Nov 2022 04:45:56 GMT
age: 35
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61564
x-xss-protection: 0
server: sffe
etag: "84cdcac007f64412"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sat, 11 Nov 2023 04:45:56 GMT

GET
H3 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012210191347000/v0/ Frame F992 14 KB
5 KB 272ms
271ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012210191347000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f453198755f824befcfa757be6d917efd740f6c19270fbe4f8d98353517f8dc8

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 09 Nov 2022 14:43:30 GMT
age: 136986
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5198
x-xss-protection: 0
server: sffe
etag: "aeb1502543fb438c"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 09 Nov 2023 14:43:30 GMT

GET
H3 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012210191347000/v0/ Frame F992 94 KB
28 KB 272ms
271ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012210191347000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ffc33071954215c38304ae191ecb45e2c03e1e7f40e758dd2f944889b92e5f76

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 10 Nov 2022 21:49:47 GMT
age: 25009
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28845
x-xss-protection: 0
server: sffe
etag: "fdb7364f8f067758"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 10 Nov 2023 21:49:47 GMT

GET
H3 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012210191347000/v0/ Frame F992 5 KB
2 KB 380ms
380ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012210191347000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bfdcc3eaa2c1649211030b5caa1e03a40a1299dc5fac7ca8d57144d56fb9afc5

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 09 Nov 2022 15:02:51 GMT
age: 135825
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1912
x-xss-protection: 0
server: sffe
etag: "9f4a70ec77acc0d1"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 09 Nov 2023 15:02:51 GMT

GET
H3 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012210191347000/v0/ Frame F992 40 KB
13 KB 388ms
387ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012210191347000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e9ab8899832043bf5aa1f2c07cc6222bbf3dd450c4311bbbae045c37e8eb420

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 09 Nov 2022 14:55:03 GMT
age: 136293
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12946
x-xss-protection: 0
server: sffe
etag: "2923b90bb7365105"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 09 Nov 2023 14:55:03 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame F992 4 KB
1 KB 832ms
279ms Stylesheet
text/css 74.125.24.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f95.1e100.net

Software

ESF /

Resource Hash

099f342bcdd01d03cacd2d665bb82ed11b7110f74768ec40774de44140481a38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 11 Nov 2022 04:46:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 11 Nov 2022 03:18:50 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 11 Nov 2022 04:46:32 GMT

GET
H2 200 container.html Show response
4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/ Frame 33A4 6 KB
3 KB 578ms
278ms Document
text/html 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 2988
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 11 Nov 2022 04:46:30 GMT
expires: Sat, 11 Nov 2023 04:46:30 GMT
last-modified: Tue, 25 Oct 2022 18:59:17 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zh_tw.png
tpc.googlesyndication.com/pagead/images/abg/ Frame F992 3 KB
3 KB 274ms
274ms Image
image/png 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/zh_tw.png

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a956a6fe1ee57805393bf1781b32486b4ed9ca402a04320280e59a18bc348a87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 10 Nov 2022 07:09:54 GMT
x-content-type-options: nosniff
server: cafe
age: 77797
etag: 7688947696963022458
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3430
x-xss-protection: 0
expires: Fri, 11 Nov 2022 07:09:54 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/abg/ Frame F992 344 B
368 B 276ms
275ms Image
image/png 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/icon.png

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 10 Nov 2022 05:43:57 GMT
x-content-type-options: nosniff
server: cafe
age: 82954
etag: 6766994032117382215
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 344
x-xss-protection: 0
expires: Fri, 11 Nov 2022 05:43:57 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame F992 0
0 322ms
320ms Image
text/html 142.251.12.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTw9HRAhtnH4DQQra2wfOhzSsW8aPHzvGQg4C24HVmYk_fdRKYa9sq_VleAiLdoSEKs9wjYczcTQc7pOAjfkdaCa878WA
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.12.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f147.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame F992 0
0 289ms
287ms Image
text/html 74.125.68.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CldnEptNtY_OXLL_mz7sPw5KGiAOk3pjYa9rDm4XNELPtxMizMRABILqEwDNgq-yxheAYoAGr2JugAcgBCakCkH4H2_wxpD7gAgCoAwHIAwqqBLQCT9Cebx-qGLn4mwLIocc0bTLatEhWhTTZAw3RcMzsfO3EDKQBDG0FDnE5QpJMdll55IkzSxqjIxbzB4Ha94CIOx7bT-5gVA7s9Jdbj1Sy3BNRLhITTCp8xYW9l9n3tZojvtDLyqFax9HQLuFzUGALc_29fvjgWQsVjW_bQX1-2dJP2Q0OCR1Ejw6OiJp-sXXkIB73GxwWnZFVcGxhBzAJvcT-yeFy3zuj4SqFd5JNAVzA9yrfs1hxQvVwVozPVHX7oIDq_nikdLJQ_9X4hstFUP2HKivJdz0OAHb1Aj1s0xQeQogT7letOU55gWSW3AUyeja7Oqu9pkzJv4zYrGc70useJi_7WwkYdDf16fcRMRxO0GzB7F5EM4Q-rmZjLU5EJtIYsqBRpzt5L-dDW1QbjxxLtUbABNaKvZiEBOAEAZIFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBoAYugAe9p-TfAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcEEOiLA9IIDwiAYRABGB0yAooCOgKAQPIIG2FkeC1zdWJzeW4tNTIzOTkzODIxMzg3MDM4MIAKA8gLAbgT5APYEw3QFQGAFwGyFx4KHAgAEhRwdWItODkzMzMyOTk5OTM5MTEwNBjKqx4&sigh=4LdYqsGVqPk&uach_m=[UACH]&cid=CAQSOwDq26N9D1OUO62QOb7sr66XT4QCAc6gGRkHYi1qr0S__aPdP-aPhvbhjOFm_70kTKXeRDLPGqZCSrxpGAEgEw&template_id=484
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.68.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sc-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H/1.1 204
No Content log
bi.adpushup.com/ 0
119 B 706ms
233ms Image
text/plain 20.212.157.225
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bi.adpushup.com/log?pxRes=false&event=GAM_RESPONSE&c_b=11394.699999809265&data=eyJsaW5lSXRlbVR5cGUiOiJBZHgiLCJhdWN0aW9uSWQiOiJlODE5ZjQ2NS1mZDFjLTRhNGYtYWE0MC05ZDA3YzkzZTQ3MWEiLCJjb21wdXRhdGlvbklkIjpudWxsLCJzbG90SWQiOiJTVElDS1lfQURQXzQyNzUzXzcyOFg5MF9kMWMxMGE3Mi0yN2I0LTQ5MzEtOGNlNy05OWExOGViYmRiYWUiLCJwYWNrZXRJZCI6IjAwMDBBNzAxLWExNDgwYzQyLTYwNDAtNDVmOC1hMjhlLWZjOTdhZmQ0MzhjYyIsImNvdW50cnkiOiJOWiIsInNpdGVJZCI6NDI3NTMsInRpbWVTdGFtcCI6MTY2ODE0MTk5MTQ0Nn0%3D
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 20.212.157.225 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Connection: keep-alive
Date: Fri, 11 Nov 2022 04:46:36 GMT
Server: nginx/1.18.0 (Ubuntu)

GET
H/1.1 204
No Content log
bi.adpushup.com/ 0
119 B 682ms
233ms Image
text/plain 20.212.157.225
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bi.adpushup.com/log?pxRes=false&event=GAM_RESPONSE&c_b=11395.5&data=eyJsaW5lSXRlbVR5cGUiOiJBZHgiLCJhdWN0aW9uSWQiOiJlODE5ZjQ2NS1mZDFjLTRhNGYtYWE0MC05ZDA3YzkzZTQ3MWEiLCJjb21wdXRhdGlvbklkIjpudWxsLCJzbG90SWQiOiJTVElDS1lfQURQXzQyNzUzXzEyMFg2MDBfMTA0YjI4MmEtYmQxMS00ZDhkLWFkNjQtMDQ5MjA2M2I2Y2JhIiwicGFja2V0SWQiOiIwMDAwQTcwMS1hMTQ4MGM0Mi02MDQwLTQ1ZjgtYTI4ZS1mYzk3YWZkNDM4Y2MiLCJjb3VudHJ5IjoiTloiLCJzaXRlSWQiOjQyNzUzLCJ0aW1lU3RhbXAiOjE2NjgxNDE5OTE0NDd9
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 20.212.157.225 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Connection: keep-alive
Date: Fri, 11 Nov 2022 04:46:36 GMT
Server: nginx/1.18.0 (Ubuntu)

GET
H3 200 6592766407814317453
tpc.googlesyndication.com/simgad/13094608949199738707/ Frame F992 31 KB
31 KB 278ms
277ms Image
image/jpeg 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13094608949199738707/6592766407814317453

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0dc6b3a9c4a2129c94a5f47dcceca6e0e8e6a522f2ab6eab1866d5a9de19528f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:31 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31559
x-xss-protection: 0
last-modified: Mon, 08 Aug 2022 01:16:12 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 11 Nov 2023 04:46:31 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/4925454681866407537/ Frame F992 1 KB
1 KB 417ms
416ms Image
image/png 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/4925454681866407537/downsize_200k_v1?w=100&h=100

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

82a9e4ee02f1964420517a08469c1279b6f56386c43442de78a99261a78d4279

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:31 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1446
x-xss-protection: 0
last-modified: Wed, 28 Jul 2021 05:01:39 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 11 Nov 2023 04:46:31 GMT

GET
DATA 200
OK truncated
/ Frame F992 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4f715a684a3d86bb45d9b806f874a4415355a45ed74f2e075b2bd7cf3b673e10

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 204 prebid.aspx Show response
prebid.scupio.com/recweb/ Frame BDE3 0
161 B 1117ms
289ms XHR
text/html 210.59.219.181
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.scupio.com/recweb/prebid.aspx?cb=0.7747052397370515
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 210.59.219.181 New Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 11 Nov 2022 04:46:31 GMT
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
content-type: text/html
access-control-allow-origin: https://www.bg3.co
cache-control: private
access-control-allow-credentials: true

POST
H2 204 prebid.aspx Show response
prebid.scupio.com/recweb/ Frame BDE3 0
27 B 1117ms
290ms XHR
text/html 210.59.219.181
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.scupio.com/recweb/prebid.aspx?cb=0.7126459326930472
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 210.59.219.181 New Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 11 Nov 2022 04:46:31 GMT
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
content-type: text/html
access-control-allow-origin: https://www.bg3.co
cache-control: private
access-control-allow-credentials: true

POST
H2 200 cdb Show response
bidder.criteo.com/ Frame BDE3 177 B
427 B 237ms
236ms XHR
application/json 182.161.73.145
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?ptv=132&profileId=184&cb=83039880417

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.145 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

74771a329cf27f400d9411a0139f4712ba3e1a1ede02ddf719cd9d22ffe408f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Fri, 11 Nov 2022 04:46:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bg3.co
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 163

POST
H2 200 cdb Show response
bidder.criteo.com/ Frame BDE3 177 B
427 B 237ms
237ms XHR
application/json 182.161.73.145
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?ptv=132&profileId=184&cb=29615819950

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.145 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

e81b6043c9f3a82968ac1fd456204f5ed0af479159aef0d5ed40b78e44b4d133

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Fri, 11 Nov 2022 04:46:31 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bg3.co
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 163

POST
H2 204 events
bidder.criteo.com/csm/ Frame BDE3 0
211 B 235ms
235ms Ping
text/plain 182.161.73.145
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/csm/events

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.145 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 11 Nov 2022 04:46:36 GMT
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
access-control-allow-origin: https://www.bg3.co
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *

POST
H2 204 events
bidder.criteo.com/csm/ Frame BDE3 0
211 B 235ms
234ms Ping
text/plain 182.161.73.145
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/csm/events

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.145 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 11 Nov 2022 04:46:36 GMT
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
access-control-allow-origin: https://www.bg3.co
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *

GET
H2 200 drawV2.js Show response
cdn.holmesmind.com/js/ Frame BDE3 10 KB
10 KB 262ms
261ms Script
application/javascript 13.227.254.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.holmesmind.com/js/drawV2.js
Requested by: Host: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=14006&rf=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&n=883&o=1&d=1&b=2&ts=1&ii=2&FPCK=3302-XjJVpHJmOewoiMYXi0wErpQlJ2hUUO19&initver=210830P
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.254.22 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-254-22.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f3fc929a36ee5db31a8a9b4743845474bdeb425edb019eb4e75a441cdb8ab032

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: null
date: Fri, 11 Nov 2022 04:46:36 GMT
via: 1.1 db75d9999621c662b2eccf4f496b12aa.cloudfront.net (CloudFront)
last-modified: Fri, 16 Oct 2020 09:58:46 GMT
server: AmazonS3
x-amz-cf-pop: SIN52-C3
age: 11
etag: "84d8b1a745228113e60f5e62f0eff6d3"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 10359
x-amz-cf-id: Ns6wV1x9n36fq9pHk7ESaoB9Q8RvxxEmnjGRkNVwA4klRJLUT8ORiQ==

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame A20B 624 B
288 B 580ms
279ms Document
text/html 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COXuopICELGQ6u0CGOeI-9UBMAE&v=APEucNX0da73oJE-k_3wJLRdPTl79aPynLvG2FcNHpDAIKzd_BTlfVFUl56cFcOJjVFq2Il_BJhbNrLTzD4z05DNYt8l_WsFkA

Requested by

Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 11 Nov 2022 04:46:32 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame E64B 15 KB
11 KB 608ms
308ms Script
text/javascript 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BgxnjbE11OvFnpRSjwsDWzGGQUYuAhb2IJn4GbCl-WImGgLfUgRgy5NkzX_04wFmd5V0FpKKd5YpQNBFz0XTSt4asabqpOkNL0-iiVlkAETmMthhiwU3Xcgk8qs2PoxWXkn1ckY7QOijEx4DeGHQyBI8OPYhrMd3VLtSUKMhNKt_iKS1s&cry=1&dbm_d=AKAmf-Bxxz8LI53bmOAFtsvg8bgQZp_uTp5pLxTYjJ0IhlouuTIEULE_Unadt8GZb-WSHyhQZoGHZ2QqLxbFLM-wV_y6LABIruVLdNxJAOFjaVPpZHE61V6Y0nwbPXurWQ45TeSLnhm_DPMhspe3IPzbGHdnRY6HYtyErJlzQo53oxOJGuURw3EHH3WhxI_f6zGdL_lop2uOyPmizCcPL41CVQRHvamgAtu2wSZpA6Z9Mt55T27Vk2Or31-v3SmFrFGEyoo4uu_wvbhNm8tUi24tLBBx6S0ZfM1hW-hzq2EqlS4_7vgkVW8VkvAXsNYCcJHnpOAMzQES5GowRbPZAXFQNfUNBkRMt7p0kz01ls8l1VzfU_JwUKtLAN56RXuYHCpbRTN1rL3odbQkqywdeQ6pl5-L1_rGg3KM3P2eGIrr6veKpB_0VyOri7273Wj5_QJKEEXy-mS_aOP2LUzOuk9t_9kK6W3wx-YITNeyrJvNqATR22mbAR5b0k5WpZphTU2_L21gxI1tJfk0n7sZqJWjPxYWWSOQb9NNiJLgGYo4wlVyru0o4z1oldCwSdTD8-MyNlZijDDRvODWEOSFehclkeqTGmAy6HRyjmA8chDPnm0vwrwey6_4acH_rLud7_53Vo32wxOVu_0N0WC25q7_nyQ2zKQQJNDPVyQiy4TcR4wvUDowty_rzlefYkWDRMKcj1IKe_kta_xEPnPhiQilaKCuW05GkxyKRO0VQmPe2XvzBskNrQUkAALNJxSLA0Ornq-KNn1hcLi5cim3YAUp0uwADtw_eqrzEqIAMZmuOaBHN63mv1BPMerOt69m00ThNcbhRsfxOUEeAwdoJsMnDeO2i-Lgi0Qy-KoXLaBURFMunup85UkbPmnW3xjEysgbBFq6IRUTxN57rQCHv7JJfqBPznQUQA0sRi0hCszdksyw2FoRAeLBJtRPi41IsfOwUuu2L5CHznEXIlhlUzE7X6JEjdCBLgDDUtuD8mQDuncD2-sV17Y_Bj5e37cuTo-IW51shqvn-SmpoK4sVDRG8Oa82U7AzbvfHaT-JAbsp2HwW8sEqG2_Wyz3037w2ZHItlX_w676y0wQzZz95pkezzexSYE7dTz5DJhimGo0kKWwsFzUb9rCCp3cKDcdgZD3JUXLn9iD5nGgNWpgkvErGSJHkM5pbiZAZ71JOnG5RvYLadTxV8vXorAY5_vJE1mq3a5fkpR7qXzb69zWeqFGegSMdeXX1XnOikTO9rzreJPxCL70EGHvRZ1M1gxZ3eV_ZJKSzHbeUqTaEUMPX8yMpaZbnJuM34UbjstF-ilH62zeczViC6nFerN9VMC3S0bHngX_Bw9wuJ66mn_0Nf4_f-PJmuBCexO6nysEOtNGCO-ywb91UyvYWquA3XOkFNP-APDh6aAvf1yp0ygY9US4lzb9ae-rGBe2K3zOPSJYCNaNLabtb2-3p0jlrKPtlSLpPIXc81HdfklMR1kB9h0_ad4gWopfEnpgjuwT5yRMIemjtQufX7Sa9M961lQcl2zdBLbGvY4QoMXKBS52U44a7Tgv70s3jgH-zwm2GU2iM9hMp0GIuNquz-i79k2jK5-fQzDsWpr5qMOIXpSCwPWIBilwNhZ8yviTIzhO_nUPMfvDqu6gl13WISkl0MsgHyRBdal1HuA1AvSnFK8WzsrXiTWMTLim01i4rc-zvUWjMksyGBW82Uix4Vfv2mytoG5wWv6zaFni9b0Dj6bLnYmMqJNNWM_y_RrraQmIcWWwlj1Dxy1K4FZQwcL_E-0LGhIYHdTOp5scZDmM9EenHEcQ8RMTa8hZZB68chpckFNWGnHNr8Gm3WhXyR5911kj0_12Tx4qLU97i93n76w8xPSGI5VtjA7cUsYWVTV_MtHw3Vpb68LKeEGmn128L_qxXZ5_2TjzOY5ZZzy-FM8ehsfYYLLgMFO2A0f4M4INfbYR4pRT8agXmGybDC2S1gjPcrl0brnw1s6GcG_HDiIOGl_6Ova5vqwTNrIk7h_H8S8PfSphqMZ4iOSBCb4bagojFT3NQNq1IOGENYjQPofFQx3Bf1c5sfHzlOmzLBjEGsxtzXDjqjS6RuCj8QLu606SLv9fuvtanZjVhbOMckkt1rC51o6mDmWNKfh70OBnPpx99aK7ylRt2xYZs8t1EPUqJLnIugyvUdXHh83NwRHQbaXX7f9poro6rgF1Wo5lIVCGofTDNw3Zru5KCmjA2Xv4PoRcdxuowJwk515o6egDBRa4gZkQb-t8ZnrhVByfcLHkonRXKjZU1kX_NbZiWs0hulVBHXob6OEECdCbRKmJHdScotAc5cTaljXRTKhQLn-l7vv1uaPOzhSYxGd1fBHXSf9w81VDkA0kBMbFo2qm74drICmOUus53eiTx6TFNsVU2DctOHSdMOmJisED0Kn4uz3lwz4_RKuwUuJEBoEvvAlSTKsY2qwc15qF_9w2EQ0RsRkvWZYaU6PsHaOXMgOITr7uKAHIevr6MJiGbeW17InCuXcLRHwbCrpy9rPEkRHpOjXjnq0sxrKXNEIv4orpNRvPRmO-dxITPyFHcBhyqJj5LKmfFCBgFMODOl_vT3yUjVkK0dzfdqNrh9wpNU31u-fDDMDHCjR8keeFhSYKqhpj-dl76LzKCbh4fZnxwKjsQ3j3k23kTuUd42bUEyAsR5ESlmlgrmD57sW6coeHpUNrp2Og1AteJ-hoYgoJJekYdTms8LuNUUVyhE2R0ITpDP2XvoWrX8RlruwFXCJjQ5mMFPoZMZNwa3MaPtJCQ5UrgwEmczs5f7jWiqZ-4M3nWiZjOeBQHhv0zs3LjYRNXvAoN81oTvgj6ZrIJ0QCHxzPW4pQv5WQ75b9sFcXHDbc8R92YFW8M-1Geh-CR8xqnz4vW78v-aZuX2TiANPe9uFPtLTIqfCwEI7YPoyK_1dAgPAWjUtc72Y62iiNeisSUotNhyAqDPhJAXd0TPOdw-gvp3hd_IeE7N2415JmS1LKl8E6lq674cWQ0Svut4Dp-bxOXFF7-oTbH35WWJrudzatkE8rZ6yMEKKrS8how-SLs26B97Mq8k-OJIDPKfF-j9iM7bqes02xbq9UJfCwKG5StG6WUxwi8veF-hXoplQ0FLyiAHdM5YQGPsQWrFqFtKNGjPqu_LHahbBS5KQ476YfzMhJI5qVJXmqch6va85OG8pFIRZDRO3w_4ufasP4uZpBg15gKnbwNP2qzcsjEZVM9tPRUwBaBuGR2we4Za8JdlotlgICiqHzO5FpeWYWkrCLOTeIuyxn_c23p43hkZ0L6gB05LnH5r3T56wGnSQbfzWm3DMNeN0adc_idJ4IwLAKzOPTq61UDiPON7quEP5RQNFlC2SHRsbVaIAa_6ctAshDfjyXAL90fxsnLrSiE7MwqpnuBVX-NIBQjb_825M_iz7RRJIztkY1l_wVU5i3i8AQqDtIv1jOSHbZlcQCLqTHdjhsGiKxSQ&cid=CAQSOwDq26N9D1OUO62QOb7sr66XT4QCAc6gGRkHYi1qr0S__aPdP-aPhvbhjOFm_70kTKXeRDLPGqZCSrxpGAEgEw&rfl=1%2Chttps%253A%252F%252Fwww.bg3.co%252F%240

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0091a27319e9ae84660e322711fa5234ad77088a2488c0ba3809d9766dc5ee9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:32 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11264
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame E64B 42 B
63 B 279ms
279ms Image
image/gif 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BLGCZcj5V9ixRejWl_Hn95f9XkWu1mft4fZ_IK2CW4LAVe1a7JasjBHvyxIaHitrZm58JGGYvgFDQtmGBgVr2fYP8Yo9peJk2SWfsKXDE7DbI2V80

Requested by

Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221109/r20110914/client/ Frame E64B 3 KB
1 KB 274ms
273ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221109/r20110914/client/window_focus_fy2021.js

Requested by

Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 10 Nov 2022 20:31:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29709
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Nov 2022 20:31:23 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221109/r20110914/client/ Frame E64B 18 KB
7 KB 275ms
274ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f841e16a15c87fd62a9fd964cbe0f0a42e8c4a890a8b4f706729c0cc53054dc2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 10 Nov 2022 20:31:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29709
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7417
x-xss-protection: 0
server: cafe
etag: 18318620284716439044
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Nov 2022 20:31:23 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame E64B 0
0 615ms
314ms Image
text/html 142.251.12.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRXGAy1A97sYgQb-SykAEq8hFmY1LPYC06YXUzrq3RUwjbpG3dRKrz_c1r-WsNSzddG4gzc3CtM6jH18N4lDob1uPzLfw
Requested by: Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.12.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f147.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E64B 154 KB
47 KB 1658ms
1096ms Script
text/javascript 74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

74e5d27c3ce88edecaa16bdd847929fae0ebe21d23da8e419564ced5bd844977

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48226
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1667997631252355"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 11 Nov 2022 04:46:33 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 8CFA 640 B
308 B 583ms
278ms Document
text/html 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CK6UTBCO3LwCGLvB5dQBMAE&v=APEucNVtCYeUcrbwUESlW7IVLmyQx5SOdMVgjqotAD-oFbfT6b5cq74wgWUhiplq9KXryaN4tgKNL9tk8LlmtwTGxzlNoD_J_A

Requested by

Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 11 Nov 2022 04:46:32 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 33A4 68 KB
33 KB 642ms
340ms Script
text/javascript 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AxxTPaXvBsB1Yc4VtrC-EQKtE6iZ-2Z6YfNnaa8eJ8x9Zetmj75KWKSVo1IRX37gNUhu6eJ_6ykulenjA0qp0aDAGmHg&cry=1&dbm_d=AKAmf-AQjAHg3tLIt1Baf5ZZ5oPRdcw2nxWGLErzgA1oa3tOjzvJUuPLBJ8XRKZ7LEmYNFrER3VBqxMv-309sfMEMSl0kYaGsyIsyYfpQrBEtA7x3XtzsnfetmMpZcGPUiNaLj9_RtNf8R0VA-kLRPUL9VpzG8tD9KZEeLuAec3xD_q2uwx8_xNyYsZmQJTNNboDtHfvcweVmQ_a_Hbr-k7jEWTldv-6oDT8NYQhWHs7vCeX4EyChaIHC19BoLqTAEEg2hkcSq2grw16c4BUnL-YzLCytT2M2QLT-pCkNKHXMsbdu0nAGSxUy3q7si8SSZnOVvUXAURvrSYH5lY0H3pm2G_mM5t9bJvDz3z6TlQN29KOijrSqDXep4d2PMWlH0spWYyzYCid1LvDbXU0KVfFMTDd60rXU8TR1tr6k2VeTkJaWHWXZmkWgu1zKVhY6acd2oU9lYikHuPsJOLiBPjw-YP7P31cr2MvPQ1I_lkiWtKigRcOHYAdcpjBrnFMj8OOfL6uPMHs4-jN8X1j_h6jG-prl1hiv5mZXAlbgxRhNDsL2QHAR3YQFqfArah7x0KRWgDy6U_w7RSVDIyDZm-kqwcQ-yqBrVXJWOfTXfIiyb-_3DYLJz_sDZh3a_8t6AAqbCfoki6VExBpO1NlvgQK9pkIEqgYd3U37g82XIHzeBnvkpmT3o_NYrT8MNn4Hmzel-LyJ-nEq56FdXygYMZh0B0GTLI_IjrpFYlQf-w2pwgBl4LeaH0k9iUUPYipMuXJHcCQ2tkCYwJqA7Q9TMXR5OC7zvC-tw0NGFULZOqSP9k1LvJmEhDs7sa2taWF6L5sRurvr4EbZ4VqSc9lnu5fkRXo1ZDu7Nb0edYPyOQtnCAHS6va1pDIMXQ6kWvo60Juz8cQKWQLMS50-EeoKkRZj7HXJ_qjT2EyNU43UNb3MAZbq-UAwleLHJ1CjwGjxqFdWxx0aa3hML6aWh2UkNO5yf44wkP8kOkQsFFdydc4PlOKp51hC_a28I0oMEo-PzDdcypaETFEf0ABcGf8_7F2B9fYkuX45Pj_nrWNRcOQgQ55HG47Lp-Cjl8fzrAJzf0ZLKPDYRHMfCDw-5IAc5dXkNnIzZprhlWP1o0M99wTKgH6b6QggFfUGfjkGj2zGq9EqA3qxKf0Cu5YVY6eUlAnlAGek3nOAqwdKrGUYDHqXhsks7jxJPj8fcpjbqxPbYUeyk0LpjiyyZIpMX5A6QSpJPLknzEbMlWB2zEjdwqhg6YlwBHBPY_TsRA0K29wxSrVwtwXgqhKaXtruAUJKPUQcZoT9o0SMmR8V6at5OwhTCWdFS6HtRvzd317gDZ-Ts1TF7UPletCxUFnEPFkuX0PxCVf-OY51Um8uwiYrTv3qR3lqLcNZ0iqrv_GQL5rH2KQm-ftOiUHYiWstQHAvd14uq0TwXv4WUZbaNyRLAknLisFocXed65a8hh0gBJamGK3o74r5n0U0pQEHPM6pnfLvNqRokmQYV7UhJrr2PrRh1-NzijBAU2nnCvPuE_UmFI81xFgor6IDeN6MZSuqplXvJpT6Z2KGcfnAnvVojyD749sm0e9x5RHf7Pg4imXmIknkUKZ8od-ai8Wcp191eA4gSIiDSs2yvhyWY91jwFasjMj1x4KvPpnAv_e1F3TQqHeJt-342u8sNtea2I_SpsJG-ZHPBH4I6y2BLa-z5lf5NM--8cjhmIOH3K_-XUiRTWHNrX8ieyW1TCbbRdAerZXAL_t0axwsku_FW1zXrGe9TaSxINhZ1peTT4USgjhxwSy-VR9PjM0U_a0yYQvAUirat_uP465ea__N63QbYxZt3BYrtIfigyt_HfWLmTo0z9MGHoXKX0RF3wWSF5fFryyDq6J7UD7gWuZhycmWmXClCdnVsTOWWulpXUDj1Qq9I-jmOEjvzg-YYZLg54rp069mFKXJHjGkfzgjgm5cnt6CHbMqZ0G4y5BMb10dFrVTVMTkBKLBXesKa0D2f9275bldbGzvDTMQlFzL2h9egAw3TnJEscCgPcfgdgUAwEZuGMQqhqjhuKOZijH_yD9BQmzTsz32whpr4EZrtXDGvt5MZfFTrIITndZzyFP4dlcAoSH4Nvn6XxryssB0gmquVOI6EIL6OXTuQPaQIST7Ecj6xmKhP74czEsA9YivQ72oZkVaUpJyDkWcaT3PFQo4_sJ7jDDTOne5PbyeXSO71dswA-KIq4p6zvwWWwYHgClsvvi-itGP0MuCa6mv5Jrn2rGrXL6skJHQVeS3BViKYzMbOZv57jCmyl5afrdcnULv8qIGKIPuIrCOSrwpDleZLxW6Z6lrSVPNHE1qhjpy2RKl8ZArjkv6HEe82iLe6ZT4XFTUZpAy5y-DUHxLihBCEDxPWCayqN9yY1qa_CiLtvAcGMMH8UyN_hBCsaT6qwq4Ugwk0ADPRJKN-B5Qx9xh-0NeU5esG-BXhYoqEqVn6rzxYGnKx4kqwTz6p6epb6w_ZkNINplyj60lsVx9UwK58wcV__InOCIhBrsSZR8IFjlqKVs5T7mkxO6v2XNR18-3riA0Ev3k5hwYUCU0PsNh5whw8uE4ijGMznUsX3lHap6pi2UF0yGmrBvtX7c7TIAXQsTU9yVZVPEMLGVc20R2mpNrNagd15CSdx2T6a4wolDiy04FjOfv8_561NEdEa5c1cMCiFD-_VAr7Iv0pHCgMjCbTvI29uwJ5hzx5ZIxkmQ5IveI0QcbkCbP7Bx85Oygl5X3jqNCeoXZR0Gtowg8F2tl7_96u7AZgmKuV6CLxijHGGKSxYqAorl04adUKJNOpLSALq8A_x56HqJu6Ai-742lSJnVatcQVcgQ66B09htihjbr826cgYiUGDOAN39QDr-wl6QsoOUHSPlBuUcRvzx52CYd61hfrrFy8GEjoWnQLLrrAPC2x20UI6WRgWjP1A0kruotF7KxlRlX62sWKonAoFN4kdLExBPzD2NfJlYmWKvFjHsYrwLRXCx_LkL7eWdu2Lg2P6VsTDU_T5XjqYJZym7cYOky3yxvRq3VUxDSgMZfFum9xTkxsn9f8qkN0I15UAg-VbVVYtgMS-9Iw-4GpiT08Io-PhxOB5d5M_DLYg5psDv1xk_p0URIdqh356Fe5msbq5eAcvw0BHVD6_RaaxEQglOMCzdluc4j3jWnZfwtNQci0mzFnpd4of2HAt4q3YLzW1ty5D8zft-0mJZQiyta2fVVELNZpTn6E8WlgORe4e6pmyeQBLWh0Se9L7sN5DGyqRvFQG2MsugYnx_qRNsLvjSxRuD_0L0ykUW8K0P6bAmvXV8iId-wdoxdysOEir5RVWvuMpvIO5jR_elQi54g5vgP0E1lvUS-8bO61tMeR0BCkKMsAV6V32e5LPtpvXC5o1V&cid=CAQSOwDq26N9D1OUO62QOb7sr66XT4QCAc6gGRkHYi1qr0S__aPdP-aPhvbhjOFm_70kTKXeRDLPGqZCSrxpGAEgEw&rfl=1%2Chttps%253A%252F%252Fwww.bg3.co%252F%240

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7052e4ccdc624c3f4b0428098dc09841a22310edea39f7c19bcdee95066a770a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:32 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33495
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 33A4 42 B
63 B 279ms
277ms Image
image/gif 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CdcAdRSUmh4E9-_mMEGq65MvkMkgmpYjHrhYi6RnThQ5lvDIPK0XXvMhjVbeDTzv4D6gPx11xVrHcEPrmUNBs4AMoRtEsF4usLqXiehkr6yw0bJG0

Requested by

Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221109/r20110914/client/ Frame 33A4 3 KB
1 KB 275ms
273ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221109/r20110914/client/window_focus_fy2021.js

Requested by

Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 10 Nov 2022 20:31:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29709
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Nov 2022 20:31:23 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221109/r20110914/client/ Frame 33A4 18 KB
7 KB 281ms
279ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f841e16a15c87fd62a9fd964cbe0f0a42e8c4a890a8b4f706729c0cc53054dc2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 10 Nov 2022 20:31:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29709
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7417
x-xss-protection: 0
server: cafe
etag: 18318620284716439044
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Nov 2022 20:31:23 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 33A4 0
0 615ms
314ms Image
text/html 142.251.12.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRClCtW-Zarr5YjAjoPwZQYVcn-Js7isKWKHXYe-eZvgJ3TFT-1hp_LLtTH9h8dSbo9S463aRGWMrObqKVeOrKVneyk5w
Requested by: Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.12.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f147.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 33A4 154 KB
48 KB 1350ms
811ms Script
text/javascript 74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

74e5d27c3ce88edecaa16bdd847929fae0ebe21d23da8e419564ced5bd844977

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48226
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1667997631252355"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 11 Nov 2022 04:46:33 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame F992 15 KB
16 KB 835ms
277ms Font
font/woff2 172.217.194.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f94.1e100.net

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.bg3.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Nov 2022 11:07:40 GMT
x-content-type-options: nosniff
age: 581932
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 04 Nov 2023 11:07:40 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame F992 15 KB
15 KB 901ms
346ms Font
font/woff2 172.217.194.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f94.1e100.net

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.bg3.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 01:45:16 GMT
x-content-type-options: nosniff
age: 270076
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Nov 2023 01:45:16 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A20B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK9lmIsa5vzahScJJ-rseUU&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK9lmIsa5vzahScJJ-rseUU&google_cver=1&C=1

43 B
766 B

352ms
352ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK9lmIsa5vzahScJJ-rseUU&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COXuopICELGQ6u0CGOeI-9UBMAE&v=APEucNX0da73oJE-k_3wJLRdPTl79aPynLvG2FcNHpDAIKzd_BTlfVFUl56cFcOJjVFq2Il_BJhbNrLTzD4z05DNYt8l_WsFkA
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:34 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:34 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=45&external_user_id=CAESEK9lmIsa5vzahScJJ-rseUU&google_cver=1&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A20B
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y23TqTWyUcuEC7hgc6RYaAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK9lmIsa5vzahScJJ-rseUU&google_cver=1

43 B
766 B

352ms
352ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK9lmIsa5vzahScJJ-rseUU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COXuopICELGQ6u0CGOeI-9UBMAE&v=APEucNX0da73oJE-k_3wJLRdPTl79aPynLvG2FcNHpDAIKzd_BTlfVFUl56cFcOJjVFq2Il_BJhbNrLTzD4z05DNYt8l_WsFkA
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:34 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK9lmIsa5vzahScJJ-rseUU&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame A20B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEPbJAH1pgvt4v_h888C2ar0&google_cver=1

43 B
1 KB

1274ms
1274ms

Image
image/gif

68.67.179.87
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEPbJAH1pgvt4v_h888C2ar0&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COXuopICELGQ6u0CGOeI-9UBMAE&v=APEucNX0da73oJE-k_3wJLRdPTl79aPynLvG2FcNHpDAIKzd_BTlfVFUl56cFcOJjVFq2Il_BJhbNrLTzD4z05DNYt8l_WsFkA

Protocol

HTTP/1.1

Server

68.67.179.87 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:34 GMT
AN-X-Request-Uuid: f51ce551-a104-4d26-a04a-aacd75488366
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 116.90.74.196; 116.90.74.196; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:33 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEPbJAH1pgvt4v_h888C2ar0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame A20B
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzY4MDg1OTMxNTg4MTM3NzEwNA%3D%3D

170 B
329 B

480ms
277ms

Image
image/png

142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzY4MDg1OTMxNTg4MTM3NzEwNA%3D%3D

Requested by

Protocol

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 11 Nov 2022 04:46:32 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 116.90.74.196; 116.90.74.196; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 5329288d-85a9-4979-a660-05215b007ef6
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzY4MDg1OTMxNTg4MTM3NzEwNA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 8CFA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDrzf0MF3V6FdhEDO2Acbaw&google_cver=1

43 B
61 B

383ms
238ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDrzf0MF3V6FdhEDO2Acbaw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK6UTBCO3LwCGLvB5dQBMAE&v=APEucNVtCYeUcrbwUESlW7IVLmyQx5SOdMVgjqotAD-oFbfT6b5cq74wgWUhiplq9KXryaN4tgKNL9tk8LlmtwTGxzlNoD_J_A
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:33 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:33 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDrzf0MF3V6FdhEDO2Acbaw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 8CFA
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZWFjNWY4NDgtZDk4OC0yMmUxLWU5MWUtYzU0NTdlNDY3MmVk

170 B
232 B

571ms
289ms

Image
image/png

142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZWFjNWY4NDgtZDk4OC0yMmUxLWU5MWUtYzU0NTdlNDY3MmVk

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK6UTBCO3LwCGLvB5dQBMAE&v=APEucNVtCYeUcrbwUESlW7IVLmyQx5SOdMVgjqotAD-oFbfT6b5cq74wgWUhiplq9KXryaN4tgKNL9tk8LlmtwTGxzlNoD_J_A

Protocol

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 11 Nov 2022 04:46:32 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZWFjNWY4NDgtZDk4OC0yMmUxLWU5MWUtYzU0NTdlNDY3MmVk
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

um
sync.teads.tv/ Frame 8CFA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEP3KzGu2v8VJyWgnC5NrxVc&google_cver=1

23 B
172 B

332ms
332ms

Image
image/gif

104.71.49.155
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEP3KzGu2v8VJyWgnC5NrxVc&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK6UTBCO3LwCGLvB5dQBMAE&v=APEucNVtCYeUcrbwUESlW7IVLmyQx5SOdMVgjqotAD-oFbfT6b5cq74wgWUhiplq9KXryaN4tgKNL9tk8LlmtwTGxzlNoD_J_A
Protocol: H2
Server: 104.71.49.155 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-71-49-155.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.9 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

expires: Fri, 11 Nov 2022 04:46:33 GMT
pragma: no-cache
date: Fri, 11 Nov 2022 04:46:33 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.9
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:33 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEP3KzGu2v8VJyWgnC5NrxVc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 8CFA
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=ZjNhNzBiMDEtMTM0NS00YWM2LWIwZGEtZDY0YzVmZTdlOTFj

170 B
232 B

443ms
290ms

Image
image/png

142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=ZjNhNzBiMDEtMTM0NS00YWM2LWIwZGEtZDY0YzVmZTdlOTFj

Requested by

Protocol

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:32 GMT
server: akka-http/10.2.9
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=ZjNhNzBiMDEtMTM0NS00YWM2LWIwZGEtZDY0YzVmZTdlOTFj
cache-control: max-age=0, no-cache, no-store
content-length: 189
expires: Fri, 11 Nov 2022 04:46:32 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame E64B 41 KB
15 KB 275ms
273ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BgxnjbE11OvFnpRSjwsDWzGGQUYuAhb2IJn4GbCl-WImGgLfUgRgy5NkzX_04wFmd5V0FpKKd5YpQNBFz0XTSt4asabqpOkNL0-iiVlkAETmMthhiwU3Xcgk8qs2PoxWXkn1ckY7QOijEx4DeGHQyBI8OPYhrMd3VLtSUKMhNKt_iKS1s&cry=1&dbm_d=AKAmf-Bxxz8LI53bmOAFtsvg8bgQZp_uTp5pLxTYjJ0IhlouuTIEULE_Unadt8GZb-WSHyhQZoGHZ2QqLxbFLM-wV_y6LABIruVLdNxJAOFjaVPpZHE61V6Y0nwbPXurWQ45TeSLnhm_DPMhspe3IPzbGHdnRY6HYtyErJlzQo53oxOJGuURw3EHH3WhxI_f6zGdL_lop2uOyPmizCcPL41CVQRHvamgAtu2wSZpA6Z9Mt55T27Vk2Or31-v3SmFrFGEyoo4uu_wvbhNm8tUi24tLBBx6S0ZfM1hW-hzq2EqlS4_7vgkVW8VkvAXsNYCcJHnpOAMzQES5GowRbPZAXFQNfUNBkRMt7p0kz01ls8l1VzfU_JwUKtLAN56RXuYHCpbRTN1rL3odbQkqywdeQ6pl5-L1_rGg3KM3P2eGIrr6veKpB_0VyOri7273Wj5_QJKEEXy-mS_aOP2LUzOuk9t_9kK6W3wx-YITNeyrJvNqATR22mbAR5b0k5WpZphTU2_L21gxI1tJfk0n7sZqJWjPxYWWSOQb9NNiJLgGYo4wlVyru0o4z1oldCwSdTD8-MyNlZijDDRvODWEOSFehclkeqTGmAy6HRyjmA8chDPnm0vwrwey6_4acH_rLud7_53Vo32wxOVu_0N0WC25q7_nyQ2zKQQJNDPVyQiy4TcR4wvUDowty_rzlefYkWDRMKcj1IKe_kta_xEPnPhiQilaKCuW05GkxyKRO0VQmPe2XvzBskNrQUkAALNJxSLA0Ornq-KNn1hcLi5cim3YAUp0uwADtw_eqrzEqIAMZmuOaBHN63mv1BPMerOt69m00ThNcbhRsfxOUEeAwdoJsMnDeO2i-Lgi0Qy-KoXLaBURFMunup85UkbPmnW3xjEysgbBFq6IRUTxN57rQCHv7JJfqBPznQUQA0sRi0hCszdksyw2FoRAeLBJtRPi41IsfOwUuu2L5CHznEXIlhlUzE7X6JEjdCBLgDDUtuD8mQDuncD2-sV17Y_Bj5e37cuTo-IW51shqvn-SmpoK4sVDRG8Oa82U7AzbvfHaT-JAbsp2HwW8sEqG2_Wyz3037w2ZHItlX_w676y0wQzZz95pkezzexSYE7dTz5DJhimGo0kKWwsFzUb9rCCp3cKDcdgZD3JUXLn9iD5nGgNWpgkvErGSJHkM5pbiZAZ71JOnG5RvYLadTxV8vXorAY5_vJE1mq3a5fkpR7qXzb69zWeqFGegSMdeXX1XnOikTO9rzreJPxCL70EGHvRZ1M1gxZ3eV_ZJKSzHbeUqTaEUMPX8yMpaZbnJuM34UbjstF-ilH62zeczViC6nFerN9VMC3S0bHngX_Bw9wuJ66mn_0Nf4_f-PJmuBCexO6nysEOtNGCO-ywb91UyvYWquA3XOkFNP-APDh6aAvf1yp0ygY9US4lzb9ae-rGBe2K3zOPSJYCNaNLabtb2-3p0jlrKPtlSLpPIXc81HdfklMR1kB9h0_ad4gWopfEnpgjuwT5yRMIemjtQufX7Sa9M961lQcl2zdBLbGvY4QoMXKBS52U44a7Tgv70s3jgH-zwm2GU2iM9hMp0GIuNquz-i79k2jK5-fQzDsWpr5qMOIXpSCwPWIBilwNhZ8yviTIzhO_nUPMfvDqu6gl13WISkl0MsgHyRBdal1HuA1AvSnFK8WzsrXiTWMTLim01i4rc-zvUWjMksyGBW82Uix4Vfv2mytoG5wWv6zaFni9b0Dj6bLnYmMqJNNWM_y_RrraQmIcWWwlj1Dxy1K4FZQwcL_E-0LGhIYHdTOp5scZDmM9EenHEcQ8RMTa8hZZB68chpckFNWGnHNr8Gm3WhXyR5911kj0_12Tx4qLU97i93n76w8xPSGI5VtjA7cUsYWVTV_MtHw3Vpb68LKeEGmn128L_qxXZ5_2TjzOY5ZZzy-FM8ehsfYYLLgMFO2A0f4M4INfbYR4pRT8agXmGybDC2S1gjPcrl0brnw1s6GcG_HDiIOGl_6Ova5vqwTNrIk7h_H8S8PfSphqMZ4iOSBCb4bagojFT3NQNq1IOGENYjQPofFQx3Bf1c5sfHzlOmzLBjEGsxtzXDjqjS6RuCj8QLu606SLv9fuvtanZjVhbOMckkt1rC51o6mDmWNKfh70OBnPpx99aK7ylRt2xYZs8t1EPUqJLnIugyvUdXHh83NwRHQbaXX7f9poro6rgF1Wo5lIVCGofTDNw3Zru5KCmjA2Xv4PoRcdxuowJwk515o6egDBRa4gZkQb-t8ZnrhVByfcLHkonRXKjZU1kX_NbZiWs0hulVBHXob6OEECdCbRKmJHdScotAc5cTaljXRTKhQLn-l7vv1uaPOzhSYxGd1fBHXSf9w81VDkA0kBMbFo2qm74drICmOUus53eiTx6TFNsVU2DctOHSdMOmJisED0Kn4uz3lwz4_RKuwUuJEBoEvvAlSTKsY2qwc15qF_9w2EQ0RsRkvWZYaU6PsHaOXMgOITr7uKAHIevr6MJiGbeW17InCuXcLRHwbCrpy9rPEkRHpOjXjnq0sxrKXNEIv4orpNRvPRmO-dxITPyFHcBhyqJj5LKmfFCBgFMODOl_vT3yUjVkK0dzfdqNrh9wpNU31u-fDDMDHCjR8keeFhSYKqhpj-dl76LzKCbh4fZnxwKjsQ3j3k23kTuUd42bUEyAsR5ESlmlgrmD57sW6coeHpUNrp2Og1AteJ-hoYgoJJekYdTms8LuNUUVyhE2R0ITpDP2XvoWrX8RlruwFXCJjQ5mMFPoZMZNwa3MaPtJCQ5UrgwEmczs5f7jWiqZ-4M3nWiZjOeBQHhv0zs3LjYRNXvAoN81oTvgj6ZrIJ0QCHxzPW4pQv5WQ75b9sFcXHDbc8R92YFW8M-1Geh-CR8xqnz4vW78v-aZuX2TiANPe9uFPtLTIqfCwEI7YPoyK_1dAgPAWjUtc72Y62iiNeisSUotNhyAqDPhJAXd0TPOdw-gvp3hd_IeE7N2415JmS1LKl8E6lq674cWQ0Svut4Dp-bxOXFF7-oTbH35WWJrudzatkE8rZ6yMEKKrS8how-SLs26B97Mq8k-OJIDPKfF-j9iM7bqes02xbq9UJfCwKG5StG6WUxwi8veF-hXoplQ0FLyiAHdM5YQGPsQWrFqFtKNGjPqu_LHahbBS5KQ476YfzMhJI5qVJXmqch6va85OG8pFIRZDRO3w_4ufasP4uZpBg15gKnbwNP2qzcsjEZVM9tPRUwBaBuGR2we4Za8JdlotlgICiqHzO5FpeWYWkrCLOTeIuyxn_c23p43hkZ0L6gB05LnH5r3T56wGnSQbfzWm3DMNeN0adc_idJ4IwLAKzOPTq61UDiPON7quEP5RQNFlC2SHRsbVaIAa_6ctAshDfjyXAL90fxsnLrSiE7MwqpnuBVX-NIBQjb_825M_iz7RRJIztkY1l_wVU5i3i8AQqDtIv1jOSHbZlcQCLqTHdjhsGiKxSQ&cid=CAQSOwDq26N9D1OUO62QOb7sr66XT4QCAc6gGRkHYi1qr0S__aPdP-aPhvbhjOFm_70kTKXeRDLPGqZCSrxpGAEgEw&rfl=1%2Chttps%253A%252F%252Fwww.bg3.co%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 06:54:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 165140
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 09 Nov 2023 06:54:12 GMT

GET
H/1.1 200
OK frm Show response
www.adtrek.co/adserver/ Frame 7C2D 16 KB
16 KB 771ms
333ms Document
text/html 13.239.108.8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.adtrek.co/adserver/frm?cc=32c8794c-79f1-49bb-a03f-85569be09a9f&clk=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCNM5XptNtY_KXLL_mz7sPw5KGiAPSsKT5bPfi_MeUEb_N9fyaLRABILqEwDNgq-yxheAYoAGwgquTAcgBCakCkH4H2_wxpD6oAwGqBPEBT9CSguzHfUkAq6IzG8ExV6kFkoONOdgXlPee5Hoqqx0wT4BIVP3dCx8x9WgqpOusFrQ93ErG09QaZ32s1NJig6tIoq8-9sk4r7sAGVFdTGwwPnULQVbepBPkmnNj6FrGb-h7UL1gyqv-8euSqdILYEwz1jcrTDpyzqwXhOToI8oBKfnBocyYf2M0iOCaCPj4o2YBNGQIzHq12YTKHV-opmUmfVXjDtWCPELKv3ed1xg1CS_ZEUKHXD4S724UzxcXneimct5XwGfMTUtgyZYmJYU2519s2yHB_0FzlkqBVKrxwMEqkPp85w0UjPuBlSwzwMAEze_J7IYE4AQDkAYBoAZNgAe4_dTsAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgGEQARgdMgKKAjoCgEDyCBthZHgtc3Vic3luLTUyMzk5MzgyMTM4NzAzODCACgOYCwHICwGADAGwE9vp8RDIE7eMpOED0BMA2BMK2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9D1OUO62QOb7sr66XT4QCAc6gGRkHYi1qr0S__aPdP-aPhvbhjOFm_70kTKXeRDLPGqZCSrxpGAEgEw%26sig%3DAOD64_3-z_XYl25mDV_X5Jrm6Hx4s_49tg%26client%3Dca-pub-8933329999391104%26dbm_c%3DAKAmf-Bhb7WnPP7_QB_ysexA7T8kXDNDYsxagqKkaMz06HCcWZF_kdCxW1Ub_CEG2n99dAl__Z7cdgQbKdtYhpoRPBUMDDt0yx34NtxQsBlZQ1ZtXQ-BohFcyDD0guLORGNTdSi5_zSUF76Ghpdu7DqiKvFAOUCMuuBDIGxzS8C216th0Gr6xlU%26cry%3D1%26dbm_d%3DAKAmf-BZklHQByQhP1Z1xgI29jLUfCKPEK7gATj8_rrVO6_UIt1aNclTbcijE_h8yrXMLaYpusPdWPMtgNbg42b2tYRwH5OENsu02LGe7CN4qUmZ7aPLcB76lcaInld_e4GtqynCAP4Gqf6pIF-nk2r1uXCZpt_8PnLNXvoyc2TWD_V6T1nceHHzlhdcYTncI61FgITXSGVxsNvkC0mNIkJ8LTsWz8Q9UM3RGZQ-O9ikh3x_FcwDKAiMl3mOMTbbM_ByQeY6Lweerk5YFy8zfGyEgzDLTr_3c6vB9Uh0ZyFC-xV9zL8_0bhDxQ2rFH9QFklJbJfik7pK-Ju6KP52qvQnPRLMgJ3oRg1JxMQGb-EaSlAPAnHvX4fzFMPxt6nJ1Z2LVdxBfKuH0P4191C-lcwQUy0PVgpprp2zy2EI-ABWnbjpuLOF9nfo0SU6p271kS7-5l42n6X2uDAccOHQ07XR1AemP-LYWpyy7Txj8U_OLWe3744aob0sME_gxSsLTVSYd2fwdP_cIqiLsGsxCltxOLyrClUGQrH2Nx-cPcqe4bPYYhDrD4othhYWYoydJFYVPJIBke7KcNCc2eW4XC7SyXv62XHhDs2xjgx2mktr_57KY48X_FU%26adurl%3Dhttps%3a%2f%2fwww.adtrek.co%2fadserver%2fclick%3fcc%3d32c8794c-79f1-49bb-a03f-85569be09a9f&ord=1668141990723954
Requested by: Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.239.108.8 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-239-108-8.ap-southeast-2.compute.amazonaws.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 0cccbbd4158e3690c734da6cfc6512f6ef57d6da10bbd8f1806a04dac2a5dc13

Request headers

Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: keep-alive
Content-Length: 15898
Content-Type: text/html; charset=utf-8
Date: Fri, 11 Nov 2022 04:46:32 GMT
Expires: -1
Pragma: no-cache
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 5.2
X-Powered-By: ASP.NET

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame CAA1 1 KB
643 B 277ms
276ms Document
text/html 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

age: 82004
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 10 Nov 2022 05:59:48 GMT
etag: 48472445140208031
expires: Fri, 11 Nov 2022 05:59:48 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame E64B 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a5688b1d91b3bf6cdc2ea499151f601a4553f4ffc475eaea63fb819b4a834e1a

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame ADC3 0
0 280ms
279ms Image
text/html 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022110801&jk=4377299375855441&bg=!NDelN3PNAAbvMpMzzzI7ACkAdvg8WlWzv44fQzvzGmRMQ35KUwRtsvHGNNqqMWolxEHJosvFKnMCMAIAAAC_UgAAAANoAQeZArseF2EPdBoamsa8p_XNd5MClBrilGRGEXQk4XEHCxij8oQlMStTDPlHzi2kfjMiL5scMMTGdAyw7Uk3wiYi29yTT3UQ12YRQimyHfv8xX1zCtJEcf0BQkcPjt6wk4KwwjaZlFwz_N86eoo4WJZPjX9CLS9JWq3XxzZGAPvlgx2JJgBgq5iG0wFKvR7lkxLPaHyuGaERIj3UJ68cw5c2WMdSyfDJtxS1O2mHqI4Q3OOfcwg4cXveg4HinA4I-877sdMGgANSkD2LqGmvhF9Zc_TRTvvSPUCUPfJibQvpeaFN_C8oxG3N095_hcQSM3eHx0VEMJfJ01_YoKKF5KqgbG-A-_KP9mffPXlgzKawl325Ihj_ISjzPk6GR7TQFlKyEvbMoN9FvlWBBnVFyrIDgjbScWN2QW-_e9UYxy-CyPLpjO_eMQcEEZHRoa9qJsFbDOspmXuQDR229eDlk-YZ0kJFOBwcW7zXkNVHFN9JTGZXTanE2gUScaJvK73lfjLnXa20jC04-cNYusZmaHASArm0Y0Vt5tsNiYr3QS8a8OJ4uGvu76pz9yVrJLgbH7Fm2mHgzj-VmULjEOtgh8Bpiaf16CqMSdi92DPUD6JnUva9aygNawDyK-hwiRyBIgIdJDrqn5yo2rXa-Abr-hzGTlkKPB33m95uX8Noc_fXam_SySba5xSznJMwD6RzWftx22-Dk2jtw4IfTIQpXR1MGt5Rn1sM1uHbgSLVWlCuHV1Uqp4OkyeXGj1CcrgwPO_XcBfTLyrH4002lCkEN2u4x0ZEDjb1e1yv4mVRKbo_ab-bXILqx_w97wkx_eZug3ukcv64BlhzI7RJqPmkq24bc633n8E_bkYLhiH9duTeH1zpZA7058mr-T17u2e3Ki2gL1329YsvQenWZM3dyb-tg-Rl7JYcOpWxf0FHjA4
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.200.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sa-in-f154.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame B216 0
0 282ms
282ms Image
text/html 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022110801&jk=1260345923607549&bg=!-Pul-7_NAAbvMpMzzzI7ACkAdvg8WsKfkRNKRQMt2gxRq2fPssOwHy0E74LiQ3xL5juBDBWskRFpfwIAAAB3UgAAAAJoAQeZAsHoqx6ptPOlEvmSxhItZVoyNMGpAMgJ1o9DrQDmXhkt279eJNL9rlO6C_fVfxC8dh4Tc9BAm9Nk2wSm0z31IyzsGxaeYMSiRzgCjHOrgZK0x15lzpwh-edjhCUTwD5hHzyIMncwnJTCp58B_EnLpzwR5-1Soi2UokprvguYOWUVeQIpjiaThIwPslgudpMZ9LF6ZM5dPUPmR3BHDk8BzBjGNOe7JqHA6jHa3jgyLBJLClLtF5RC5GfcMskJuned-TeetHqOB48U88mgV_y6hlhl8QsUkVpkNUYSRPrjnJZ8M5Kx3ehZJhpJTPO8oOWr5wV9Kzh2kpukA7ZNhXXAiqg96r4x0h2l_YWcP3x9doszAgbeHoGFbH0V6EDxVD8ZHEqEjy59h0pjNm-X8r5Nz0W1_8OhlZ91AAG_16eFLxvsp_EcAdXNVJNf9GkkvVlFNf0AZyL7I6tdJWi2pkRhs-rcDevuJA0amYcOt7LM4r9fZikUDj5YfsaC2MQD87kXBeluEaZ7_4-trNFCYZTQz2VVA7y1sDr6118vbg8VOa9R5QucP_cG1mxu0bI2n5e6yQt69HdV7f2LnejysBA1JyMD-SGz9aietSzo7yZ5aIcdrnEZE2tVU78w-GM7hWJjhJPRD72jmp85ZkIflo_juPllgX-ucaJHXDnpBn7LEVFJPP3jwjh5jQtx7t-2go4tZtY_wp8N4-9_HfJIcf8L1ZvzL8FT_YIGPwX98miK1xCm37elDSPvIRomoMDNovMcCYoRbiCyH1hStSziO8MHUxnkPLwRDdpIdA9GrGeLMMrA35ETK-Qdd8pbz8S4wLu0sqKaAtjIawGiOjZAMTLaHUKqK1HU-xYg4p8oyLyWzl_wRZ7WpFukNFDCiIwB-4tQrgf4UvX7R1_ze2skzWsNsxB5-UDnX8YSUJpo85kJqD5udJg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.200.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sa-in-f154.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

POST
H3

200

bid Show response
ad2.apx.appier.net/v1/prebid/ Frame BDE3
Redirect Chain

https://ad2.apx.appier.net/v1/prebid/bid
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid
https://ad2.apx.appier.net/v1/prebid/bid?acid=ETgc6mymDHOx9giKqtNtYw

9 KB
4 KB

640ms
356ms

XHR
application/json

34.96.119.68
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ad2.apx.appier.net/v1/prebid/bid?acid=ETgc6mymDHOx9giKqtNtYw
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H3
Server: 34.96.119.68 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 68.119.96.34.bc.googleusercontent.com
Software: nginx/1.19.0 /
Resource Hash: 01fee801c0a5a17897a6cdf3b024d685b68494df4f325db53e782bb9df7e5d3c

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:34 GMT
content-encoding: gzip
via: 1.1 google
server: nginx/1.19.0
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-store
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

Redirect headers

date: Fri, 11 Nov 2022 04:46:34 GMT
server: nginx
p3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: null
location: https://ad2.apx.appier.net/v1/prebid/bid?acid=ETgc6mymDHOx9giKqtNtYw
cache-control: no-store
access-control-allow-credentials: true
content-length: 0

POST
H3

200

bid Show response
ad2.apx.appier.net/v1/prebid/ Frame BDE3
Redirect Chain

https://ad2.apx.appier.net/v1/prebid/bid
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid
https://ad2.apx.appier.net/v1/prebid/bid?acid=xMXnOvw-Bpy3f11LqtNtYw

2 B
19 B

558ms
274ms

XHR
application/json

34.96.119.68
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ad2.apx.appier.net/v1/prebid/bid?acid=xMXnOvw-Bpy3f11LqtNtYw
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H3
Server: 34.96.119.68 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 68.119.96.34.bc.googleusercontent.com
Software: nginx/1.19.0 /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:34 GMT
via: 1.1 google
server: nginx/1.19.0
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-store
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2

Redirect headers

date: Fri, 11 Nov 2022 04:46:34 GMT
server: nginx
p3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: null
location: https://ad2.apx.appier.net/v1/prebid/bid?acid=xMXnOvw-Bpy3f11LqtNtYw
cache-control: no-store
access-control-allow-credentials: true
content-length: 0

POST
H3

200

bid Show response
ad2.apx.appier.net/v1/prebid/ Frame BDE3
Redirect Chain

https://ad2.apx.appier.net/v1/prebid/bid
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid
https://ad2.apx.appier.net/v1/prebid/bid?acid=_g2VgqfvAHuywj6vqtNtYw

2 B
19 B

633ms
349ms

XHR
application/json

34.96.119.68
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ad2.apx.appier.net/v1/prebid/bid?acid=_g2VgqfvAHuywj6vqtNtYw
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H3
Server: 34.96.119.68 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 68.119.96.34.bc.googleusercontent.com
Software: nginx/1.19.0 /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:34 GMT
via: 1.1 google
server: nginx/1.19.0
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-store
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2

Redirect headers

date: Fri, 11 Nov 2022 04:46:34 GMT
server: nginx
p3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: null
location: https://ad2.apx.appier.net/v1/prebid/bid?acid=_g2VgqfvAHuywj6vqtNtYw
cache-control: no-store
access-control-allow-credentials: true
content-length: 0

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221109/r20110914/ Frame 33A4 29 KB
11 KB 276ms
276ms Script
text/javascript 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221109/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AxxTPaXvBsB1Yc4VtrC-EQKtE6iZ-2Z6YfNnaa8eJ8x9Zetmj75KWKSVo1IRX37gNUhu6eJ_6ykulenjA0qp0aDAGmHg&cry=1&dbm_d=AKAmf-AQjAHg3tLIt1Baf5ZZ5oPRdcw2nxWGLErzgA1oa3tOjzvJUuPLBJ8XRKZ7LEmYNFrER3VBqxMv-309sfMEMSl0kYaGsyIsyYfpQrBEtA7x3XtzsnfetmMpZcGPUiNaLj9_RtNf8R0VA-kLRPUL9VpzG8tD9KZEeLuAec3xD_q2uwx8_xNyYsZmQJTNNboDtHfvcweVmQ_a_Hbr-k7jEWTldv-6oDT8NYQhWHs7vCeX4EyChaIHC19BoLqTAEEg2hkcSq2grw16c4BUnL-YzLCytT2M2QLT-pCkNKHXMsbdu0nAGSxUy3q7si8SSZnOVvUXAURvrSYH5lY0H3pm2G_mM5t9bJvDz3z6TlQN29KOijrSqDXep4d2PMWlH0spWYyzYCid1LvDbXU0KVfFMTDd60rXU8TR1tr6k2VeTkJaWHWXZmkWgu1zKVhY6acd2oU9lYikHuPsJOLiBPjw-YP7P31cr2MvPQ1I_lkiWtKigRcOHYAdcpjBrnFMj8OOfL6uPMHs4-jN8X1j_h6jG-prl1hiv5mZXAlbgxRhNDsL2QHAR3YQFqfArah7x0KRWgDy6U_w7RSVDIyDZm-kqwcQ-yqBrVXJWOfTXfIiyb-_3DYLJz_sDZh3a_8t6AAqbCfoki6VExBpO1NlvgQK9pkIEqgYd3U37g82XIHzeBnvkpmT3o_NYrT8MNn4Hmzel-LyJ-nEq56FdXygYMZh0B0GTLI_IjrpFYlQf-w2pwgBl4LeaH0k9iUUPYipMuXJHcCQ2tkCYwJqA7Q9TMXR5OC7zvC-tw0NGFULZOqSP9k1LvJmEhDs7sa2taWF6L5sRurvr4EbZ4VqSc9lnu5fkRXo1ZDu7Nb0edYPyOQtnCAHS6va1pDIMXQ6kWvo60Juz8cQKWQLMS50-EeoKkRZj7HXJ_qjT2EyNU43UNb3MAZbq-UAwleLHJ1CjwGjxqFdWxx0aa3hML6aWh2UkNO5yf44wkP8kOkQsFFdydc4PlOKp51hC_a28I0oMEo-PzDdcypaETFEf0ABcGf8_7F2B9fYkuX45Pj_nrWNRcOQgQ55HG47Lp-Cjl8fzrAJzf0ZLKPDYRHMfCDw-5IAc5dXkNnIzZprhlWP1o0M99wTKgH6b6QggFfUGfjkGj2zGq9EqA3qxKf0Cu5YVY6eUlAnlAGek3nOAqwdKrGUYDHqXhsks7jxJPj8fcpjbqxPbYUeyk0LpjiyyZIpMX5A6QSpJPLknzEbMlWB2zEjdwqhg6YlwBHBPY_TsRA0K29wxSrVwtwXgqhKaXtruAUJKPUQcZoT9o0SMmR8V6at5OwhTCWdFS6HtRvzd317gDZ-Ts1TF7UPletCxUFnEPFkuX0PxCVf-OY51Um8uwiYrTv3qR3lqLcNZ0iqrv_GQL5rH2KQm-ftOiUHYiWstQHAvd14uq0TwXv4WUZbaNyRLAknLisFocXed65a8hh0gBJamGK3o74r5n0U0pQEHPM6pnfLvNqRokmQYV7UhJrr2PrRh1-NzijBAU2nnCvPuE_UmFI81xFgor6IDeN6MZSuqplXvJpT6Z2KGcfnAnvVojyD749sm0e9x5RHf7Pg4imXmIknkUKZ8od-ai8Wcp191eA4gSIiDSs2yvhyWY91jwFasjMj1x4KvPpnAv_e1F3TQqHeJt-342u8sNtea2I_SpsJG-ZHPBH4I6y2BLa-z5lf5NM--8cjhmIOH3K_-XUiRTWHNrX8ieyW1TCbbRdAerZXAL_t0axwsku_FW1zXrGe9TaSxINhZ1peTT4USgjhxwSy-VR9PjM0U_a0yYQvAUirat_uP465ea__N63QbYxZt3BYrtIfigyt_HfWLmTo0z9MGHoXKX0RF3wWSF5fFryyDq6J7UD7gWuZhycmWmXClCdnVsTOWWulpXUDj1Qq9I-jmOEjvzg-YYZLg54rp069mFKXJHjGkfzgjgm5cnt6CHbMqZ0G4y5BMb10dFrVTVMTkBKLBXesKa0D2f9275bldbGzvDTMQlFzL2h9egAw3TnJEscCgPcfgdgUAwEZuGMQqhqjhuKOZijH_yD9BQmzTsz32whpr4EZrtXDGvt5MZfFTrIITndZzyFP4dlcAoSH4Nvn6XxryssB0gmquVOI6EIL6OXTuQPaQIST7Ecj6xmKhP74czEsA9YivQ72oZkVaUpJyDkWcaT3PFQo4_sJ7jDDTOne5PbyeXSO71dswA-KIq4p6zvwWWwYHgClsvvi-itGP0MuCa6mv5Jrn2rGrXL6skJHQVeS3BViKYzMbOZv57jCmyl5afrdcnULv8qIGKIPuIrCOSrwpDleZLxW6Z6lrSVPNHE1qhjpy2RKl8ZArjkv6HEe82iLe6ZT4XFTUZpAy5y-DUHxLihBCEDxPWCayqN9yY1qa_CiLtvAcGMMH8UyN_hBCsaT6qwq4Ugwk0ADPRJKN-B5Qx9xh-0NeU5esG-BXhYoqEqVn6rzxYGnKx4kqwTz6p6epb6w_ZkNINplyj60lsVx9UwK58wcV__InOCIhBrsSZR8IFjlqKVs5T7mkxO6v2XNR18-3riA0Ev3k5hwYUCU0PsNh5whw8uE4ijGMznUsX3lHap6pi2UF0yGmrBvtX7c7TIAXQsTU9yVZVPEMLGVc20R2mpNrNagd15CSdx2T6a4wolDiy04FjOfv8_561NEdEa5c1cMCiFD-_VAr7Iv0pHCgMjCbTvI29uwJ5hzx5ZIxkmQ5IveI0QcbkCbP7Bx85Oygl5X3jqNCeoXZR0Gtowg8F2tl7_96u7AZgmKuV6CLxijHGGKSxYqAorl04adUKJNOpLSALq8A_x56HqJu6Ai-742lSJnVatcQVcgQ66B09htihjbr826cgYiUGDOAN39QDr-wl6QsoOUHSPlBuUcRvzx52CYd61hfrrFy8GEjoWnQLLrrAPC2x20UI6WRgWjP1A0kruotF7KxlRlX62sWKonAoFN4kdLExBPzD2NfJlYmWKvFjHsYrwLRXCx_LkL7eWdu2Lg2P6VsTDU_T5XjqYJZym7cYOky3yxvRq3VUxDSgMZfFum9xTkxsn9f8qkN0I15UAg-VbVVYtgMS-9Iw-4GpiT08Io-PhxOB5d5M_DLYg5psDv1xk_p0URIdqh356Fe5msbq5eAcvw0BHVD6_RaaxEQglOMCzdluc4j3jWnZfwtNQci0mzFnpd4of2HAt4q3YLzW1ty5D8zft-0mJZQiyta2fVVELNZpTn6E8WlgORe4e6pmyeQBLWh0Se9L7sN5DGyqRvFQG2MsugYnx_qRNsLvjSxRuD_0L0ykUW8K0P6bAmvXV8iId-wdoxdysOEir5RVWvuMpvIO5jR_elQi54g5vgP0E1lvUS-8bO61tMeR0BCkKMsAV6V32e5LPtpvXC5o1V&cid=CAQSOwDq26N9D1OUO62QOb7sr66XT4QCAc6gGRkHYi1qr0S__aPdP-aPhvbhjOFm_70kTKXeRDLPGqZCSrxpGAEgEw&rfl=1%2Chttps%253A%252F%252Fwww.bg3.co%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8f3ce76b086c8ff73e7ea3943a49cb9bcd943d2e24efe793fad5c14556f88d6d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 10 Nov 2022 18:41:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 36326
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11172
x-xss-protection: 0
server: cafe
etag: 1193498290069121257
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Nov 2022 18:41:07 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221109/r20110914/elements/html/ Frame 33A4 8 KB
3 KB 321ms
321ms Script
text/javascript 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221109/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 10 Nov 2022 18:34:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 36720
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2986
x-xss-protection: 0
server: cafe
etag: 3296546412363819624
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Nov 2022 18:34:33 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 33A4 0
0 841ms
289ms Fetch
image/gif 142.251.12.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstcId1_pEN9C1nK-JFehs785KEYWljLqx2SKG6jk7EfMHd7kXv9ODMM4oydJr5ruDbNMXwBLkDLhTWjW3IYNwYF6m5gvS5ql_iiBCxhxSczL1JdLd4G83lYuiGEQNW7SrJeoYoqywQxefEnkLO9ZVJxlUr0dMMrhfROEuaFWS8KBubiA-ANt4urcF4YYaqqxqALoSwDKdQDlM65q8aqAgFOCK3Mn_We15W8y4qbJ0S0_uXqjkRcQvDpA4_LqsXMsOFu8BHdx1M3zqZF7DncxuOsKNQePa7KeiaM8CXtl7pldACuytMcEiwcBHbQ7eDWVx2y7tylLE-QjLUZY-6geqIL9WlGaKDBM9MK4eCkmoqQ_dUNobNc-KYkdWKf2PAQ5gBLBBMDMQPgX9BWQ2LuHOuAX0DrHWb8DZls4Dcl_zhrMHTQ849aZGGdQu8mMBCkVaAUpDzxn-j39HbzSR_iHh6N-yOwJ-9LWoKNa9kbYY9KOolqra-wh322m8U1kMCUsj-jxQ2FdiMPW-Jh2is7Q_E6vEXFYjoeay_UHD9RpMTTd9NAAGcjY0CEOX8PWxINfweO47Wi6-w-Gged6FmtRVpisXRsoaW5m_uVIKA7d2y4HRZsa4HfmjWS2FiA8WOzmNs_D-ptyyLwctnWIjE03a-qGVVzujlIJA3G_mLI6lzIcxApWptfqlL7WaYGGomUdJ4l8gbKg3cNnFLPFbaNsuHjswGcJKO32mcJfF6ILWAl4v9edB_xneUGP4sSKYOFGqFIKkb4z_FRKBYhXAcqcN98YZy8SeyLOpbrIKoSF3lkORmcw9m2uNcdPYTTerQRiiTPgpNsw_gwHdJXwbXlM2avk2_d4lj72bvrFvR7vp9A8P_gMmSxKnAW4RySzICAQl3Z4xyYfN0DS-lSyK4QzKAB_vGQTxDYnneF_zTOMyBHhtjYzxRX6D41dRv0N-DdvC33u7pn-jw36MzAl-nzR7Zaz2t9FtvAzI-xp_Rx0PamnyFZD1r9ipB1oCPDlqwAcWJ2J9PbHXedlgxHKRPrWDaYRYv99C_O3sHrmm4khSECrFpU1PrC7b4JfSlZ5uMNsVGMzxlHmEd96iHh7aeFnyHcgOS5_M8USZ9UBk5LaE0e-WtqxIQ2_JHdlmuQCZA5TyUhLXNBcpQgSymO_8TrOjsUuwtlj4tV2jYttoTTrvZj5hOL04Th2rovKxvD0OZ0EptYpV0ZAuKykl8RN1TrxQ3J9nLMtvXd6AzXRDosajZQt7l5TZm88qsyMMUL4i6paHf1hsA6ag&sai=AMfl-YQygGAmoPvEb00mneQbaati9gGvAEqNMx3pufeYUxzxeNhnKAh7RT_z1ONimtY0imIQxPK5_fthgMpo-wnTmu8m67u3BCt702bEw-FwgXCHuJr5f2qFzckD8IOTRaHZ8qRVRSuo-xwr2oUWVXyZNpUsYsufXQuRkwN_YS3X7ZkuFPxa9IxmS2ARR3ZOl41_3IZrluf4MKHXG_2m8ggyrvr7zu9DogSluQ1V50hX4p2OYybvQI-XxcWbYJJ08HKjFnheinsK8wM&sig=Cg0ArKJSzP7zjfbCKASQEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20221109.46874&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 11 Nov 2022 04:46:33 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 11 Nov 2022 04:46:33 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 33A4 41 KB
15 KB 274ms
274ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 06:54:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 165141
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 09 Nov 2023 06:54:12 GMT

GET
H2 200 10880848475328421596
s0.2mdn.net/simgad/ Frame 33A4 27 KB
27 KB 1239ms
676ms Image
image/gif 172.217.194.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/10880848475328421596

Requested by

Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f149.1e100.net

Software

sffe /

Resource Hash

9102e03252800e7357474927a5bfbcaf49070862cdaf7bf2ce0798c1228417be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:33 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27401
x-xss-protection: 0
last-modified: Sun, 02 Oct 2022 13:22:29 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 11 Nov 2023 04:46:33 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 5AFD 22 KB
8 KB 274ms
273ms Document
text/html 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 165358
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 09 Nov 2022 06:50:35 GMT
expires: Thu, 09 Nov 2023 06:50:35 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1

200
OK

sync
gdn.socdm.com/rtb/ Frame CAA1
Redirect Chain

https://tg.socdm.com/rtb/sync_before?proto=google&sspid=google&google_gid=CAESEEduNgC-QvNRar_yzFxc4zw&google_cver=1&google_push=ASkJ3FbOlcY-rhX5QVpPhe-TK8cISkR5K4nglgGoOIsni01h2AdxteBYWc4xKfQPTp7Ff...
https://cm.g.doubleclick.net/pixel?google_nid=scout&google_cm&google_hm=WTIzVHFjQ284WHdBQUJMSG9NTUFBQUFB
https://gdn.socdm.com/rtb/sync?proto=google&sspid=google&google_gid=CAESEEduNgC-QvNRar_yzFxc4zw&google_cver=1

43 B
972 B

848ms
283ms

Image
image/gif

124.146.215.3
INFOSPHERE NTT PC...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gdn.socdm.com/rtb/sync?proto=google&sspid=google&google_gid=CAESEEduNgC-QvNRar_yzFxc4zw&google_cver=1
Requested by: Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Protocol: HTTP/1.1
Server: 124.146.215.3 , Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:35 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/rtb\/sync?proto=google&sspid=google&google_gid=CAESEEduNgC-QvNRar_yzFxc4zw&google_cver=1","cluster_id":34,"gdpr":false,"ipv4":"116.90.74.196","key":"Y23TqcCo8YAAABA1dDIAAAAA","privacy_sensitive":false,"uid":"Y23TqcCo8YAAABA1dDIAAAAA","upstream_id":"m-ad290"}
X-SO-Key: Y23TqcCo8YAAABA1dDIAAAAA
X-SO-Upstream-ID: m-ad290
P3P: CP="See also http://www.scaleout.jp/privacy/"
X-SO-HostName: m-ad290.dc4p.scaleout.jp
X-SO-UID: Y23TqcCo8YAAABA1dDIAAAAA
Connection: keep-alive
Content-Length: 43
X-SO-IP: 116.90.74.196
X-SO-Cluster-ID: 34
Server: nginx
Content-Type: image/gif
Cache-Control: private
X-SO-Ads-Time: 4
X-SO-LB-Hostname: m-ng38.dc4p.scaleout.jp

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://gdn.socdm.com/rtb/sync?proto=google&sspid=google&google_gid=CAESEEduNgC-QvNRar_yzFxc4zw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 318
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame CAA1
Redirect Chain

https://sync.fout.jp/sync?xid=googleadex&g_pixel=&sp=1&google_gid=CAESEEUzjNeSfTpNUAHtazeqih0&google_cver=1&google_push=ASkJ3FarXjKFZMuOKUWpQiz98NM-dHZYml_Fgc-PamKLP8qkQPqNEYCtAM6mRzktJagm5YiHULoEy...
https://cm.g.doubleclick.net/pixel?google_nid=freakout&google_push=ASkJ3FarXjKFZMuOKUWpQiz98NM-dHZYml_Fgc-PamKLP8qkQPqNEYCtAM6mRzktJagm5YiHULoEy6kqfbCS1NziJOyc3XBMp8XGXSbtla4AwjlU_bqxDWoGnluXnklM12...

170 B
232 B

578ms
277ms

Image
image/png

142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=freakout&google_push=ASkJ3FarXjKFZMuOKUWpQiz98NM-dHZYml_Fgc-PamKLP8qkQPqNEYCtAM6mRzktJagm5YiHULoEy6kqfbCS1NziJOyc3XBMp8XGXSbtla4AwjlU_bqxDWoGnluXnklM12lbZR2rXoNHCIIi&google_hm=emlRM2RMLVVlMi1YOFI4dzgzWkFQUXAzQ2ZN&from_google=sp1

Requested by

Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:33 GMT
Strict-Transport-Security: max-age=15768000
Server: nginx
Transfer-Encoding: chunked
P3P: CP="ADM NOI OUR"
Location: https://cm.g.doubleclick.net/pixel?google_nid=freakout&google_push=ASkJ3FarXjKFZMuOKUWpQiz98NM-dHZYml_Fgc-PamKLP8qkQPqNEYCtAM6mRzktJagm5YiHULoEy6kqfbCS1NziJOyc3XBMp8XGXSbtla4AwjlU_bqxDWoGnluXnklM12lbZR2rXoNHCIIi&google_hm=emlRM2RMLVVlMi1YOFI4dzgzWkFQUXAzQ2ZN&from_google=sp1
Cache-Control: private, no-cache, no-cache="Set-Cookie", proxy-revalidate
Connection: keep-alive

GET
H/1.1 200
OK us.php
c.eu1.dyntrk.com/adx/ga/ Frame CAA1 0
215 B 1186ms
393ms Image
text/plain 162.19.80.92
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.eu1.dyntrk.com/adx/ga/us.php?dynk=ga2ex&google_gid=CAESEIW7kw4mhXLpz6KPkYaegxQ&google_cver=1&google_push=ASkJ3Fa_XRUFXCCoJxMMfdI5vnDLgCgf91XakUnbqW-8g3LGrFLAxG_qfBMvAYktVeuNYBToWakU_7kdgUQJHa6nOdLNV1Psc37W0gXwQ8m4ddg3Ge_UqDKOHGTablUSrqbscyhEyH1N4xc
Requested by: Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.19.80.92 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3011863.ip-162-19-80.eu
Software: proxy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
cache-control: private, no-cache, no-store, proxy-revalidate, no-transform
x-rc: 10
server: proxy
content-length: 0
content-type: text/plain

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CAA1
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEHOgnYZiOVC4jxuwFLuIawo&google_cver=1&google_push=ASkJ3FYi1E4imWHy5qMmOmpZI55j0FTfFnvKTes98ckN1joQRMWSgfSWF2nikfFDeCbQxhBKlI7UvUxn...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEHOgnYZiOVC4jxuwFLuIawo&google_cver=1&google_push=ASkJ3FYi1E4imWHy5qMmOmpZI55j0FTfFnvKTes98ckN1joQRMWSgfSWF2nikfFDeCbQxhBKlI7...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjA1NzE1MTk5MjQ5MzU1NjEwMQ&google_push=ASkJ3FYi1E4imWHy5qMmOmpZI55j0FTfFnvKTes98ckN1joQRMWSgfSWF2nikfFDeCbQxhBKlI7UvU...

170 B
188 B

381ms
285ms

Image
image/png

142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjA1NzE1MTk5MjQ5MzU1NjEwMQ&google_push=ASkJ3FYi1E4imWHy5qMmOmpZI55j0FTfFnvKTes98ckN1joQRMWSgfSWF2nikfFDeCbQxhBKlI7UvUxnUwonqDX7R3fPJmjLcESPdZq3AwXuLW61lZ-cLVNnQ_5b1ZowCctBUQdo4xyKLrRp

Requested by

Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjA1NzE1MTk5MjQ5MzU1NjEwMQ&google_push=ASkJ3FYi1E4imWHy5qMmOmpZI55j0FTfFnvKTes98ckN1joQRMWSgfSWF2nikfFDeCbQxhBKlI7UvUxnUwonqDX7R3fPJmjLcESPdZq3AwXuLW61lZ-cLVNnQ_5b1ZowCctBUQdo4xyKLrRp
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CAA1
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEK2MoGWyQ3sKl15oK040mcc&google_cver=1&google_push=ASkJ3FYTtc75dg_eh0_QK25ine_9BvJzkk-4KI6SPhNctpkmc2fxUL5NWQ6Q33ZM3jsoD6tV_4VZ-bCwWXae9i4...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=zIovUmUAQYRa7qzl_SUpZHRaSsQ&google_push=ASkJ3FYTtc75dg_eh0_QK25ine_9BvJzkk-4KI6SPhNctpkmc2fxUL5NWQ6Q33ZM3jsoD6tV_4VZ-bCwWXae9i...

170 B
188 B

282ms
281ms

Image
image/png

142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=zIovUmUAQYRa7qzl_SUpZHRaSsQ&google_push=ASkJ3FYTtc75dg_eh0_QK25ine_9BvJzkk-4KI6SPhNctpkmc2fxUL5NWQ6Q33ZM3jsoD6tV_4VZ-bCwWXae9i4Dz7gd0uLRQCJ-YOi-niJvDdqsB7lp5IJtjkjUg-vqK5Lg4OUbI-2Wsh1e

Requested by

Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=zIovUmUAQYRa7qzl_SUpZHRaSsQ&google_push=ASkJ3FYTtc75dg_eh0_QK25ine_9BvJzkk-4KI6SPhNctpkmc2fxUL5NWQ6Q33ZM3jsoD6tV_4VZ-bCwWXae9i4Dz7gd0uLRQCJ-YOi-niJvDdqsB7lp5IJtjkjUg-vqK5Lg4OUbI-2Wsh1e
Date: Fri, 11 Nov 2022 04:46:34 GMT
Connection: keep-alive
Content-Length: 286
Content-Type: text/html; charset=utf-8

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame CAA1
Redirect Chain

https://ads.yieldmo.com/exptsync?google_gid=CAESEFuNc8mCkHARpzkQLIzDxRs&google_cver=1&google_push=ASkJ3FYLTMHoQ-FDFVQKWIj53ckNR29ENg4t0-2c6B5ObnRO0LR3_Ns_RfaeMucN19Om_UIh0olOy5k18NeboItIJh0E0n3u8OH...
https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=ASkJ3FYLTMHoQ-FDFVQKWIj53ckNR29ENg4t0-2c6B5ObnRO0LR3_Ns_RfaeMucN19Om_UIh0olOy5k18NeboItIJh0E0n3u8OHM0rP80Sz6yqik0vIiWZ9xW1X9jKTQV8a...

170 B
232 B

579ms
279ms

Image
image/png

142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=ASkJ3FYLTMHoQ-FDFVQKWIj53ckNR29ENg4t0-2c6B5ObnRO0LR3_Ns_RfaeMucN19Om_UIh0olOy5k18NeboItIJh0E0n3u8OHM0rP80Sz6yqik0vIiWZ9xW1X9jKTQV8aoxBf_fxkpohUC&google_hm=ZzUyMDg1NGVjYTA5NTFjMjNlOGQ=

Requested by

Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:33 GMT
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json;charset=utf-8
location: https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=ASkJ3FYLTMHoQ-FDFVQKWIj53ckNR29ENg4t0-2c6B5ObnRO0LR3_Ns_RfaeMucN19Om_UIh0olOy5k18NeboItIJh0E0n3u8OHM0rP80Sz6yqik0vIiWZ9xW1X9jKTQV8aoxBf_fxkpohUC&google_hm=ZzUyMDg1NGVjYTA5NTFjMjNlOGQ=
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CAA1
Redirect Chain

https://secure.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=${BASE64_UID_ENC}&google_gid=CAESEP3bCAbhippOgHzYYQFG4_0&google_cver=1&google_push=ASkJ3Fb_XYnZGuPfV...
https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=MzY4MDg1OTMxNTg4MTM3NzEwNA%3D%3D&google_gid=CAESEP3bCAbhippOgHzYYQFG4_0&google_cver=1&google_push=ASkJ3Fb_XYnZGuPfVq-eVEj_5MTCI1FvNs...

170 B
188 B

384ms
282ms

Image
image/png

142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=MzY4MDg1OTMxNTg4MTM3NzEwNA%3D%3D&google_gid=CAESEP3bCAbhippOgHzYYQFG4_0&google_cver=1&google_push=ASkJ3Fb_XYnZGuPfVq-eVEj_5MTCI1FvNsrL2zz3lBdUXFCSZqsUGL7ary2gAynw9WLUNw7sx3yxTFFjDqKwUwYpNaUMjDUBYY4ZQgxaMu92--ZJFrQpCRWlJXoguP8uh3Jr4VnptZSYDEObTg

Requested by

Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 11 Nov 2022 04:46:33 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 116.90.74.196; 116.90.74.196; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: fb324a04-ec8f-4e41-9101-aa1608d3aa16
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=MzY4MDg1OTMxNTg4MTM3NzEwNA%3D%3D&google_gid=CAESEP3bCAbhippOgHzYYQFG4_0&google_cver=1&google_push=ASkJ3Fb_XYnZGuPfVq-eVEj_5MTCI1FvNsrL2zz3lBdUXFCSZqsUGL7ary2gAynw9WLUNw7sx3yxTFFjDqKwUwYpNaUMjDUBYY4ZQgxaMu92--ZJFrQpCRWlJXoguP8uh3Jr4VnptZSYDEObTg
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame CAA1 0
223 B 425ms
277ms Image
text/html 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LLyV3BTQ0Va_tnJIYChhXan0llgPw7Kfv2dJsH0MyzjVLUKG9Yupv0ixd5hghzm8MnrQcOwA

Requested by

Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:33 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js Show response
pagead2.googlesyndication.com/bg/ Frame 5AFD 36 KB
16 KB 276ms
276ms Script
text/javascript 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a98bdefd73410963a41036b4bc4d25b080aaec85db7ebd132a12d3aa17e8586

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 10 Nov 2022 00:36:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 101377
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 10 Nov 2023 00:36:56 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame CE5A 1 KB
643 B 281ms
281ms Document
text/html 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

age: 82005
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 10 Nov 2022 05:59:48 GMT
etag: 48472445140208031
expires: Fri, 11 Nov 2022 05:59:48 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 33A4 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c7bea5aa87483b8aaba947f42a987d3e3d77906d6d4fa2149627b5c68c034d90

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 706ms
235ms Preflight
application/json 182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.bg3.co%2F&domain=www.bg3.co&cw=1&pbt=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.bg3.co
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Fri, 11 Nov 2022 04:46:33 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 531889
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 json Show response
gum.criteo.com/sid/ 332 B
638 B 717ms
245ms XHR
application/json 182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.bg3.co%2F&domain=www.bg3.co&cw=1&pbt=1&lsw=1

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

692a1b54521ce8d4e2afdd27684b6b12b05224d4137623910e8c0b75c39f13df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 639527
expires: 0

GET
H2 200 rid Show response
match.adsrvr.org/track/ 109 B
540 B 433ms
143ms XHR
application/json 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=pubmatic&fmt=json
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: c0fe7b9ad6e64fc4af8ba04dd3fafb08a3a25f4e8f256f4436e1a37f5480db2d

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 11 Nov 2022 04:46:33 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bg3.co
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 109
expires: Sun, 11 Dec 2022 04:46:33 GMT

GET
H2 200 sync.html Show response
public.servenobid.com/ Frame 1B92 9 KB
4 KB 1181ms
397ms Document
text/html 99.86.159.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.159.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-159-129.mxp64.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 330f76ee720927481e92c4f344a43bdf66af209bb74aad6be1ceaf75092928df

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

age: 12410
cache-control: max-age=86400
content-encoding: gzip
content-type: text/html
date: Fri, 11 Nov 2022 01:19:45 GMT
etag: W/"3f9fe5e8418a849fb87380af5ee37be6"
last-modified: Tue, 08 Nov 2022 01:16:39 GMT
server: AmazonS3
vary: Accept-Encoding Origin
via: 1.1 b6fbc074b6a76c1767be39d5e3a2839a.cloudfront.net (CloudFront)
x-amz-cf-id: iilqm8w953wiLWKIWj6RCrObq8-Ha1oN0Vfypom1QvWdH_CCldbvhw==
x-amz-cf-pop: MXP64-C2
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:us-east-1:559734745816:build/adserver-public-prod:b53fbd2f-551a-488c-a424-2e86d2c8da6f
x-amz-meta-codebuild-content-md5: 1392d0a0af229d92a17f00e1ea0d9335
x-amz-meta-codebuild-content-sha256: ebfa1f961263d3afe7dd71dd9b123dfd9a7fb454041f01580b85f67111a14543
x-cache: Hit from cloudfront

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame ADA3 281 B
554 B 817ms
270ms Document
text/html 23.75.85.227
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.75.85.227 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-75-85-227.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 11 Nov 2022 04:46:34 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 0051 52 KB
17 KB 1119ms
292ms Document
text/html 23.78.217.3
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.78.217.3 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-78-217-3.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Fri, 11 Nov 2022 04:46:34 GMT
ETag: "623de86a-cf34"
Expires: Sat, 12 Nov 2022 04:46:36 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Unused62: 8096267
Vary: Accept-Encoding

GET
H2

200

sync Show response
eb2.3lift.com/ Frame F055
Redirect Chain

https://eb2.3lift.com/sync?
https://eb2.3lift.com/sync?&ld=1

1 KB
2 KB

235ms
235ms

Document
text/html

35.71.178.8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?&ld=1
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.178.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: 025308f46d117d1cce80857a9f6927de2b24b8041b19bc43acdf2b44cb1f52fa

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1148
content-type: text/html; charset=utf-8
date: Fri, 11 Nov 2022 04:46:34 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Fri, 11 Nov 2022 04:46:33 GMT
location: /sync?&ld=1
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame C5F0 4 KB
2 KB 626ms
392ms Document
text/html 51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1668141988381

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

4a8f7244e579fe566ca1365d9029bf401101641d487282f6f456ab91b112438e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 1373
content-type: text/html
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 35E3 36 KB
12 KB 835ms
289ms Document
text/html 104.71.48.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C294%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.71.48.26 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

63af0192ee2fd131b1b79cf8097cb830e3dc9b29580fb378fa089bf0340adfc2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 11837
content-type: text/html; charset=UTF-8
date: Fri, 11 Nov 2022 04:46:34 GMT
expires: Sun, 13 Nov 2022 04:46:34 GMT
p3p: CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 200 pd Show response
u.openx.net/w/1.0/ Frame 74FE 533 B
634 B 264ms
262ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/pd
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: ae5181ac6e76a33bbceba6c8991da5bb960cea9cd60341840e4a16ef4dcc79c5

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 322
content-type: text/html
date: Fri, 11 Nov 2022 04:46:33 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame CED7 3 KB
2 KB 446ms
151ms Document
text/html 104.18.13.76
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.13.76 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

age: 371
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 76846284ded7aaf9-SYD
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 11 Nov 2022 04:46:33 GMT
expires: Fri, 11 Nov 2022 08:46:33 GMT
last-modified: Mon, 25 Jul 2022 19:18:19 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H2 200 Enabler.js Show response
s0.2mdn.net/ads/studio/ Frame 7C2D 136 KB
46 KB 367ms
278ms Script
text/javascript 172.217.194.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/Enabler.js

Requested by

Host: www.adtrek.co
URL: https://www.adtrek.co/adserver/frm?cc=32c8794c-79f1-49bb-a03f-85569be09a9f&clk=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCNM5XptNtY_KXLL_mz7sPw5KGiAPSsKT5bPfi_MeUEb_N9fyaLRABILqEwDNgq-yxheAYoAGwgquTAcgBCakCkH4H2_wxpD6oAwGqBPEBT9CSguzHfUkAq6IzG8ExV6kFkoONOdgXlPee5Hoqqx0wT4BIVP3dCx8x9WgqpOusFrQ93ErG09QaZ32s1NJig6tIoq8-9sk4r7sAGVFdTGwwPnULQVbepBPkmnNj6FrGb-h7UL1gyqv-8euSqdILYEwz1jcrTDpyzqwXhOToI8oBKfnBocyYf2M0iOCaCPj4o2YBNGQIzHq12YTKHV-opmUmfVXjDtWCPELKv3ed1xg1CS_ZEUKHXD4S724UzxcXneimct5XwGfMTUtgyZYmJYU2519s2yHB_0FzlkqBVKrxwMEqkPp85w0UjPuBlSwzwMAEze_J7IYE4AQDkAYBoAZNgAe4_dTsAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgGEQARgdMgKKAjoCgEDyCBthZHgtc3Vic3luLTUyMzk5MzgyMTM4NzAzODCACgOYCwHICwGADAGwE9vp8RDIE7eMpOED0BMA2BMK2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9D1OUO62QOb7sr66XT4QCAc6gGRkHYi1qr0S__aPdP-aPhvbhjOFm_70kTKXeRDLPGqZCSrxpGAEgEw%26sig%3DAOD64_3-z_XYl25mDV_X5Jrm6Hx4s_49tg%26client%3Dca-pub-8933329999391104%26dbm_c%3DAKAmf-Bhb7WnPP7_QB_ysexA7T8kXDNDYsxagqKkaMz06HCcWZF_kdCxW1Ub_CEG2n99dAl__Z7cdgQbKdtYhpoRPBUMDDt0yx34NtxQsBlZQ1ZtXQ-BohFcyDD0guLORGNTdSi5_zSUF76Ghpdu7DqiKvFAOUCMuuBDIGxzS8C216th0Gr6xlU%26cry%3D1%26dbm_d%3DAKAmf-BZklHQByQhP1Z1xgI29jLUfCKPEK7gATj8_rrVO6_UIt1aNclTbcijE_h8yrXMLaYpusPdWPMtgNbg42b2tYRwH5OENsu02LGe7CN4qUmZ7aPLcB76lcaInld_e4GtqynCAP4Gqf6pIF-nk2r1uXCZpt_8PnLNXvoyc2TWD_V6T1nceHHzlhdcYTncI61FgITXSGVxsNvkC0mNIkJ8LTsWz8Q9UM3RGZQ-O9ikh3x_FcwDKAiMl3mOMTbbM_ByQeY6Lweerk5YFy8zfGyEgzDLTr_3c6vB9Uh0ZyFC-xV9zL8_0bhDxQ2rFH9QFklJbJfik7pK-Ju6KP52qvQnPRLMgJ3oRg1JxMQGb-EaSlAPAnHvX4fzFMPxt6nJ1Z2LVdxBfKuH0P4191C-lcwQUy0PVgpprp2zy2EI-ABWnbjpuLOF9nfo0SU6p271kS7-5l42n6X2uDAccOHQ07XR1AemP-LYWpyy7Txj8U_OLWe3744aob0sME_gxSsLTVSYd2fwdP_cIqiLsGsxCltxOLyrClUGQrH2Nx-cPcqe4bPYYhDrD4othhYWYoydJFYVPJIBke7KcNCc2eW4XC7SyXv62XHhDs2xjgx2mktr_57KY48X_FU%26adurl%3Dhttps%3a%2f%2fwww.adtrek.co%2fadserver%2fclick%3fcc%3d32c8794c-79f1-49bb-a03f-85569be09a9f&ord=1668141990723954

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f149.1e100.net

Software

sffe /

Resource Hash

bf6ec42c97f86957a324a484a37dd528b568a9ff2570965be53e6ec4b0dfdae2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:43:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 188
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46978
x-xss-protection: 0
last-modified: Mon, 06 Jun 2022 19:45:39 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 11 Nov 2022 04:58:25 GMT

GET
H/1.1 200
OK dyn-hype-multiitem.js Show response
www.adtrek.co/Scripts/Inserts/ Frame 7C2D 11 KB
3 KB 143ms
143ms Script
application/javascript 13.239.108.8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.adtrek.co/Scripts/Inserts/dyn-hype-multiitem.js?v=1-4
Requested by: Host: www.adtrek.co
URL: https://www.adtrek.co/adserver/frm?cc=32c8794c-79f1-49bb-a03f-85569be09a9f&clk=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCNM5XptNtY_KXLL_mz7sPw5KGiAPSsKT5bPfi_MeUEb_N9fyaLRABILqEwDNgq-yxheAYoAGwgquTAcgBCakCkH4H2_wxpD6oAwGqBPEBT9CSguzHfUkAq6IzG8ExV6kFkoONOdgXlPee5Hoqqx0wT4BIVP3dCx8x9WgqpOusFrQ93ErG09QaZ32s1NJig6tIoq8-9sk4r7sAGVFdTGwwPnULQVbepBPkmnNj6FrGb-h7UL1gyqv-8euSqdILYEwz1jcrTDpyzqwXhOToI8oBKfnBocyYf2M0iOCaCPj4o2YBNGQIzHq12YTKHV-opmUmfVXjDtWCPELKv3ed1xg1CS_ZEUKHXD4S724UzxcXneimct5XwGfMTUtgyZYmJYU2519s2yHB_0FzlkqBVKrxwMEqkPp85w0UjPuBlSwzwMAEze_J7IYE4AQDkAYBoAZNgAe4_dTsAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgGEQARgdMgKKAjoCgEDyCBthZHgtc3Vic3luLTUyMzk5MzgyMTM4NzAzODCACgOYCwHICwGADAGwE9vp8RDIE7eMpOED0BMA2BMK2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9D1OUO62QOb7sr66XT4QCAc6gGRkHYi1qr0S__aPdP-aPhvbhjOFm_70kTKXeRDLPGqZCSrxpGAEgEw%26sig%3DAOD64_3-z_XYl25mDV_X5Jrm6Hx4s_49tg%26client%3Dca-pub-8933329999391104%26dbm_c%3DAKAmf-Bhb7WnPP7_QB_ysexA7T8kXDNDYsxagqKkaMz06HCcWZF_kdCxW1Ub_CEG2n99dAl__Z7cdgQbKdtYhpoRPBUMDDt0yx34NtxQsBlZQ1ZtXQ-BohFcyDD0guLORGNTdSi5_zSUF76Ghpdu7DqiKvFAOUCMuuBDIGxzS8C216th0Gr6xlU%26cry%3D1%26dbm_d%3DAKAmf-BZklHQByQhP1Z1xgI29jLUfCKPEK7gATj8_rrVO6_UIt1aNclTbcijE_h8yrXMLaYpusPdWPMtgNbg42b2tYRwH5OENsu02LGe7CN4qUmZ7aPLcB76lcaInld_e4GtqynCAP4Gqf6pIF-nk2r1uXCZpt_8PnLNXvoyc2TWD_V6T1nceHHzlhdcYTncI61FgITXSGVxsNvkC0mNIkJ8LTsWz8Q9UM3RGZQ-O9ikh3x_FcwDKAiMl3mOMTbbM_ByQeY6Lweerk5YFy8zfGyEgzDLTr_3c6vB9Uh0ZyFC-xV9zL8_0bhDxQ2rFH9QFklJbJfik7pK-Ju6KP52qvQnPRLMgJ3oRg1JxMQGb-EaSlAPAnHvX4fzFMPxt6nJ1Z2LVdxBfKuH0P4191C-lcwQUy0PVgpprp2zy2EI-ABWnbjpuLOF9nfo0SU6p271kS7-5l42n6X2uDAccOHQ07XR1AemP-LYWpyy7Txj8U_OLWe3744aob0sME_gxSsLTVSYd2fwdP_cIqiLsGsxCltxOLyrClUGQrH2Nx-cPcqe4bPYYhDrD4othhYWYoydJFYVPJIBke7KcNCc2eW4XC7SyXv62XHhDs2xjgx2mktr_57KY48X_FU%26adurl%3Dhttps%3a%2f%2fwww.adtrek.co%2fadserver%2fclick%3fcc%3d32c8794c-79f1-49bb-a03f-85569be09a9f&ord=1668141990723954
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.239.108.8 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-239-108-8.ap-southeast-2.compute.amazonaws.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: f824af6240aaa57ba4104f1969365afa9b6904544545284db4a7469e6a94768a

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/adserver/frm?cc=32c8794c-79f1-49bb-a03f-85569be09a9f&clk=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCNM5XptNtY_KXLL_mz7sPw5KGiAPSsKT5bPfi_MeUEb_N9fyaLRABILqEwDNgq-yxheAYoAGwgquTAcgBCakCkH4H2_wxpD6oAwGqBPEBT9CSguzHfUkAq6IzG8ExV6kFkoONOdgXlPee5Hoqqx0wT4BIVP3dCx8x9WgqpOusFrQ93ErG09QaZ32s1NJig6tIoq8-9sk4r7sAGVFdTGwwPnULQVbepBPkmnNj6FrGb-h7UL1gyqv-8euSqdILYEwz1jcrTDpyzqwXhOToI8oBKfnBocyYf2M0iOCaCPj4o2YBNGQIzHq12YTKHV-opmUmfVXjDtWCPELKv3ed1xg1CS_ZEUKHXD4S724UzxcXneimct5XwGfMTUtgyZYmJYU2519s2yHB_0FzlkqBVKrxwMEqkPp85w0UjPuBlSwzwMAEze_J7IYE4AQDkAYBoAZNgAe4_dTsAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgGEQARgdMgKKAjoCgEDyCBthZHgtc3Vic3luLTUyMzk5MzgyMTM4NzAzODCACgOYCwHICwGADAGwE9vp8RDIE7eMpOED0BMA2BMK2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9D1OUO62QOb7sr66XT4QCAc6gGRkHYi1qr0S__aPdP-aPhvbhjOFm_70kTKXeRDLPGqZCSrxpGAEgEw%26sig%3DAOD64_3-z_XYl25mDV_X5Jrm6Hx4s_49tg%26client%3Dca-pub-8933329999391104%26dbm_c%3DAKAmf-Bhb7WnPP7_QB_ysexA7T8kXDNDYsxagqKkaMz06HCcWZF_kdCxW1Ub_CEG2n99dAl__Z7cdgQbKdtYhpoRPBUMDDt0yx34NtxQsBlZQ1ZtXQ-BohFcyDD0guLORGNTdSi5_zSUF76Ghpdu7DqiKvFAOUCMuuBDIGxzS8C216th0Gr6xlU%26cry%3D1%26dbm_d%3DAKAmf-BZklHQByQhP1Z1xgI29jLUfCKPEK7gATj8_rrVO6_UIt1aNclTbcijE_h8yrXMLaYpusPdWPMtgNbg42b2tYRwH5OENsu02LGe7CN4qUmZ7aPLcB76lcaInld_e4GtqynCAP4Gqf6pIF-nk2r1uXCZpt_8PnLNXvoyc2TWD_V6T1nceHHzlhdcYTncI61FgITXSGVxsNvkC0mNIkJ8LTsWz8Q9UM3RGZQ-O9ikh3x_FcwDKAiMl3mOMTbbM_ByQeY6Lweerk5YFy8zfGyEgzDLTr_3c6vB9Uh0ZyFC-xV9zL8_0bhDxQ2rFH9QFklJbJfik7pK-Ju6KP52qvQnPRLMgJ3oRg1JxMQGb-EaSlAPAnHvX4fzFMPxt6nJ1Z2LVdxBfKuH0P4191C-lcwQUy0PVgpprp2zy2EI-ABWnbjpuLOF9nfo0SU6p271kS7-5l42n6X2uDAccOHQ07XR1AemP-LYWpyy7Txj8U_OLWe3744aob0sME_gxSsLTVSYd2fwdP_cIqiLsGsxCltxOLyrClUGQrH2Nx-cPcqe4bPYYhDrD4othhYWYoydJFYVPJIBke7KcNCc2eW4XC7SyXv62XHhDs2xjgx2mktr_57KY48X_FU%26adurl%3Dhttps%3a%2f%2fwww.adtrek.co%2fadserver%2fclick%3fcc%3d32c8794c-79f1-49bb-a03f-85569be09a9f&ord=1668141990723954
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:30 GMT
Content-Encoding: gzip
Last-Modified: Wed, 27 Apr 2022 14:29:24 GMT
Server: Microsoft-IIS/8.5
ETag: "0fa1131435ad81:0"
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2968

GET
H/1.1 200
OK pol.jpg
s3-ap-southeast-2.amazonaws.com/adtrek/7387f6fa-a109-45b5-9a4f-d45813c5ad8b/ Frame 7C2D 4 KB
2 KB 448ms
158ms Image
image/jpeg 52.95.129.116
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/7387f6fa-a109-45b5-9a4f-d45813c5ad8b/pol.jpg
Requested by: Host: www.adtrek.co
URL: https://www.adtrek.co/adserver/frm?cc=32c8794c-79f1-49bb-a03f-85569be09a9f&clk=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCNM5XptNtY_KXLL_mz7sPw5KGiAPSsKT5bPfi_MeUEb_N9fyaLRABILqEwDNgq-yxheAYoAGwgquTAcgBCakCkH4H2_wxpD6oAwGqBPEBT9CSguzHfUkAq6IzG8ExV6kFkoONOdgXlPee5Hoqqx0wT4BIVP3dCx8x9WgqpOusFrQ93ErG09QaZ32s1NJig6tIoq8-9sk4r7sAGVFdTGwwPnULQVbepBPkmnNj6FrGb-h7UL1gyqv-8euSqdILYEwz1jcrTDpyzqwXhOToI8oBKfnBocyYf2M0iOCaCPj4o2YBNGQIzHq12YTKHV-opmUmfVXjDtWCPELKv3ed1xg1CS_ZEUKHXD4S724UzxcXneimct5XwGfMTUtgyZYmJYU2519s2yHB_0FzlkqBVKrxwMEqkPp85w0UjPuBlSwzwMAEze_J7IYE4AQDkAYBoAZNgAe4_dTsAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgGEQARgdMgKKAjoCgEDyCBthZHgtc3Vic3luLTUyMzk5MzgyMTM4NzAzODCACgOYCwHICwGADAGwE9vp8RDIE7eMpOED0BMA2BMK2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9D1OUO62QOb7sr66XT4QCAc6gGRkHYi1qr0S__aPdP-aPhvbhjOFm_70kTKXeRDLPGqZCSrxpGAEgEw%26sig%3DAOD64_3-z_XYl25mDV_X5Jrm6Hx4s_49tg%26client%3Dca-pub-8933329999391104%26dbm_c%3DAKAmf-Bhb7WnPP7_QB_ysexA7T8kXDNDYsxagqKkaMz06HCcWZF_kdCxW1Ub_CEG2n99dAl__Z7cdgQbKdtYhpoRPBUMDDt0yx34NtxQsBlZQ1ZtXQ-BohFcyDD0guLORGNTdSi5_zSUF76Ghpdu7DqiKvFAOUCMuuBDIGxzS8C216th0Gr6xlU%26cry%3D1%26dbm_d%3DAKAmf-BZklHQByQhP1Z1xgI29jLUfCKPEK7gATj8_rrVO6_UIt1aNclTbcijE_h8yrXMLaYpusPdWPMtgNbg42b2tYRwH5OENsu02LGe7CN4qUmZ7aPLcB76lcaInld_e4GtqynCAP4Gqf6pIF-nk2r1uXCZpt_8PnLNXvoyc2TWD_V6T1nceHHzlhdcYTncI61FgITXSGVxsNvkC0mNIkJ8LTsWz8Q9UM3RGZQ-O9ikh3x_FcwDKAiMl3mOMTbbM_ByQeY6Lweerk5YFy8zfGyEgzDLTr_3c6vB9Uh0ZyFC-xV9zL8_0bhDxQ2rFH9QFklJbJfik7pK-Ju6KP52qvQnPRLMgJ3oRg1JxMQGb-EaSlAPAnHvX4fzFMPxt6nJ1Z2LVdxBfKuH0P4191C-lcwQUy0PVgpprp2zy2EI-ABWnbjpuLOF9nfo0SU6p271kS7-5l42n6X2uDAccOHQ07XR1AemP-LYWpyy7Txj8U_OLWe3744aob0sME_gxSsLTVSYd2fwdP_cIqiLsGsxCltxOLyrClUGQrH2Nx-cPcqe4bPYYhDrD4othhYWYoydJFYVPJIBke7KcNCc2eW4XC7SyXv62XHhDs2xjgx2mktr_57KY48X_FU%26adurl%3Dhttps%3a%2f%2fwww.adtrek.co%2fadserver%2fclick%3fcc%3d32c8794c-79f1-49bb-a03f-85569be09a9f&ord=1668141990723954
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.129.116 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 04af379c37398603077d9d44bfccfb4f4fa3cddcd33a3f1629f25c22031a09a6

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:34 GMT
Content-Encoding: gzip
Last-Modified: Wed, 12 Oct 2022 01:38:24 GMT
Server: AmazonS3
x-amz-request-id: VKCFPZH23177M63C
ETag: "51725432a390bdc2beb9923ad23d567f"
x-amz-meta-info: polite loading image
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 1569
x-amz-id-2: feRISz0oZ+Hwr69dhhH6Ihc3uMyVNljS394Eed2/cLgeckzF/aphym0LiuIW9V8T/oXF6h+6mEE=

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CE5A
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESED9rjCcV82LJEOARV1dpKxo&google_cver=1&google_push=ASkJ3FbNe4qdwR7ab2P4HaQx4SsKuKZjFLwNakOgbtBsR0mdF1-WzhMRIh-tWAdUgCdUVg3viLTZSkpMDb0ZHWWohu3kXcD-2NIGcr...
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=DEA4A601E7C34F7B8A65CB6EF47D4DCC&google_push=ASkJ3FbNe4qdwR7ab2P4HaQx4SsKuKZjFLwNakOgbtBsR0mdF1-WzhMRIh-tWAdUgCdUVg3viLTZSkpMDb0ZHWW...

170 B
188 B

285ms
285ms

Image
image/png

142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=DEA4A601E7C34F7B8A65CB6EF47D4DCC&google_push=ASkJ3FbNe4qdwR7ab2P4HaQx4SsKuKZjFLwNakOgbtBsR0mdF1-WzhMRIh-tWAdUgCdUVg3viLTZSkpMDb0ZHWWohu3kXcD-2NIGcrJsUhujDSm6MaHHAAksXKzeMQpzzFsq3KUJ1OeD2GmeEg

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html

Protocol

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 11 Nov 2022 04:46:34 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=DEA4A601E7C34F7B8A65CB6EF47D4DCC&google_push=ASkJ3FbNe4qdwR7ab2P4HaQx4SsKuKZjFLwNakOgbtBsR0mdF1-WzhMRIh-tWAdUgCdUVg3viLTZSkpMDb0ZHWWohu3kXcD-2NIGcrJsUhujDSm6MaHHAAksXKzeMQpzzFsq3KUJ1OeD2GmeEg
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Thu, 10 Nov 2022 04:46:34 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CE5A
Redirect Chain

https://px.ads.linkedin.com/setuid?partner=googleadxdb&google_gid=CAESEK0IbgTMT-jHpSo32UoED5o&google_cver=1&google_push=ASkJ3FYgDTp9wqq1RDEBVVngEG6J9c3Le84bIannwUp1q7fHNp_ucTtbg7_JfG1An6SWHI7hy_6u6...
https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=ASkJ3FYgDTp9wqq1RDEBVVngEG6J9c3Le84bIannwUp1q7fHNp_ucTtbg7_JfG1An6SWHI7hy_6u6Nys71H2nqbPI498rMLSl-PivFPxPJCtCk4ONDDSc5Tfy0CNuZasF6...

170 B
188 B

282ms
282ms

Image
image/png

142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=ASkJ3FYgDTp9wqq1RDEBVVngEG6J9c3Le84bIannwUp1q7fHNp_ucTtbg7_JfG1An6SWHI7hy_6u6Nys71H2nqbPI498rMLSl-PivFPxPJCtCk4ONDDSc5Tfy0CNuZasF61VGoI_hSX667xeJQ

Requested by

Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 11 Nov 2022 04:46:33 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 17DB5FC244DB4E23BCF403E9245E6142 Ref B: MEL01EDGE1322 Ref C: 2022-11-11T04:46:34Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=ASkJ3FYgDTp9wqq1RDEBVVngEG6J9c3Le84bIannwUp1q7fHNp_ucTtbg7_JfG1An6SWHI7hy_6u6Nys71H2nqbPI498rMLSl-PivFPxPJCtCk4ONDDSc5Tfy0CNuZasF61VGoI_hSX667xeJQ
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXtKpL+eS8K56yN0aEqmQ==

GET
H/1.1 200
OK us.php
c.eu1.dyntrk.com/adx/ga/ Frame CE5A 0
215 B 834ms
395ms Image
text/plain 162.19.80.92
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.eu1.dyntrk.com/adx/ga/us.php?dynk=ga2ex&google_gid=CAESEIW7kw4mhXLpz6KPkYaegxQ&google_cver=1&google_push=ASkJ3FZMf8Mse3ozwJ5_S-TJoGWhS8lpKdHULTcxrtoIG-GOg-heDlqHopY4A80BQCw1yENxKWLgM_3qnQmCv7Todz5SeDv_eM01o5dnzpnecUyopipFQFiHUhT6fyl7R5UTyRzXTSJqsTL-Kw
Requested by: Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.19.80.92 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3011863.ip-162-19-80.eu
Software: proxy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
cache-control: private, no-cache, no-store, proxy-revalidate, no-transform
x-rc: 10
server: proxy
content-length: 0
content-type: text/plain

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CE5A
Redirect Chain

https://s.uuidksinc.net/match/47/?remote_uid=CAESEKzCK9Si0Ia8fRVdcaI0B8Y&c_param1=ASkJ3FaBbnGQYFCKKWHuTAo1mU3g7g76kF8JUGNnG9cdR1DiQoNzy-YVmsM4LCHGXFnI5DJWiL_gCPA6rMlKplg6oQ8MvfIGKmqkxokVd-pDTHzKeqs...
https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=ASkJ3FaBbnGQYFCKKWHuTAo1mU3g7g76kF8JUGNnG9cdR1DiQoNzy-YVmsM4LCHGXFnI5DJWiL_gCPA6rMlKplg6oQ8MvfIGKmqkxokVd-pDTHzKeqs1225Hb3YTur7jWWmwG...

170 B
188 B

283ms
282ms

Image
image/png

142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=ASkJ3FaBbnGQYFCKKWHuTAo1mU3g7g76kF8JUGNnG9cdR1DiQoNzy-YVmsM4LCHGXFnI5DJWiL_gCPA6rMlKplg6oQ8MvfIGKmqkxokVd-pDTHzKeqs1225Hb3YTur7jWWmwGNyg94Yq_Pl6Ew

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html

Protocol

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=ASkJ3FaBbnGQYFCKKWHuTAo1mU3g7g76kF8JUGNnG9cdR1DiQoNzy-YVmsM4LCHGXFnI5DJWiL_gCPA6rMlKplg6oQ8MvfIGKmqkxokVd-pDTHzKeqs1225Hb3YTur7jWWmwGNyg94Yq_Pl6Ew
date: Fri, 11 Nov 2022 04:46:34 GMT
server: nginx/1.19.0
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CE5A
Redirect Chain

https://tg.socdm.com/rtb/sync_before?proto=google_ebda&google_gid=CAESEECLMsH53Q0FBCT13gLEwFQ&google_cver=1&google_push=ASkJ3FZ0pZ1Ehrm1efPfXI2CIp5ARsxGiQMrnDpdDxa3qo3rEkr2ec6JGq27U5JrDkowBqxNmJYdW...
https://cm.g.doubleclick.net/pixel?google_nid=ad_generation_eb&google_push=ASkJ3FZ0pZ1Ehrm1efPfXI2CIp5ARsxGiQMrnDpdDxa3qo3rEkr2ec6JGq27U5JrDkowBqxNmJYdWQ92Oxw1SiXjqNgyj8yS1mZS4mvgsxQxtDtn18ahcepeZ6...

170 B
188 B

350ms
285ms

Image
image/png

142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ad_generation_eb&google_push=ASkJ3FZ0pZ1Ehrm1efPfXI2CIp5ARsxGiQMrnDpdDxa3qo3rEkr2ec6JGq27U5JrDkowBqxNmJYdWQ92Oxw1SiXjqNgyj8yS1mZS4mvgsxQxtDtn18ahcepeZ61xF97i8id8CPaphjcI6VcFog&google_hm=WTIzVHFjQ284WUFBQUJBMWRESUFBQUFB

Requested by

Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

X-SO-Cluster-ID: 34
Date: Fri, 11 Nov 2022 04:46:33 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/rtb\/sync_before?proto=google_ebda&google_gid=CAESEECLMsH53Q0FBCT13gLEwFQ&google_cver=1&google_push=ASkJ3FZ0pZ1Ehrm1efPfXI2CIp5ARsxGiQMrnDpdDxa3qo3rEkr2ec6JGq27U5JrDkowBqxNmJYdWQ92Oxw1SiXjqNgyj8yS1mZS4mvgsxQxtDtn18ahcepeZ61xF97i8id8CPaphjcI6VcFog","cluster_id":34,"gdpr":false,"ipv4":"116.90.74.196","key":"Y23TqcCo8YAAABA1dDIAAAAA","privacy_sensitive":false,"uid":"","upstream_id":"m-ad290"}
X-SO-Key: Y23TqcCo8YAAABA1dDIAAAAA
Server: nginx
X-SO-Upstream-ID: m-ad290
P3P: CP="See also http://www.scaleout.jp/privacy/"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ad_generation_eb&google_push=ASkJ3FZ0pZ1Ehrm1efPfXI2CIp5ARsxGiQMrnDpdDxa3qo3rEkr2ec6JGq27U5JrDkowBqxNmJYdWQ92Oxw1SiXjqNgyj8yS1mZS4mvgsxQxtDtn18ahcepeZ61xF97i8id8CPaphjcI6VcFog&google_hm=WTIzVHFjQ284WUFBQUJBMWRESUFBQUFB
Cache-Control: private
X-SO-HostName: m-ad290.dc4p.scaleout.jp
Connection: keep-alive
X-SO-Ads-Time: 3
Content-Length: 0
X-SO-LB-Hostname: m-tgng28.dc4p.scaleout.jp
X-SO-IP: 116.90.74.196

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CE5A
Redirect Chain

https://rtb2-useast.e-volution.ai/sync?exchange=193&google_gid=CAESEB9Qi_7Wu971cJM9TskErlk&google_cver=1&google_push=ASkJ3FaAX1ECR6MdJyElqI_QCP70fR_oNDwXcPgCVxdnkUzgR5tkHjOELlhwKLrC79qz-6MFHLEmF6O-...
https://dsp.adkernel.com/adkuid?r=https%3A%2F%2Frtb2-useast.e-volution.ai%2Fsync%3Fexchange%3D193%26google_gid%3DCAESEB9Qi_7Wu971cJM9TskErlk%26google_cver%3D1%26google_push%3DASkJ3FaAX1ECR6MdJyElqI...
https://rtb2-useast.e-volution.ai/sync?adkuid=A4922620013104618519&exchange=193&google_gid=CAESEB9Qi_7Wu971cJM9TskErlk&google_cver=1&google_push=ASkJ3FaAX1ECR6MdJyElqI_QCP70fR_oNDwXcPgCVxdnkUzgR5tk...
https://cm.g.doubleclick.net/pixel?google_nid=metup_srl_w_bidswitch&google_hm=QTQ5MjI2MjAwMTMxMDQ2MTg1MTk&google_push=ASkJ3FaAX1ECR6MdJyElqI_QCP70fR_oNDwXcPgCVxdnkUzgR5tkHjOELlhwKLrC79qz-6MFHLEmF6O...

170 B
188 B

290ms
289ms

Image
image/png

142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=metup_srl_w_bidswitch&google_hm=QTQ5MjI2MjAwMTMxMDQ2MTg1MTk&google_push=ASkJ3FaAX1ECR6MdJyElqI_QCP70fR_oNDwXcPgCVxdnkUzgR5tkHjOELlhwKLrC79qz-6MFHLEmF6O-mu3KAPLSZEJyAkOR6rw-k8il37d2wXLcSDIL6Gge7LyTmPMycvlLj8TAwLQh6wVocQ

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html

Protocol

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=metup_srl_w_bidswitch&google_hm=QTQ5MjI2MjAwMTMxMDQ2MTg1MTk&google_push=ASkJ3FaAX1ECR6MdJyElqI_QCP70fR_oNDwXcPgCVxdnkUzgR5tkHjOELlhwKLrC79qz-6MFHLEmF6O-mu3KAPLSZEJyAkOR6rw-k8il37d2wXLcSDIL6Gge7LyTmPMycvlLj8TAwLQh6wVocQ
Date: Fri, 11 Nov 2022 04:46:35 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CE5A
Redirect Chain

https://match.sharethrough.com/E4rooAtA/v1?google_gid=CAESEDs6J05CdsOgUhD6e2hMxLY&google_cver=1&google_push=ASkJ3Fae0mTaXKogT7DDZiFPqUXHsNrVC9EAEaJdpmqfbHdLSHqfqLEsSke6fJKqnmjS7aw0YzwuQQpRubsVakd9v...
https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=MTk2ZWQ1NzYtOGI1NS00N2NiLTgxMzQtMjE4NWQxYTRjYzYz&google_push=ASkJ3Fae0mTaXKogT7DDZiFPqUXHsNrVC9EAEaJdpmqfbHdLSHqfqLEsSke6fJKq...

170 B
188 B

283ms
283ms

Image
image/png

142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=MTk2ZWQ1NzYtOGI1NS00N2NiLTgxMzQtMjE4NWQxYTRjYzYz&google_push=ASkJ3Fae0mTaXKogT7DDZiFPqUXHsNrVC9EAEaJdpmqfbHdLSHqfqLEsSke6fJKqnmjS7aw0YzwuQQpRubsVakd9vQ5kXX_dpoDQ5oB-hP93XwpTkbyJpg-2c7KQ_cLW-Jw1Py8UQOgeC1Lut-w

Requested by

Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=MTk2ZWQ1NzYtOGI1NS00N2NiLTgxMzQtMjE4NWQxYTRjYzYz&google_push=ASkJ3Fae0mTaXKogT7DDZiFPqUXHsNrVC9EAEaJdpmqfbHdLSHqfqLEsSke6fJKqnmjS7aw0YzwuQQpRubsVakd9vQ5kXX_dpoDQ5oB-hP93XwpTkbyJpg-2c7KQ_cLW-Jw1Py8UQOgeC1Lut-w
date: Fri, 11 Nov 2022 04:46:34 GMT
content-length: 0

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame CE5A 0
40 B 578ms
274ms Image
text/html 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LE8w4Q2FMickYvxefUMMeGyALC-Ys0cCVwQJT11oDwZ7OHLAbofXFXeIBIUXGWK26y6vskjpU

Requested by

Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:34 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 74FE
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=2777667461208195544&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

239ms
238ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=2777667461208195544&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:35 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=2777667461208195544&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Fri, 11 Nov 2022 04:46:33 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 74FE
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=c6aa2b82-10ff-7c45-fcfe-9ffcb4a4bc8d&gdpr=0
https://match.adsrvr.org/track/cmb/openx?oxid=c6aa2b82-10ff-7c45-fcfe-9ffcb4a4bc8d&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed&ttd_puid=c6aa2b82-10ff-7c45-fcfe-9ffcb4a4bc8d&gdpr=0&gdpr_consent=

43 B
62 B

238ms
238ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed&ttd_puid=c6aa2b82-10ff-7c45-fcfe-9ffcb4a4bc8d&gdpr=0&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:33 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed&ttd_puid=c6aa2b82-10ff-7c45-fcfe-9ffcb4a4bc8d&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 335

GET
H2

200

sd
jp-u.openx.net/w/1.0/ Frame 74FE
Redirect Chain

https://tg.socdm.com/rtb/sync_before?proto=openx
https://jp-u.openx.net/w/1.0/sd?id=537072335&val=Y23TqsCo8XwAABLHoNcAAAAA

43 B
114 B

238ms
237ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jp-u.openx.net/w/1.0/sd?id=537072335&val=Y23TqsCo8XwAABLHoNcAAAAA
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

X-SO-Cluster-ID: 56
Date: Fri, 11 Nov 2022 04:46:34 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/rtb\/sync_before?proto=openx","cluster_id":56,"gdpr":false,"ipv4":"116.90.74.196","key":"Y23TqsCo8XwAABLHoNcAAAAA","privacy_sensitive":false,"uid":"","upstream_id":"a-ad40222"}
X-SO-Key: Y23TqsCo8XwAABLHoNcAAAAA
Server: nginx
X-SO-Upstream-ID: a-ad40222
P3P: CP="See also http://www.scaleout.jp/privacy/"
Location: https://jp-u.openx.net/w/1.0/sd?id=537072335&val=Y23TqsCo8XwAABLHoNcAAAAA
Cache-Control: private
X-SO-HostName: a-ad40222.dc2p.scaleout.jp
Connection: keep-alive
X-SO-Ads-Time: 2
Content-Length: 0
X-SO-LB-Hostname: m-tgng24.dc4p.scaleout.jp
X-SO-IP: 116.90.74.196

GET
H3

200

sd
jp-u.openx.net/w/1.0/ Frame 74FE
Redirect Chain

https://cr-p3.ladsp.com/cookiesender/3
https://cr-p3.ladsp.com/cookiesender/3?cr=true
https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AXhwUbUHqjBPks8ADv76QMLiBM8AAAGEZQLSew

43 B
61 B

237ms
237ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AXhwUbUHqjBPks8ADv76QMLiBM8AAAGEZQLSew
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
via: 1.1 55c8386ba54fbe8ac7d89b90344d4344.cloudfront.net (CloudFront)
server: Logicad
x-amz-cf-pop: SIN52-C3
x-cache: Miss from cloudfront
p3p: CP="NOI DEVo TAIo PSAo PSDo OUR IND UNI NAV", policyref="http://cd.ladsp.com/xml/w3c/p3p.xml"
location: https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AXhwUbUHqjBPks8ADv76QMLiBM8AAAGEZQLSew
cache-control: no-cache
content-length: 0
x-amz-cf-id: iUXUzYP2HlSkWE8PfMle2rbb95qTdOAzS3jua4aCuGanQ_ZKMv9RAw==
expires: -1

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 74FE 170 B
232 B 580ms
277ms Image
image/png 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZWFjNWY4NDgtZDk4OC0yMmUxLWU5MWUtYzU0NTdlNDY3MmVk

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 74FE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDrzf0MF3V6FdhEDO2Acbaw&google_cver=1

43 B
61 B

239ms
238ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDrzf0MF3V6FdhEDO2Acbaw&google_cver=1
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDrzf0MF3V6FdhEDO2Acbaw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel;r=1122227143;rf=0;a=p-54Nt-1NAaEEe0;url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33bc53c3e1dfb09200d6c2f8387d67...
pixel.quantserve.com/ 35 B
210 B 251ms
238ms Image
image/gif 103.229.10.247
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=1122227143;rf=0;a=p-54Nt-1NAaEEe0;url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33bc53c3e1dfb09200d6c2f8387d67ea6;uht=2;fpan=1;fpa=P0-1450987154-1668141990569;pbc=150614db-b978-43b2-a628-5714d0838f70;ns=0;ce=1;qjs=1;qv=4a00825e-20221110201859;cm=;gdpr=0;ref=;d=bg3.co;dst=0;et=1668141993683;tzo=0;ogl=;ses=f84b05eb-4206-46d1-abb2-745ca7b0a2ed

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.229.10.247 , Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Fri, 11 Nov 2022 04:46:36 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5AFD 0
20 B 279ms
279ms Image
image/gif 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BeF8oqNNtY9SZG5GF9fwP5s6poAoAAAAAOAHgBAI&bg=!DwylDEjNAAbvMpMzzzI7ACkAdvg8WgNEHBrWGbVBR7D18q_MtGV9Z3c_y2xxfqK24bOmSObY06pY5gIAAABNUgAAAAJoAQeZAuUwzr7vssQUxq_1n2tntIJdTyu1DYC0luJNbuV5WY3i9ID34WRd-z_cxxS8_Pqa0ZL7N3BltufnB22kr-3SLkNtZ8HHt67_2YdyZz_Kjyqd9atyWNo7ea37SKH8veg55S_b-HSwKdUZBZkZRqJKNESaoLw6veBusddiVKChLO19lKDvT_nafe16ENSmx4Pl355S7zolU5u4aYLgMDx3paadSVDBQ46av53xMve3KURnuTLnlXlpv_coCP0P-s0_PU4Kqc_HVp9dXLAWZ9meXN5B1WrHFHKZIt8fSfzPnhXH_wWU_QYb4RTINj_gGsoUgIpTbpDjzN8V0FvJxdKsplVL3VQlwBRIhoUhSoVw8F13yVYV-CPgxBaoTJ8e58_yAfeTy-In6nPtPUpOuARbAyPVqm8I1cMQtxhRNn95BaPJfVUE_gH9_rRsErFtr8vGHVhPU-0uZ7IH6FVl2vVBVffC6F5MQaArRgKTXtFkuLZwOkJ_fUCBee873Cl4E4HzuYilHDnwd4RLJDeTx9NF7sgdacF66RZEoueUYr1CBjCOuM8eGLxVzKn-TyPchamK1SC_gTHeYsXz5Gc1HdB0fBFHlOZUvWbo3U6F0tTsm0kPw0tAQBk6imADtZDRnmzsqGzwoqWRX6FA6sMNmNmVZO-TDrVAhiDMxbjwVCXwOMguSjjyGKCYXherC769_JeLRfC7f3Vi9Zpoz7J2qO5QrLV7HvYFuTCUHUui9qV7spc3lINguF76HvEbV_zj7XPOEH8ra82rKXfvDXQNgFf_6kgpfOelV68VXcNMDQ231QICDT0pfJvH0-jPwDmcGgSZbw5bbkQP9kJp9N6NeRVWVq89OSqRyARuJl5dh_pYK_IZdWBkrZlu-ikd5wD5j4r6NTB4fSyqs0GEb_mEdKol5tVOqNmn74sxFcb8KCN1ouJmD2CCX8ilmsJdcT8RwbydD5c6dEEE4d_Q2jVXoWrb7DkqGr0oNLE

Requested by

Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:33 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

usermatch Show response
ssum-sec.casalemedia.com/ Frame 6ED8
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1

2 KB
1 KB

556ms
435ms

Document
text/html

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.18.126 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bf59fd1379b3caf3b3bb5c9497adb5e6fc4defe1c651a8fc443b29c39ce62e32

Request headers

Referer: https://js-sec.indexww.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 76846289fa57eeaa-AKL
content-encoding: br
content-type: text/html
date: Fri, 11 Nov 2022 04:46:34 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tSULK4wTbfupW85FO%2BKRyd73%2FWq6xUNfNqv80vnJgKv9mgR9vTnb5EL4ddRzw1GSLtutMRwyIr68AUHUkMER734o8Oho9I5Q4VCHglQODGEVhE87v3OMUEqfeUA3rXKtCiV6nrtubxOo8g%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 76846287bb1aa8ac-SYD
content-length: 0
date: Fri, 11 Nov 2022 04:46:34 GMT
expires: 0
location: /usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mOC9eiTkgCab2VAxwkchfV4%2FaXRNkrYeBM8au3BYjNu%2BrYt3VWNQ%2BRjwhhQyZ70OnnW5%2BAib4kYweK%2BcK%2BVE6B0vFishuDHOnTai9SO%2BTx6sOhZc8dXGmRSTwaZCWh7PUz%2BTmtlSUfuGPw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2

200

/
onetag-sys.com/match/ Frame C5F0
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=75&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D1%26uid%3D%5BMM_UUID%5D%26gdpr%3D1%26gdpr_consent%3D
https://onetag-sys.com/match/?int_id=1&uid=847b636d-d3aa-4400-9736-6e984d688036&gdpr=1&gdpr_consent=

0
340 B

391ms
391ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=1&uid=847b636d-d3aa-4400-9736-6e984d688036&gdpr=1&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1668141988381

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Date: Fri, 11 Nov 2022 04:46:34 GMT
Server: MT3 4629 97bee97 master nrt-pixel-x14 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://onetag-sys.com/match/?int_id=1&uid=847b636d-d3aa-4400-9736-6e984d688036&gdpr=1&gdpr_consent=
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Fri, 11 Nov 2022 04:46:33 GMT

GET
H/1.1 204
No Content sync.php
pixel-eu.rubiconproject.com/exchange/ Frame C5F0 0
239 B 1793ms
388ms Image
image/gif 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-eu.rubiconproject.com/exchange/sync.php?p=onetag&gdpr=1&gdpr_consent=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1668141988381
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

/
onetag-sys.com/match/ Frame C5F0
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D98%26gdpr%3D1%26gdpr_consent%3D%26uid%3D$UID
https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=3680859315881377104

0
340 B

391ms
391ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=3680859315881377104

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1668141988381

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Date: Fri, 11 Nov 2022 04:46:34 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 116.90.74.196; 116.90.74.196; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 29c94b4d-07e0-4f0f-a4f4-6ef3b1ae2a7d
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=3680859315881377104
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK tap.php
pixel.rubiconproject.com/ Frame C5F0 42 B
679 B 1313ms
237ms Image
image/gif 69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=223352&nid=4584&put=t6fI41fj_gABxidy2C6_9Lw8BErXOrEZCIkQuDZnDs8
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1668141988381
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: f60a7260b0ebb7a40a81234af4a9e826
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C5F0
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&ot_initiated=1
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABhGUC0NtNB3JYm-efQ0eGia_yq2YkpEe3fA

170 B
188 B

282ms
281ms

Image
image/png

142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABhGUC0NtNB3JYm-efQ0eGia_yq2YkpEe3fA

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1668141988381

Protocol

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABhGUC0NtNB3JYm-efQ0eGia_yq2YkpEe3fA
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H/1.1 200
OK sync
ssbsync-global.smartadserver.com/api/ Frame C5F0 0
75 B 1311ms
235ms Image
text/plain 23.106.127.52
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=1&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid]
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1668141988381
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.106.127.52 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:34 GMT
content-length: 0

GET
H2

200

/
onetag-sys.com/match/ Frame C5F0
Redirect Chain

https://id.rlcdn.com/711916.gif?ct=4&cv=
https://id.rlcdn.com/1000.gif?memo=COy5KxoNCKqnt5sGEgUI6AcQAEIASgA
https://onetag-sys.com/match/?int_id=110&uid=

0
340 B

392ms
392ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=110&uid=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1668141988381

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

date: Fri, 11 Nov 2022 04:46:35 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://onetag-sys.com/match/?int_id=110&uid=
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame C5F0
Redirect Chain

https://onetag-sys.com/match/?int_id=113&gdpr=1&gdpr_consent=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1
https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=g9g4wLGp0efm6qjv_6bMeI9v-Gb5yRo_ANOgl2APmok

43 B
479 B

1357ms
340ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=g9g4wLGp0efm6qjv_6bMeI9v-Gb5yRo_ANOgl2APmok

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1668141988381

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:35 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 3TTACCN525FQ4CZX6XAJ
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location: https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=g9g4wLGp0efm6qjv_6bMeI9v-Gb5yRo_ANOgl2APmok
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2 200 ImgSync
image8.pubmatic.com/AdServer/ Frame C5F0 0
42 B 711ms
236ms Image
text/plain 67.199.150.82
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=1&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26uid%3D%23PMUID
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1668141988381
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 67.199.150.82 Los Angeles, United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:35 GMT
content-length: 0

GET
H2

200

/
onetag-sys.com/match/ Frame C5F0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm
https://onetag-sys.com/match/?int_id=106&google_gid=CAESEFFVzTGcB5fyoGt5BW7J9pg&google_cver=1

0
340 B

393ms
392ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=106&google_gid=CAESEFFVzTGcB5fyoGt5BW7J9pg&google_cver=1

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1668141988381

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

ec2-52-74-162-2.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=106&google_gid=CAESEFFVzTGcB5fyoGt5BW7J9pg&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 298
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 occ
ups.analytics.yahoo.com/ups/58488/ Frame C5F0 0
15 B 239ms
239ms Image
text/plain 52.74.162.2
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58488/occ?&gdpr=1&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1668141988381

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.74.162.2 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/9.1.10.25 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:35 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

/
onetag-sys.com/match/ Frame C5F0
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=vw6iyrn&ttd_tpi=1&gpdr=1&gdpr_consent=
https://onetag-sys.com/match/?int_id=29&uid=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed&gdpr=0&gdpr_consent=

0
340 B

392ms
392ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=29&uid=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed&gdpr=0&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1668141988381

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:35 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://onetag-sys.com/match/?int_id=29&uid=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 233

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame C5F0 43 B
235 B 521ms
358ms Image
image/gif 35.213.12.39
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=onetag&gdpr=1&gdpr_consent=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1668141988381
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.213.12.39 Tokyo, Japan, ASN15169 (GOOGLE, US),
Reverse DNS: 39.12.213.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:35 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame EBD6 22 KB
8 KB 275ms
274ms Document
text/html 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 165359
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 09 Nov 2022 06:50:35 GMT
expires: Thu, 09 Nov 2023 06:50:35 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 33A4 0
20 B 277ms
277ms Image
image/gif 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodarir&v=30&d=1&s=1&f=0.01&bgai=BdiHSqNNtY6HPHK2r3LUP2Iud0AEAAAAAOAHgBAI

Requested by

Host: 4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com
URL: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame ADA3 33 KB
10 KB 271ms
270ms Script
text/html 23.75.85.227
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.75.85.227 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-75-85-227.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 701e63b36146442c60d37618e26c0a0d8efd675766377047a5f96c2d953f119c

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:34 GMT
Content-Encoding: gzip
Last-Modified: Fri, 11 Nov 2022 00:59:42 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=72788
Connection: keep-alive
Content-Length: 9884
Expires: Sat, 12 Nov 2022 00:59:42 GMT

GET
H2 200 sync Show response
gum.criteo.com/ Frame 35E3 61 B
301 B 549ms
236ms Script
text/javascript 182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?r=2&c=321&gdpr=0&gdpr_pd=0&gdpr_consent=&us_privacy=&j=window.advBidxc.mnetRtusId

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C294%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

f77f47058428a1c21dad5a75ac13fbfdeb9858947218fee2112fded5972a0b5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:34 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
server: Kestrel
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 304680
expires: 60

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 1231
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=medianet
https://eus.rubiconproject.com/usync.html?p=medianet

281 B
554 B

272ms
271ms

Document
text/html

23.75.85.227
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=medianet
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C294%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.75.85.227 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-75-85-227.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://contextual.media.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 11 Nov 2022 04:46:35 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Fri, 11 Nov 2022 04:46:34 GMT
location: https://eus.rubiconproject.com/usync.html?p=medianet
server: AkamaiGHost

GET
H2

200

cksync.html Show response
contextual.media.net/ Frame 57B9
Redirect Chain

https://p.rfihub.com/cm?pub=19967&in=1&forward=https%3A%2F%2Fcontextual.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Drkt%26refUrl%3D%26vid%3D814199422531114359474436050...
https://contextual.media.net/cksync.html?cs=8&vsid=3111435947443605000V10&type=rkt&refUrl=&vid=81419942253111435947443605000V10&ovsid=2018808912825656481

219 B
651 B

308ms
307ms

Document
text/html

104.71.48.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/cksync.html?cs=8&vsid=3111435947443605000V10&type=rkt&refUrl=&vid=81419942253111435947443605000V10&ovsid=2018808912825656481

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.71.48.26 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

85af3052d288ffd9157258dfe4daf5309f0b64d0067ab8221cd0c62909c18419

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://contextual.media.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-length: 219
content-type: text/html;charset=UTF-8
date: Fri, 11 Nov 2022 04:46:35 GMT
expires: Fri, 11 Nov 2022 04:46:35 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA" CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
pragma: no-cache
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

Redirect headers

Content-Length: 0
Date: Fri, 11 Nov 2022 04:46:35 GMT
Location: https://contextual.media.net/cksync.html?cs=8&vsid=3111435947443605000V10&type=rkt&refUrl=&vid=81419942253111435947443605000V10&ovsid=2018808912825656481
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.3.29.v20201019)

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame AE15 15 KB
6 KB 829ms
270ms Document
text/html 23.78.217.19
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dpba%26refUrl%3D%26vid%3D81419942253111435947443605000V10%26ovsid%3DPM_UID
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C294%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.78.217.19 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-78-217-19.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://contextual.media.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=32259
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Fri, 11 Nov 2022 04:46:34 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Fri, 11 Nov 2022 13:44:13 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2

200

cksync.php
contextual.media.net/ Frame 35E3
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dapx%26refUrl%3D%26vid%3D81419942253111435947443605000V10%26ovsid%3D%24UID
https://contextual.media.net/cksync.php?cs=8&vsid=3111435947443605000V10&type=apx&refUrl=&vid=81419942253111435947443605000V10&ovsid=3680859315881377104

45 B
453 B

391ms
391ms

Image
image/gif

104.71.48.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3111435947443605000V10&type=apx&refUrl=&vid=81419942253111435947443605000V10&ovsid=3680859315881377104

Requested by

Protocol

Server

104.71.48.26 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Fri, 11 Nov 2022 04:46:34 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Fri, 11 Nov 2022 04:46:34 GMT

Redirect headers

Date: Fri, 11 Nov 2022 04:46:34 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 116.90.74.196; 116.90.74.196; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 67f354c3-f00c-4700-8a92-fcb045e54b50
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://contextual.media.net/cksync.php?cs=8&vsid=3111435947443605000V10&type=apx&refUrl=&vid=81419942253111435947443605000V10&ovsid=3680859315881377104
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

cksync.html
contextual.media.net/ Frame 35E3
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=78e2dffc-bb89-4bb2-ae92-f592d006518b&ph=6a16560a-f6c6-4851-b7b5-0b2c0190166a&r=https%3A%2F%2Fcontextual.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D3111435947443605...
https://contextual.media.net/cksync.html?cs=8&vsid=3111435947443605000V10&type=opx&refUrl=&vid=81419942253111435947443605000V10&ovsid=0e86421d-bbff-46a5-9fb1-e192064b2e51

219 B
219 B

305ms
304ms

Image
text/html

104.71.48.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.html?cs=8&vsid=3111435947443605000V10&type=opx&refUrl=&vid=81419942253111435947443605000V10&ovsid=0e86421d-bbff-46a5-9fb1-e192064b2e51

Requested by

Protocol

Server

104.71.48.26 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Fri, 11 Nov 2022 04:46:34 GMT
server: Apache
vary: Accept-Encoding
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: text/html;charset=UTF-8
cache-control: max-age=0, no-cache, no-store
content-length: 219
x-mnet-hl2: E
expires: Fri, 11 Nov 2022 04:46:34 GMT

Redirect headers

date: Fri, 11 Nov 2022 04:46:34 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://contextual.media.net/cksync.html?cs=8&vsid=3111435947443605000V10&type=opx&refUrl=&vid=81419942253111435947443605000V10&ovsid=0e86421d-bbff-46a5-9fb1-e192064b2e51
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

cksync.php
contextual.media.net/ Frame 35E3
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=64&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dmma%26refUrl%3D%26vid%3D814199422531114359474436...
https://contextual.media.net/cksync.php?cs=8&vsid=3111435947443605000V10&type=mma&refUrl=&vid=81419942253111435947443605000V10&ovsid=635a636d-d3aa-4200-b3a0-f12363f77230

45 B
465 B

292ms
290ms

Image
image/gif

104.71.48.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3111435947443605000V10&type=mma&refUrl=&vid=81419942253111435947443605000V10&ovsid=635a636d-d3aa-4200-b3a0-f12363f77230

Requested by

Protocol

Server

104.71.48.26 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Fri, 11 Nov 2022 04:46:35 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Fri, 11 Nov 2022 04:46:35 GMT

Redirect headers

Date: Fri, 11 Nov 2022 04:46:34 GMT
Server: MT3 4629 97bee97 master nrt-pixel-x9 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://contextual.media.net/cksync.php?cs=8&vsid=3111435947443605000V10&type=mma&refUrl=&vid=81419942253111435947443605000V10&ovsid=635a636d-d3aa-4200-b3a0-f12363f77230
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Fri, 11 Nov 2022 04:46:33 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 35E3
Redirect Chain

https://sync.1rx.io/usersync2/rmp1r1?sub=medianet&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dr1%26refUrl%3D%26vid%3D81419942253111435947...
https://sync.1rx.io/usersync2/rmp1r1?sub=medianet&zcc=1&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dr1%26refUrl%3D%26vid%3D81419942253111...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=576425946
https://sync.1rx.io/usersync/tradedesk/1bc1ccf6-de8d-48ed-908c-c2e129bce8ed
https://sync.targeting.unrulymedia.com/csync/RX-696a581e-8d06-4a82-8bcb-7fe19581bee0-004?redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dr1%2...
https://contextual.media.net/cksync.php?cs=8&vsid=3111435947443605000V10&type=r1&refUrl=&vid=81419942253111435947443605000V10&ovsid=RX-696a581e-8d06-4a82-8bcb-7fe19581bee0-004

45 B
470 B

315ms
312ms

Image
image/gif

104.71.48.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3111435947443605000V10&type=r1&refUrl=&vid=81419942253111435947443605000V10&ovsid=RX-696a581e-8d06-4a82-8bcb-7fe19581bee0-004

Requested by

Protocol

Server

104.71.48.26 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Fri, 11 Nov 2022 04:46:37 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Fri, 11 Nov 2022 04:46:37 GMT

Redirect headers

location: https://contextual.media.net/cksync.php?cs=8&vsid=3111435947443605000V10&type=r1&refUrl=&vid=81419942253111435947443605000V10&ovsid=RX-696a581e-8d06-4a82-8bcb-7fe19581bee0-004
date: Fri, 11 Nov 2022 04:46:37 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RX696a581e8d064a828bcb7fe19581bee0004
content-type: text/html

GET
H/1.1

200
OK

cksync
cs.media.net/ Frame 35E3
Redirect Chain

https://cm.g.doubleclick.net/pixel?cs=8&google_nid=media&google_cm=1&google_hm=MzExMTQzNTk0NzQ0MzYwNTAwMFYxMA%3D%3D&google_sc=1
https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEMF196GzEWZUv62aG1SHcyo&google_cver=1

45 B
610 B

878ms
333ms

Image
image/gif

96.17.188.24
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEMF196GzEWZUv62aG1SHcyo&google_cver=1
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C294%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol: HTTP/1.1
Server: 96.17.188.24 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-17-188-24.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:35 GMT
Server: Apache
P3P: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 45
X-MNET-HL2: E
Expires: Fri, 11 Nov 2022 04:46:35 GMT

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEMF196GzEWZUv62aG1SHcyo&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 35E3
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=MEDIANET&rurl=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Ddxu%26refUrl%3D%26vid%3D81419942253111435947443...
https://pm.w55c.net/ping_match.gif?scc=1&ei=MEDIANET&rurl=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Ddxu%26refUrl%3D%26vid%3D81419942253111435...
https://contextual.media.net/cksync.php?cs=8&vsid=3111435947443605000V10&type=dxu&refUrl=&vid=81419942253111435947443605000V10&ovsid=mnUB4g691OTlW35

45 B
452 B

306ms
306ms

Image
image/gif

104.71.48.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3111435947443605000V10&type=dxu&refUrl=&vid=81419942253111435947443605000V10&ovsid=mnUB4g691OTlW35

Requested by

Protocol

Server

104.71.48.26 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Fri, 11 Nov 2022 04:46:35 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Fri, 11 Nov 2022 04:46:35 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:34 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/5502e06#5502e06d7dbe3c52c9a5559e1550ac262fba6e07 i-0be4466892d3f37f0@ap-southeast-1a@dxedge-app-ap-southeast-1-prod-asg
Location: https://contextual.media.net/cksync.php?cs=8&vsid=3111435947443605000V10&type=dxu&refUrl=&vid=81419942253111435947443605000V10&ovsid=mnUB4g691OTlW35
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 35E3 43 B
363 B 710ms
236ms Image
image/gif 182.161.73.146
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=115&p=259&cp=medianet&cu=1&url=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dcrt%26ovsid%3D%40%40CRITEO_USERID%40%40

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.146 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 203510
expires: Fri, 11 Nov 2022 00:00:00 GMT

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame 35E3 43 B
235 B 653ms
289ms Image
image/gif 35.213.12.39
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=medianet&gdpr=0&gdpr_consent=&gdpr_pd=1
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C294%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.213.12.39 Tokyo, Japan, ASN15169 (GOOGLE, US),
Reverse DNS: 39.12.213.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:35 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2

200

cksync.php
contextual.media.net/ Frame 35E3
Redirect Chain

https://b1sync.zemanta.com/usersync/medianet/?cb=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dzem%26refUrl%3D%26vid%3D81419942253111435947443605...
https://stags.bluekai.com/site/23178?id=98pauI0dXBnqAgwxDuyZ&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TD...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TDFZYGQ4B7MNZT2OBGMV4GG2DBNZTWKPLNMVSGSYLOMV2CM33WONUWIPJZHBYGC5KJGBSFQQTOOFAWO53YIR2XS...
https://contextual.media.net/cksync.php?cs=8&ovsid=98pauI0dXBnqAgwxDuyZ&refUrl=&type=zem&vid=81419942253111435947443605000V10&vsid=3111435947443605000V10

45 B
456 B

284ms
283ms

Image
image/gif

104.71.48.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&ovsid=98pauI0dXBnqAgwxDuyZ&refUrl=&type=zem&vid=81419942253111435947443605000V10&vsid=3111435947443605000V10

Requested by

Protocol

Server

104.71.48.26 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Fri, 11 Nov 2022 04:46:38 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Fri, 11 Nov 2022 04:46:38 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:38 GMT
Content-Type: text/html; charset=utf-8
Location: https://contextual.media.net/cksync.php?cs=8&ovsid=98pauI0dXBnqAgwxDuyZ&refUrl=&type=zem&vid=81419942253111435947443605000V10&vsid=3111435947443605000V10
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 196
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 35E3
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=medianet&ssp_user_id=3111435947443605000V10
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=medianet&ssp_user_id=3111435947443605000V10
https://contextual.media.net/cksync.php?type=mf&ovsid=63ff969a-9b0e-4efb-b4b1-d34a208803b0&cs=1

45 B
465 B

296ms
295ms

Image
image/gif

104.71.48.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?type=mf&ovsid=63ff969a-9b0e-4efb-b4b1-d34a208803b0&cs=1

Requested by

Protocol

Server

104.71.48.26 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Fri, 11 Nov 2022 04:46:37 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Fri, 11 Nov 2022 04:46:37 GMT

Redirect headers

Location: //contextual.media.net/cksync.php?type=mf&ovsid=63ff969a-9b0e-4efb-b4b1-d34a208803b0&cs=1
Date: Fri, 11 Nov 2022 04:46:36 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H2 200 um
cs.emxdgt.com/ Frame 35E3 0
66 B 1025ms
339ms Image
text/plain 3.228.33.18
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.emxdgt.com/um?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Demx%26refUrl%3D%26vid%3D81419942253111435947443605000V10%26ovsid%3D%24UID
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C294%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.228.33.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-228-33-18.compute-1.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:35 GMT
server: awselb/2.0
content-length: 0
content-type: text/plain; charset=utf-8

GET
H/1.1

200
OK

cksync
cs.media.net/ Frame 35E3
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8m33zk4&ttd_tpi=1&gdpr=0&gdpr_consent=
https://cs.media.net/cksync?cs=1&type=ttd&ovsid=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed

45 B
621 B

286ms
286ms

Image
image/gif

96.17.188.24
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync?cs=1&type=ttd&ovsid=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C294%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol: HTTP/1.1
Server: 96.17.188.24 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-17-188-24.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:35 GMT
Server: Apache
P3P: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 45
X-MNET-HL2: E
Expires: Fri, 11 Nov 2022 04:46:35 GMT

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:35 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cs.media.net/cksync?cs=1&type=ttd&ovsid=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 199

GET
H2

200

xuid
eb2.3lift.com/ Frame F055
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=3658&xuid=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed&dongle=0cfd

37 B
355 B

237ms
237ms

Image
image/gif

35.71.178.8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed&dongle=0cfd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 35.71.178.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
date: Fri, 11 Nov 2022 04:46:34 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://eb2.3lift.com/xuid?mid=3658&xuid=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed&dongle=0cfd
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 209

GET
H2

200

ebda
eb2.3lift.com/ Frame F055
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTk1NDU1ODY4MDA5MTM5OTgzOTQyMA%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

235ms
234ms

Image
image/gif

35.71.178.8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 35.71.178.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:34 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 248
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame F055
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEMKbKtLiKMWWyB1BkG70Qo0&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1

37 B
355 B

236ms
235ms

Image
image/gif

35.71.178.8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEMKbKtLiKMWWyB1BkG70Qo0&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 35.71.178.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
date: Fri, 11 Nov 2022 04:46:34 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEMKbKtLiKMWWyB1BkG70Qo0&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 332
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F055
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTk1NDU1ODY4MDA5MTM5OTgzOTQyMA%3D%3D

170 B
188 B

282ms
282ms

Image
image/png

142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTk1NDU1ODY4MDA5MTM5OTgzOTQyMA%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1

Protocol

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTk1NDU1ODY4MDA5MTM5OTgzOTQyMA%3D%3D
date: Fri, 11 Nov 2022 04:46:34 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

/
p.adsymptotic.com/d/px/ Frame F055
Redirect Chain

https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=1954558680091399839420&dbredirect=true&gdpr=0&consent=
https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=1954558680091399839420&dbredirect=true&gdpr=0&consent=&cookiesTest=true
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=3de3e2c6-03d1-4589-9b38-73ae08dabe37&_noobservation=1
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=3de3e2c6-03d1-4589-9b38-73ae08dabe37&_noobservation=1&_expected_cookie=a83504a...

43 B
141 B

240ms
240ms

Image
image/gif

104.18.98.194
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=3de3e2c6-03d1-4589-9b38-73ae08dabe37&_noobservation=1&_expected_cookie=a83504a07d8868ad1bad14734cc59308
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 104.18.98.194 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

p3p: CP='NON DSP COR CONi OUR BUS CNT'
date: Fri, 11 Nov 2022 04:46:35 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 768462904a97dfb5-SYD
content-length: 43
content-type: image/gif

Redirect headers

location: https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=3de3e2c6-03d1-4589-9b38-73ae08dabe37&_noobservation=1&_expected_cookie=a83504a07d8868ad1bad14734cc59308
date: Fri, 11 Nov 2022 04:46:35 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7684628eb848dfb5-SYD
content-length: 0

GET
H2

200

xuid
eb2.3lift.com/ Frame F055
Redirect Chain

https://x.bidswitch.net/sync?ssp=triplelift&user_id=1954558680091399839420&gdpr=0&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=triplelift&user_id=1954558680091399839420&gdpr=0&gdpr_consent=
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=397a0df4-c51f-47bf-845f-0bfb88f30687&ssp=triplelift&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=2910&partner_device_id=10527093761914931664&gdpr=0&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_948118%26src.vi...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2910&partner_device_id=10527093761914931664&gdpr=0&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_948118%26...
https://odr.mookie1.com/t/v2?tagid=V2_948118&src.visitorid=2e6ef4c9-5467-4781-94ca-38db754fa6b5&ssp=triplelift&gdpr_consent=&gdpr=0
https://aa.agkn.com/adscores/g.pixel?sid=9212302828&puid=10527093761914931664&ssp=triplelift&gdpr=0&gdpr_consent=
https://odr.mookie1.com/t/v2?tagid=V2_785409&src.visitorId=209330804332001802008&ssp=triplelift&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=419&user_id=10527093761914931664&ssp=triplelift&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2409&xuid=397a0df4-c51f-47bf-845f-0bfb88f30687&dongle=d3d3&gdpr=0&gdpr_consent=&gdpr_pd=

37 B
355 B

238ms
237ms

Image
image/gif

35.71.178.8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2409&xuid=397a0df4-c51f-47bf-845f-0bfb88f30687&dongle=d3d3&gdpr=0&gdpr_consent=&gdpr_pd=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 35.71.178.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
date: Fri, 11 Nov 2022 04:46:39 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Location: //eb2.3lift.com/xuid?mid=2409&xuid=397a0df4-c51f-47bf-845f-0bfb88f30687&dongle=d3d3&gdpr=0&gdpr_consent=&gdpr_pd=
Date: Fri, 11 Nov 2022 04:46:38 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

xuid
eb2.3lift.com/ Frame F055
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/1954558680091399839420?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-DSOGxadE2oS0ohjvCg6EtH5HWdX2ac1Xg4F7kXtNMg--~A&dongle=0883

37 B
355 B

237ms
237ms

Image
image/gif

35.71.178.8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-DSOGxadE2oS0ohjvCg6EtH5HWdX2ac1Xg4F7kXtNMg--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 35.71.178.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
date: Fri, 11 Nov 2022 04:46:35 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date: Fri, 11 Nov 2022 04:46:34 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-DSOGxadE2oS0ohjvCg6EtH5HWdX2ac1Xg4F7kXtNMg--~A&dongle=0883
content-length: 0

GET
H/1.1

200
OK

iu3
s.amazon-adsystem.com/ Frame F055
Redirect Chain

https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=0&gdpr_consent=&uid=1954558680091399839420
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=0&gdpr_consent=&uid=1954558680091399839420&dcc=t

0
0

481ms
362ms

Image
text/html

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=0&gdpr_consent=&uid=1954558680091399839420&dcc=t
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: HTTP/1.1
Server: 52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:35 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: W0874ZYVMV77C6YDX9KB
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=0&gdpr_consent=&uid=1954558680091399839420&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 c.gif
c.bing.com/ Frame F055 42 B
669 B 584ms
292ms Image
image/gif 204.79.197.200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=1954558680091399839420&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 204.79.197.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS: a-0001.a-msedge.net
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
last-modified: Thu, 13 Oct 2022 15:58:17 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 08FEA36A265C45C3ADC3C8F5F37A50DE Ref B: SYD03EDGE0905 Ref C: 2022-11-11T04:46:34Z
etag: "e997be9b1cdfd81:0"
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
content-type: image/gif
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-length: 42

GET
H2

200

xuid
eb2.3lift.com/ Frame F055
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D3335%26xuid%3D%24UID%26dongle%3D4d58%26gdpr=0%26gdpr_consent=
https://eb2.3lift.com/xuid?mid=3335&xuid=3680859315881377104&dongle=4d58&gdpr=0&gdpr_consent=

37 B
355 B

236ms
236ms

Image
image/gif

35.71.178.8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3335&xuid=3680859315881377104&dongle=4d58&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 35.71.178.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
date: Fri, 11 Nov 2022 04:46:35 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Date: Fri, 11 Nov 2022 04:46:35 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 116.90.74.196; 116.90.74.196; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 1ff515ba-2a94-46d5-bdb8-dc1a9f39502f
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://eb2.3lift.com/xuid?mid=3335&xuid=3680859315881377104&dongle=4d58&gdpr=0&gdpr_consent=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 33A4 0
0 579ms
279ms Fetch
image/gif 142.251.12.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstcId1_pEN9C1nK-JFehs785KEYWljLqx2SKG6jk7EfMHd7kXv9ODMM4oydJr5ruDbNMXwBLkDLhTWjW3IYNwYF6m5gvS5ql_iiBCxhxSczL1JdLd4G83lYuiGEQNW7SrJeoYoqywQxefEnkLO9ZVJxlUr0dMMrhfROEuaFWS8KBubiA-ANt4urcF4YYaqqxqALoSwDKdQDlM65q8aqAgFOCK3Mn_We15W8y4qbJ0S0_uXqjkRcQvDpA4_LqsXMsOFu8BHdx1M3zqZF7DncxuOsKNQePa7KeiaM8CXtl7pldACuytMcEiwcBHbQ7eDWVx2y7tylLE-QjLUZY-6geqIL9WlGaKDBM9MK4eCkmoqQ_dUNobNc-KYkdWKf2PAQ5gBLBBMDMQPgX9BWQ2LuHOuAX0DrHWb8DZls4Dcl_zhrMHTQ849aZGGdQu8mMBCkVaAUpDzxn-j39HbzSR_iHh6N-yOwJ-9LWoKNa9kbYY9KOolqra-wh322m8U1kMCUsj-jxQ2FdiMPW-Jh2is7Q_E6vEXFYjoeay_UHD9RpMTTd9NAAGcjY0CEOX8PWxINfweO47Wi6-w-Gged6FmtRVpisXRsoaW5m_uVIKA7d2y4HRZsa4HfmjWS2FiA8WOzmNs_D-ptyyLwctnWIjE03a-qGVVzujlIJA3G_mLI6lzIcxApWptfqlL7WaYGGomUdJ4l8gbKg3cNnFLPFbaNsuHjswGcJKO32mcJfF6ILWAl4v9edB_xneUGP4sSKYOFGqFIKkb4z_FRKBYhXAcqcN98YZy8SeyLOpbrIKoSF3lkORmcw9m2uNcdPYTTerQRiiTPgpNsw_gwHdJXwbXlM2avk2_d4lj72bvrFvR7vp9A8P_gMmSxKnAW4RySzICAQl3Z4xyYfN0DS-lSyK4QzKAB_vGQTxDYnneF_zTOMyBHhtjYzxRX6D41dRv0N-DdvC33u7pn-jw36MzAl-nzR7Zaz2t9FtvAzI-xp_Rx0PamnyFZD1r9ipB1oCPDlqwAcWJ2J9PbHXedlgxHKRPrWDaYRYv99C_O3sHrmm4khSECrFpU1PrC7b4JfSlZ5uMNsVGMzxlHmEd96iHh7aeFnyHcgOS5_M8USZ9UBk5LaE0e-WtqxIQ2_JHdlmuQCZA5TyUhLXNBcpQgSymO_8TrOjsUuwtlj4tV2jYttoTTrvZj5hOL04Th2rovKxvD0OZ0EptYpV0ZAuKykl8RN1TrxQ3J9nLMtvXd6AzXRDosajZQt7l5TZm88qsyMMUL4i6paHf1hsA6ag&sai=AMfl-YQygGAmoPvEb00mneQbaati9gGvAEqNMx3pufeYUxzxeNhnKAh7RT_z1ONimtY0imIQxPK5_fthgMpo-wnTmu8m67u3BCt702bEw-FwgXCHuJr5f2qFzckD8IOTRaHZ8qRVRSuo-xwr2oUWVXyZNpUsYsufXQuRkwN_YS3X7ZkuFPxa9IxmS2ARR3ZOl41_3IZrluf4MKHXG_2m8ggyrvr7zu9DogSluQ1V50hX4p2OYybvQI-XxcWbYJJ08HKjFnheinsK8wM&sig=Cg0ArKJSzP7zjfbCKASQEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1400&vt=11&dtpt=1399&dett=2&cstd=0&cisv=r20221109.46874&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:34 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 11 Nov 2022 04:46:34 GMT

GET
H3 200 api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js Show response
pagead2.googlesyndication.com/bg/ Frame EBD6 36 KB
16 KB 276ms
276ms Script
text/javascript 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a98bdefd73410963a41036b4bc4d25b080aaec85db7ebd132a12d3aa17e8586

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 10 Nov 2022 00:36:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 101378
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 10 Nov 2023 00:36:56 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 0051 0
859 B 522ms
334ms Script
text/html 68.67.179.87
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.87 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:34 GMT
AN-X-Request-Uuid: de52c9fd-8fca-479d-b42b-ffa54b6e4e43
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 116.90.74.196; 116.90.74.196; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 13926 Show response
g2.gumgum.com/usync/ Frame 10A7 4 KB
2 KB 732ms
241ms Document
text/html 18.177.55.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.177.55.15 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-177-55-15.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 3d19b9898e0d98573aeae5166fe71b83391592fea2a13d1d6919214c2e1b5fed

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Fri, 11 Nov 2022 04:46:35 GMT
etag: W/"0b9a5d58d3a9c9bc25272923425fa6c3f"
server: nginx
timing-allow-origin: *

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 6B46 4 KB
2 KB 392ms
392ms Document
text/html 51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

8f565a61b9ee62a20e9d8cc85a16786b81fcf3cebb32b5f69817e7a99b38ef6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 1395
content-type: text/html
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK sync Show response
ssbsync.smartadserver.com/api/ Frame 1E35 1017 B
1 KB 929ms
235ms Document
text/html 23.106.127.39
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.106.127.39 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG),
Reverse DNS
Software: /
Resource Hash: 6524c27cfbd7d5663d2e5920f1d2e9df70213631b3d3411333d8c8c57a88b89e

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

content-length: 1017
content-type: text/html
date: Fri, 11 Nov 2022 04:46:34 GMT

GET
H3 200 usermatch Show response
ssum-sec.casalemedia.com/ Frame 6565 2 KB
1 KB 366ms
365ms Document
text/html 104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.18.126 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 342a89ebe9bb570ac3c68590109139599fe7540af1ba6f14325052e51f3598f9

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 7684628a5b0feeaa-AKL
content-encoding: br
content-type: text/html
date: Fri, 11 Nov 2022 04:46:34 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3ttQgm%2FUrWfOTNCgrwVyadQnX5EjCNdtjuwsdbQdmXNR9EKyl0%2FoK48FABGkKTUGOSTXtzzQd2jlBAF%2BlgAEFc7o7Na5ztqTmNGRAX9C3TI%2F84e3Y9u0ymos%2FwqLaBQ14%2BAUDAkgKFzfuQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 2991
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=duration_media&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east

281 B
554 B

269ms
269ms

Document
text/html

23.75.85.227
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.75.85.227 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-75-85-227.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 11 Nov 2022 04:46:35 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Fri, 11 Nov 2022 04:46:34 GMT
location: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
server: AkamaiGHost

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame D2D4 15 KB
6 KB 509ms
271ms Document
text/html 23.78.217.19
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.78.217.19 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-78-217-19.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=32259
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Fri, 11 Nov 2022 04:46:34 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Fri, 11 Nov 2022 13:44:13 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2

200

sync
ads.servenobid.com/ Frame 1B92
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=312&uid=3680859315881377104

0
344 B

405ms
405ms

Image
image/avif

34.252.126.43
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=312&uid=3680859315881377104
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 34.252.126.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-252-126-43.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:35 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Date: Fri, 11 Nov 2022 04:46:34 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 116.90.74.196; 116.90.74.196; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 49f62981-4704-480c-8812-40eb98186773
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://ads.servenobid.com/sync?pid=312&uid=3680859315881377104
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 1B92
Redirect Chain

https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D
https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D&dnr=1
https://ads.servenobid.com/sync?pid=310&uid=Foa-CRZHlI5BI_DlSHa9_WmA

0
350 B

404ms
404ms

Image
image/avif

34.252.126.43
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=310&uid=Foa-CRZHlI5BI_DlSHa9_WmA
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 34.252.126.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-252-126-43.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:35 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:35 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Location: https://ads.servenobid.com/sync?pid=310&uid=Foa-CRZHlI5BI_DlSHa9_WmA
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2sfo1
Content-Length: 0
Expires: Fri, 20 Mar 2009 00:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 1B92
Redirect Chain

https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID
https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID&sovrn_retry=true
https://ads.servenobid.com/sync?pid=310&uid=Foa-ELZHDv_xx9LIQTiWyp6G

0
351 B

405ms
404ms

Image
image/avif

34.252.126.43
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=310&uid=Foa-ELZHDv_xx9LIQTiWyp6G
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 34.252.126.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-252-126-43.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:35 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Date: Fri, 11 Nov 2022 04:46:35 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://ads.servenobid.com/sync?pid=310&uid=Foa-ELZHDv_xx9LIQTiWyp6G
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: close
X-Sovrn-Pod: ad_ap4sfo1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

GET
H2

200

cksync.php
contextual.media.net/ Frame 1B92
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync2/rmpssp?sub=duration&zcc=1&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D&cb=1668141995138
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=4390314617
https://sync.1rx.io/usersync/tradedesk/1bc1ccf6-de8d-48ed-908c-c2e129bce8ed
https://sync.targeting.unrulymedia.com/csync/RX-696a581e-8d06-4a82-8bcb-7fe19581bee0-004?redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dr1%2...
https://contextual.media.net/cksync.php?cs=8&vsid=3111435947443605000V10&type=r1&refUrl=&vid=81419942253111435947443605000V10&ovsid=RX-696a581e-8d06-4a82-8bcb-7fe19581bee0-004

45 B
470 B

319ms
316ms

Image
image/gif

104.71.48.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3111435947443605000V10&type=r1&refUrl=&vid=81419942253111435947443605000V10&ovsid=RX-696a581e-8d06-4a82-8bcb-7fe19581bee0-004

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Server

104.71.48.26 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Fri, 11 Nov 2022 04:46:37 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Fri, 11 Nov 2022 04:46:37 GMT

Redirect headers

location: https://contextual.media.net/cksync.php?cs=8&vsid=3111435947443605000V10&type=r1&refUrl=&vid=81419942253111435947443605000V10&ovsid=RX-696a581e-8d06-4a82-8bcb-7fe19581bee0-004
date: Fri, 11 Nov 2022 04:46:37 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RX696a581e8d064a828bcb7fe19581bee0004
content-type: text/html

GET
H2

200

sync
ads.servenobid.com/ Frame 1B92
Redirect Chain

https://p.rfihub.com/cm?pub=44007&in=1
https://ads.servenobid.com/sync?pid=324&uid=1917759394702448456

0
345 B

405ms
404ms

Image
image/avif

34.252.126.43
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=324&uid=1917759394702448456
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 34.252.126.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-252-126-43.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:35 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Location: https://ads.servenobid.com/sync?pid=324&uid=1917759394702448456
Date: Fri, 11 Nov 2022 04:46:35 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET usa
sync.go.sonobi.com/ Frame 1B92 0
0

GET
H/1.1

204
No Content

pixel
ap.lijit.com/ Frame 1B92
Redirect Chain

https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1YN-&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D
https://cm.adform.net/cookie?gdpr=1&gdpr_consent=&redirect_url=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F0%2F38292%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1YN-%26A%3D1e12c7d5-7991-4156-b3d6-5238...
https://prebid.a-mo.net/cchain/0/38292?gdpr=0&gdpr_consent=&us_privacy=1YN-&A=1e12c7d5-7991-4156-b3d6-5238e0fee4e7&bidder=adform&cbx=aHR0cHM6Ly9hZHMuc2VydmVub2JpZC5jb20vc3luYz9waWQ9MzI3JnVpZD0%3D&u...
https://ap.lijit.com/pixel?gdpr=1&gdpr_consent=&us_privacy=1YN-&redir=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F2%2F38292%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1YN-%26A%3D1e12c7d5-7991-4156-b3...

0
277 B

878ms
295ms

Image
text/plain

209.191.163.210
INTERNAP-BLOCK-4

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/pixel?gdpr=1&gdpr_consent=&us_privacy=1YN-&redir=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F2%2F38292%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1YN-%26A%3D1e12c7d5-7991-4156-b3d6-5238e0fee4e7%26bidder%3Dsovrn%26cbx%3DaHR0cHM6Ly9hZHMuc2VydmVub2JpZC5jb20vc3luYz9waWQ9MzI3JnVpZD0%253D%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Server: 209.191.163.210 , United States, ASN14744 (INTERNAP-BLOCK-4, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 11 Nov 2022 04:46:37 GMT
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap4sfo1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Access-Control-Allow-Methods: GET, POST, DELETE, PUT

Redirect headers

location: https://ap.lijit.com/pixel?gdpr=1&gdpr_consent=&us_privacy=1YN-&redir=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F2%2F38292%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1YN-%26A%3D1e12c7d5-7991-4156-b3d6-5238e0fee4e7%26bidder%3Dsovrn%26cbx%3DaHR0cHM6Ly9hZHMuc2VydmVub2JpZC5jb20vc3luYz9waWQ9MzI3JnVpZD0%253D%26uid%3D%24UID
date: Fri, 11 Nov 2022 04:46:36 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
content-length: 0

GET
H2

200

sync
ads.servenobid.com/ Frame 1B92
Redirect Chain

https://ups.analytics.yahoo.com/ups/58559/occ
https://ups.analytics.yahoo.com/ups/58559/occ?verify=true
https://ads.servenobid.com/sync?pid=337&uid=y-3v4yEN1E2uFdVGfZUGex9NwYmFeujYgpuJWli0s-~A

0
367 B

405ms
405ms

Image
image/avif

34.252.126.43
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=337&uid=y-3v4yEN1E2uFdVGfZUGex9NwYmFeujYgpuJWli0s-~A
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 34.252.126.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-252-126-43.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:35 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=337&uid=y-3v4yEN1E2uFdVGfZUGex9NwYmFeujYgpuJWli0s-~A
date: Fri, 11 Nov 2022 04:46:35 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

getuid
eb2.3lift.com/ Frame 1B92
Redirect Chain

https://ssp.disqus.com/redirectuser?r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D346%26uid%3DBUYERUID
https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D6%26r%3DCid1YS0zYjQxNGEyZS0yYTE1LTM2YzEtYjk5ZC0wODhkNDljMjIyMWUqU2h0dHBzOi8vYWRz...
https://ssp.disqus.com/redirectuser?partner=adaptmx&gdpr=1&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F0%2F29789%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D%26A%3D1e12c7d5...
https://prebid.a-mo.net/cchain/0/29789?gdpr=0&gdpr_consent=&us_privacy=&A=1e12c7d5-7991-4156-b3d6-5238e0fee4e7&bidder=zeta&cbx=aHR0cHM6Ly9zc3AuZGlzcXVzLmNvbS9tYXRjaD9iaWRkZXI9NiZyPUNpZDFZUzB6WWpReE...
https://ssum.casalemedia.com/usermatchredir?s=191503&gdpr=1&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F2%2F29789%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D%26A%3D1e12c7...
https://prebid.a-mo.net/cchain/2/29789?gdpr=0&gdpr_consent=&us_privacy=&A=1e12c7d5-7991-4156-b3d6-5238e0fee4e7&bidder=index_rtb&cbx=aHR0cHM6Ly9zc3AuZGlzcXVzLmNvbS9tYXRjaD9iaWRkZXI9NiZyPUNpZDFZUzB6W...
https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F4%2F29789%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D%26A%3D1e12c7d5-7991-4156-b3d6-5238e0fee4e7%26bidder%3Dappnexus%26cbx%3DaH...
https://prebid.a-mo.net/cchain/4/29789?gdpr=0&gdpr_consent=&us_privacy=&A=1e12c7d5-7991-4156-b3d6-5238e0fee4e7&bidder=appnexus&cbx=aHR0cHM6Ly9zc3AuZGlzcXVzLmNvbS9tYXRjaD9iaWRkZXI9NiZyPUNpZDFZUzB6WW...
https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F5%2F29789%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D%26A%3D1e12c7d5-7991-4156-b3d6-5238e0fee4e7%26bidder%3Dtriplelift%2...

37 B
139 B

235ms
235ms

Image
image/gif

35.71.178.8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F5%2F29789%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D%26A%3D1e12c7d5-7991-4156-b3d6-5238e0fee4e7%26bidder%3Dtriplelift%26cbx%3DaHR0cHM6Ly9zc3AuZGlzcXVzLmNvbS9tYXRjaD9iaWRkZXI9NiZyPUNpZDFZUzB6WWpReE5HRXlaUzB5WVRFMUxUTTJZekV0WWprNVpDMHdPRGhrTkRsak1qSXlNV1VxVTJoMGRIQnpPaTh2WVdSekxuTmxjblpsYm05aWFXUXVZMjl0TDNONWJtTV9jR2xrUFRNME5pWjFhV1E5ZFdFdE0ySTBNVFJoTW1VdE1tRXhOUzB6Tm1NeExXSTVPV1F0TURnNFpEUTVZekl5TWpGbE1nRUdPQUU9JmJ1eWVydWlkPQ%253D%253D%26uid%3D%24UID&gdpr=1&gdpr_consent=
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 35.71.178.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:39 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

Redirect headers

location: https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F5%2F29789%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D%26A%3D1e12c7d5-7991-4156-b3d6-5238e0fee4e7%26bidder%3Dtriplelift%26cbx%3DaHR0cHM6Ly9zc3AuZGlzcXVzLmNvbS9tYXRjaD9iaWRkZXI9NiZyPUNpZDFZUzB6WWpReE5HRXlaUzB5WVRFMUxUTTJZekV0WWprNVpDMHdPRGhrTkRsak1qSXlNV1VxVTJoMGRIQnpPaTh2WVdSekxuTmxjblpsYm05aWFXUXVZMjl0TDNONWJtTV9jR2xrUFRNME5pWjFhV1E5ZFdFdE0ySTBNVFJoTW1VdE1tRXhOUzB6Tm1NeExXSTVPV1F0TURnNFpEUTVZekl5TWpGbE1nRUdPQUU9JmJ1eWVydWlkPQ%253D%253D%26uid%3D%24UID&gdpr=1&gdpr_consent=
date: Fri, 11 Nov 2022 04:46:38 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
content-length: 0

GET
H2

200

sync
ads.servenobid.com/ Frame 1B92
Redirect Chain

https://ups.analytics.yahoo.com/ups/58632/occ
https://ads.servenobid.com/sync?pid=339&uid=y-3v4yEN1E2uFdVGfZUGex9NwYmFeujYgpuJWli0s-~A

0
367 B

406ms
406ms

Image
image/avif

34.252.126.43
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=339&uid=y-3v4yEN1E2uFdVGfZUGex9NwYmFeujYgpuJWli0s-~A
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 34.252.126.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-252-126-43.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:36 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=339&uid=y-3v4yEN1E2uFdVGfZUGex9NwYmFeujYgpuJWli0s-~A
date: Fri, 11 Nov 2022 04:46:36 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200
OK

ecm3
aax-eu.amazon-adsystem.com/s/ Frame ADA3
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=UDRj4xDbT265XUy3CJBK_w&rk=usync-other
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=UDRj4xDbT265XUy3CJBK_w

43 B
479 B

409ms
409ms

Image
image/gif

67.220.226.234
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=UDRj4xDbT265XUy3CJBK_w

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html

Protocol

HTTP/1.1

Server

67.220.226.234 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:37 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: DBMMKTRGWMW9ZS294CXJ
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=UDRj4xDbT265XUy3CJBK_w
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 808ed95536e7f55d8adbcb9fc76d309d
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame ADA3
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/OfxJD9ZLyOB4L4OkAZFxs8n5EUdSAgOZEtemQ7w0kco?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=3972876650625920407

42 B
679 B

237ms
237ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=3972876650625920407
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 6690dc791bf02dde8c4051a04cfd7bb8
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Fri, 11 Nov 2022 04:46:35 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=3972876650625920407
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame ADA3
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEGyPmPM3t0TVrT4eCLvKVkE&google_cver=1

42 B
679 B

708ms
236ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEGyPmPM3t0TVrT4eCLvKVkE&google_cver=1
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 030b4ddd4a4f3e9891a065664f20c4bb
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEGyPmPM3t0TVrT4eCLvKVkE&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame ADA3
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed&gdpr=0&gdpr_consent=&expires=30

42 B
679 B

739ms
237ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 0ed95c36ed1932be3ba76fc523a6e179
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed&gdpr=0&gdpr_consent=&expires=30
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 289

GET
H2

200

setuid
px.ads.linkedin.com/ Frame ADA3
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LAC0O423-1K-IQAL

0
144 B

335ms
334ms

Image
text/plain

13.107.43.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LAC0O423-1K-IQAL
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Server: 13.107.43.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:35 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 68C0EB6E69BF4F599274AFD090CA7B66 Ref B: MEL01EDGE1322 Ref C: 2022-11-11T04:46:35Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXtKpMWQOYGDUhnP2XVug==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LAC0O423-1K-IQAL
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 548ddf114c6f6bfbb66a4cdeb6a219f4
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame ADA3
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEFDME80MjMtMUstSVFBTA==

170 B
188 B

334ms
334ms

Image
image/png

142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEFDME80MjMtMUstSVFBTA==

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html

Protocol

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEFDME80MjMtMUstSVFBTA==
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 4b9b5fe4fdc8ed94e0f7cdc225df187a
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame ADA3
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NTllYWQwYzVkYmM3YmY1OTdlODdlMTYwMTllYTM0YzE4MjE4YzVlYQ

170 B
188 B

289ms
289ms

Image
image/png

142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NTllYWQwYzVkYmM3YmY1OTdlODdlMTYwMTllYTM0YzE4MjE4YzVlYQ

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html

Protocol

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NTllYWQwYzVkYmM3YmY1OTdlODdlMTYwMTllYTM0YzE4MjE4YzVlYQ
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 4b9b5fe4fdc8ed94e0f7cdc225df187a
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame ADA3
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=kI6XwnZkRZ-LzHucKxvvKQ&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=kI6XwnZkRZ-LzHucKxvvKQ

43 B
479 B

344ms
344ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=kI6XwnZkRZ-LzHucKxvvKQ

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:36 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: QM02XERW2PTQCQC3K858
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=kI6XwnZkRZ-LzHucKxvvKQ
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 4b9b5fe4fdc8ed94e0f7cdc225df187a
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame EBD6 0
20 B 280ms
279ms Image
image/gif 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BdiHSqNNtY6HPHK2r3LUP2Iud0AEAAAAAOAHgBAI&bg=!pKelp-PNAAbvMpMzzzI7ACkAdvg8WrpxBzWbCmtnT1vziXD5SOC7EaU-5U-riYbCOeD3QLOKWdMgcQIAAABWUgAAAAJoAQcKAAL9xpkDCPh9YQCkQcKQnE5KHaXnSLjD7Vc3BS4UEPT2TwRArhlYKUIaa_vdaqLNcljfxl56U1ZIRLqfdM7ShEHUoHk7zSo0VATMm99A6i02JXjPVq5577BLI4LtQ2WZboY-vUgG7waz9iAlXiL0g8Agn4UlalaqTrt9nI0Bj0qrVua1IS2iFOfQ9SNdMXeBP6K3ePpl4Bh5C60LtrxmpiwqooBlp2VA5nk-EnJEcEj8ROuzzjLIu4Ikolh3AroluGpk6i4Iz66a8MImoaFUb_yp0K1RiQE6TSuDiT5WRzHrX_yS7ktqCIGtUC4086LN-exgE-Zp9q0kDOB9yvJkd40QpJU07aZM4ylVL8BckLDTPsqftQbGsb7BxtfscAYt3wAU19uoaNGm1UznEggOyd83XbuNApC9sl7khgXMsEY51IZDv8vJ-86npVIQGrrvsmyBVUU-PZHVAGCkZy3_sCe2ygBD2_vf64-MS2rsUNw9UAWQkrEx1Z4rtohac3Qwvp8ygN8AkY9ftjAxuWQlDgLqSMx9ZVMmLp3tYnGKDyzfjAbMoY6-Vk5PaEWNzJ_PLHHlvC66YfRHO-RAu9NaEXgVSuv8sm139IxTY8_Ry-4t618BYbPnahpnjrbrIQqYgUpcwj9MOCHmAKmyf4cHXeUIohsacy27x4Kdy6vbeBZZNEwo98sBPPK1wfNDuWnDjfDyejNrQEnxrevmM80VvR3zywK_ZuiDlkBgVvxAj5mwD5S2oWCeACZXVHi-S7InJqNA9-_NTcsaoV4uIEt2EGxcj-Z5454vqOyYdbMstCGegJ-euHeMH1hq76GcwDMMIkCVpLbZoKXJ8VqGfEh8AHd0WiTwp28ue_gWSg_24Xdx8icz-WEnF4-RKJJ-Gj8cqfRVzsaStAi5pBCqN8n91hQwjysaXZ93WMAKMRRJWrw8jy_D9uB4ao3Qvo5QXxbOhyrbdTgg3V6bkTAYhi7OW-m-CtFebUvPhj2IAuniQzxllWEa2EsVdV8yW9gGXLeS_KCz2jIIxncP2sFrk5fg

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-18-141-128-115.ap-southeast-1.compute.amazonaws.com

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:34 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 6565
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed&expiration=1670733994&gdpr=0&gdpr_consent=

43 B
894 B

353ms
352ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed&expiration=1670733994&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:35 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:35 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed&expiration=1670733994&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 323

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame 6565
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y23TqieVRMZN1-kbgV6H8wAAE50AAAIB
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y23TqieVRMZN1-kbgV6H8wAAE50AAAIB&dcc=t

43 B
855 B

387ms
366ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y23TqieVRMZN1-kbgV6H8wAAE50AAAIB&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:36 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: EV8N3S2B5P65FDXZ61QY
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:35 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: X4FF5TCTPEM3NTFDK1C2
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y23TqieVRMZN1-kbgV6H8wAAE50AAAIB&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame 6565
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=Y23TqieVRMZN1-kbgV6H8wAAE50AAAIB&gdpr_consent=&us_privacy=&gdpr=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEKUs2tjoQvMkWUDE5G9CWNo&google_cver=1

43 B
842 B

385ms
385ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEKUs2tjoQvMkWUDE5G9CWNo&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: H3
Server: 104.18.18.126 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:35 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=INdKygQlG8XwtqaZ%2FSh9RcdZ599adiWK80NmfXZPACe2SoG2qtxqgVJr0oQvyKjtDnza2r09wQxsn%2BvC9qFI%2FDjXMzdaeusYkdgkPNThmcMHhTxIQEck9fexHkdM2ztGVdWPi8bC18Hczg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 7684628e886aeeaa-AKL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:35 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEKUs2tjoQvMkWUDE5G9CWNo&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 342
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 6565
Redirect Chain

https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=3680859315881377104

43 B
766 B

530ms
359ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=3680859315881377104
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:35 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Date: Fri, 11 Nov 2022 04:46:35 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 116.90.74.196; 116.90.74.196; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 9a8f7754-b4b7-4d68-be51-4a952a725300
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=3680859315881377104
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 6565
Redirect Chain

https://cms.quantserve.com/pixel/p-Z8PuJEk6U7Hyq.gif?idmatch=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=LfxLan_8HGw2_k87LvhQPX-rTTk2-0w3KarWL5Jx

43 B
766 B

427ms
337ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=LfxLan_8HGw2_k87LvhQPX-rTTk2-0w3KarWL5Jx
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:35 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:35 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=LfxLan_8HGw2_k87LvhQPX-rTTk2-0w3KarWL5Jx
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 6565
Redirect Chain

https://um.simpli.fi/pm_match?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=$UID
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=DEA4A601E7C34F7B8A65CB6EF47D4DCC

43 B
894 B

570ms
352ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=DEA4A601E7C34F7B8A65CB6EF47D4DCC
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:35 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=496
Content-Length: 43
Expires: 0

Redirect headers

date: Fri, 11 Nov 2022 04:46:35 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=DEA4A601E7C34F7B8A65CB6EF47D4DCC
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Thu, 10 Nov 2022 04:46:35 GMT

GET
H2 200 Y23TqieVRMZN1-kbgV6H8wAAE50AAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 6565 43 B
601 B 247ms
242ms Image
image/gif 18.141.128.115
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/Y23TqieVRMZN1-kbgV6H8wAAE50AAAIB?gdpr_consent=&us_privacy=&gdpr=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.141.128.115 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:35 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 6565
Redirect Chain

https://sync.adotmob.com/cookie/indexexchange?r=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D13%26external_user_id%3D%7bamob_user_id%7d%26expiration%3D%5bEXPIRATION%5d
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=13&external_user_id=085c22041940e0c90188291f&expiration=[EXPIRATION]

43 B
766 B

338ms
337ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=13&external_user_id=085c22041940e0c90188291f&expiration=[EXPIRATION]
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:36 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=13&external_user_id=085c22041940e0c90188291f&expiration=[EXPIRATION]
date: Fri, 11 Nov 2022 04:46:35 GMT
access-control-allow-credentials: true
x-powered-by: Express
keep-alive: timeout=5
vary: Origin
content-length: 0

GET
H2 200 sync
ads.servenobid.com/ Frame 6565 0
356 B 406ms
405ms Image
image/avif 34.252.126.43
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=333&uid=Y23TqieVRMZN1-kbgV6H8wAAE50AAAIB
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.252.126.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-252-126-43.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:35 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame 6ED8
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y23TqrR-H1tu5_PMWLBNCQAAFNMAAAIB
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y23TqrR-H1tu5_PMWLBNCQAAFNMAAAIB&dcc=t

43 B
855 B

358ms
358ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y23TqrR-H1tu5_PMWLBNCQAAFNMAAAIB&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:36 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 9T9VYK5Q8MJBNQ46SZNW
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:35 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: B31G49M123SJ393QQYQT
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y23TqrR-H1tu5_PMWLBNCQAAFNMAAAIB&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 6ED8
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=Y23TqrR.H1tu5-PMWLBNCQAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEK9lmIsa5vzahScJJ-rseUU&google_cver=1&google_hm=2

43 B
894 B

647ms
352ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEK9lmIsa5vzahScJJ-rseUU&google_cver=1&google_hm=2
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:36 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=495
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:35 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEK9lmIsa5vzahScJJ-rseUU&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 330
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 6ED8
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed&expiration=1670733995&gdpr=0&gdpr_consent=

43 B
766 B

352ms
352ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed&expiration=1670733995&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:35 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:35 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed&expiration=1670733995&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 323

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame 6ED8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=Y23TqrR-H1tu5_PMWLBNCQAAFNMAAAIB&gdpr_consent=&us_privacy=&gdpr=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEKUs2tjoQvMkWUDE5G9CWNo&google_cver=1

43 B
847 B

266ms
266ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEKUs2tjoQvMkWUDE5G9CWNo&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H3
Server: 104.18.18.126 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:35 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SZGGwpBC45Pk0xjtk5SgiqnGwZd%2Bc%2FmoTuhi5sScJC9gO1D1KWAdlrrjKOoMVgTMhptqUbkSab13Ws%2FyHebBO4kqHPaI8iHKbzcICmJqWMUGN4N278dtSuJ3NXX7dM%2BP%2FVBdOBybYVj%2BJg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 7684628e9876eeaa-AKL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:35 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEKUs2tjoQvMkWUDE5G9CWNo&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 342
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 6ED8
Redirect Chain

https://sync.adotmob.com/cookie/indexexchange?r=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D13%26external_user_id%3D%7bamob_user_id%7d%26expiration%3D%5bEXPIRATION%5d
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=13&external_user_id=085c2204199019661f60bf43&expiration=[EXPIRATION]

43 B
766 B

338ms
337ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=13&external_user_id=085c2204199019661f60bf43&expiration=[EXPIRATION]
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:36 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=495
Content-Length: 43
Expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=13&external_user_id=085c2204199019661f60bf43&expiration=[EXPIRATION]
date: Fri, 11 Nov 2022 04:46:35 GMT
access-control-allow-credentials: true
x-powered-by: Express
keep-alive: timeout=5
vary: Origin
content-length: 0

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 6ED8
Redirect Chain

https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=3680859315881377104

43 B
766 B

662ms
337ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=3680859315881377104
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:35 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=496
Content-Length: 43
Expires: 0

Redirect headers

Date: Fri, 11 Nov 2022 04:46:35 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 116.90.74.196; 116.90.74.196; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 7ccab54a-d44a-4cf2-a789-eae5f166eef7
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=3680859315881377104
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 6ED8
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&_test=Y23TqwAHIjEvwwAr
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y23TqwAHIjEvwwAr&_test=Y23TqwAHIjEvwwAr

43 B
766 B

417ms
351ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y23TqwAHIjEvwwAr&_test=Y23TqwAHIjEvwwAr
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:36 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

x-served-by: cache-mel11220-MEL
pragma: no-cache
date: Fri, 11 Nov 2022 04:46:35 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1668141996.718553,VS0,VE0
x-cache: HIT
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y23TqwAHIjEvwwAr&_test=Y23TqwAHIjEvwwAr
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200
OK

demconf.jpg
dpm.demdex.net/ Frame 6ED8
Redirect Chain

https://dpm.demdex.net/ibs:dpid=23728&dpuuid=Y23TqrR.H1tu5-PMWLBNCQAA%265331?gdpr_consent=&us_privacy=&gdpr=
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=23728&dpuuid=Y23TqrR.H1tu5-PMWLBNCQAA%265331

42 B
948 B

238ms
238ms

Image
image/gif

52.220.119.96
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=23728&dpuuid=Y23TqrR.H1tu5-PMWLBNCQAA%265331

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1

Protocol

HTTP/1.1

Server

52.220.119.96 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-220-119-96.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

DCS: dcscanary-prod-apse-1-v053-0ff9cf2f3.edge-apse.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: GE+iP/wOSGc=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-apse-2-v042-08b2b77fc.edge-apse.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: 5nBvPvnjRMQ=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=23728&dpuuid=Y23TqrR.H1tu5-PMWLBNCQAA%265331
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 htw-pixel.gif
cdn.indexww.com/ht/ Frame 6ED8 43 B
353 B 454ms
151ms Image
image/gif 104.18.12.76
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.indexww.com/ht/htw-pixel.gif?Y23TqrR.H1tu5-PMWLBNCQAA%265331
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.12.76 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:35 GMT
cf-cache-status: HIT
last-modified: Tue, 24 Jan 2017 19:36:04 GMT
server: cloudflare
age: 22593
etag: "902a3d-2b-546dc3a097100"
vary: Accept-Encoding
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
edge-control: cache-maxage=1h
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 76846291eaf2a965-SYD
content-length: 43
expires: Sat, 12 Nov 2022 04:46:35 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6B46
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&ot_initiated=1
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABhGUC1JL3jFbrhTzrNRqHT-If3k0SThsu1g

170 B
188 B

281ms
280ms

Image
image/png

142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABhGUC1JL3jFbrhTzrNRqHT-If3k0SThsu1g

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABhGUC1JL3jFbrhTzrNRqHT-If3k0SThsu1g
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H3 200 711916.gif
id.rlcdn.com/ Frame 6B46 42 B
60 B 324ms
318ms Image
image/gif 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/711916.gif?ct=4&cv=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:35 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H2

200

/
onetag-sys.com/match/ Frame 6B46
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm
https://onetag-sys.com/match/?int_id=106&google_gid=CAESEFFVzTGcB5fyoGt5BW7J9pg&google_cver=1

0
340 B

391ms
391ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=106&google_gid=CAESEFFVzTGcB5fyoGt5BW7J9pg&google_cver=1

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:35 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=106&google_gid=CAESEFFVzTGcB5fyoGt5BW7J9pg&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 298
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
onetag-sys.com/match/ Frame 6B46
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=75&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D1%26uid%3D%5BMM_UUID%5D%26gdpr%3D0%26gdpr_consent%3D
https://onetag-sys.com/match/?int_id=1&uid=847b636d-d3aa-4400-9736-6e984d688036&gdpr=0&gdpr_consent=

0
340 B

391ms
391ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=1&uid=847b636d-d3aa-4400-9736-6e984d688036&gdpr=0&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Date: Fri, 11 Nov 2022 04:46:35 GMT
Server: MT3 4629 97bee97 master nrt-pixel-x19 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://onetag-sys.com/match/?int_id=1&uid=847b636d-d3aa-4400-9736-6e984d688036&gdpr=0&gdpr_consent=
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Fri, 11 Nov 2022 04:46:34 GMT

GET
H2

200

/
onetag-sys.com/match/ Frame 6B46
Redirect Chain

https://pixel-eu.rubiconproject.com/exchange/sync.php?p=onetag&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=2&uid=LAC0O423-1K-IQAL&gdpr=0

0
340 B

415ms
391ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=2&uid=LAC0O423-1K-IQAL&gdpr=0

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://onetag-sys.com/match/?int_id=2&uid=LAC0O423-1K-IQAL&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 8f052d4f888ae4e0626c5f819879cacd
Expires: 0

GET
H2

200

/
onetag-sys.com/match/ Frame 6B46
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D98%26gdpr%3D0%26gdpr_consent%3D%26uid%3D$UID
https://onetag-sys.com/match/?int_id=98&gdpr=0&gdpr_consent=&uid=3680859315881377104

0
340 B

406ms
406ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=98&gdpr=0&gdpr_consent=&uid=3680859315881377104

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Date: Fri, 11 Nov 2022 04:46:35 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 116.90.74.196; 116.90.74.196; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 73e85c03-8bef-47d5-8af6-8731f09adacf
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://onetag-sys.com/match/?int_id=98&gdpr=0&gdpr_consent=&uid=3680859315881377104
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK tap.php
pixel.rubiconproject.com/ Frame 6B46 42 B
679 B 697ms
235ms Image
image/gif 69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=223352&nid=4584&put=g9g4wLGp0efm6qjv_6bMeI9v-Gb5yRo_ANOgl2APmok
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 548ddf114c6f6bfbb66a4cdeb6a219f4
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

/
onetag-sys.com/match/ Frame 6B46
Redirect Chain

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=0&gdpr_consent=&us_privacy=1YN-&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid]
https://onetag-sys.com/match/?int_id=107&uid=4629085678653095460

0
340 B

392ms
392ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=107&uid=4629085678653095460

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=107&uid=4629085678653095460
date: Fri, 11 Nov 2022 04:46:34 GMT
content-length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 6B46
Redirect Chain

https://onetag-sys.com/match/?int_id=113&gdpr=0&gdpr_consent=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1
https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=g9g4wLGp0efm6qjv_6bMeI9v-Gb5yRo_ANOgl2APmok

43 B
720 B

549ms
350ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=g9g4wLGp0efm6qjv_6bMeI9v-Gb5yRo_ANOgl2APmok

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:36 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: J3H2P2Z3J7YGD62F1JJE
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location: https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=g9g4wLGp0efm6qjv_6bMeI9v-Gb5yRo_ANOgl2APmok
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2

200

/
onetag-sys.com/match/ Frame 6B46
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=0&gdpr_consent=&us_privacy=1YN-&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26uid%3D%23PMUID
https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=0&gdpr_consent=&us_privacy=1YN-&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26uid%3D%23PMUID&rdf=1
https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

0
340 B

393ms
392ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10
date: Fri, 11 Nov 2022 04:46:35 GMT
cache-control: private,max-age=86400
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 108
content-type: text/html; charset=utf-8

GET
H2

200

/
onetag-sys.com/match/ Frame 6B46
Redirect Chain

https://ups.analytics.yahoo.com/ups/58488/occ?&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=92&uid=y-3v4yEN1E2uFdVGfZUGex9NwYmFeujYgpuJWli0s-~A

0
340 B

392ms
391ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=92&uid=y-3v4yEN1E2uFdVGfZUGex9NwYmFeujYgpuJWli0s-~A

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=92&uid=y-3v4yEN1E2uFdVGfZUGex9NwYmFeujYgpuJWli0s-~A
date: Fri, 11 Nov 2022 04:46:35 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

/
onetag-sys.com/match/ Frame 6B46
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=vw6iyrn&ttd_tpi=1&gpdr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=29&uid=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed&gdpr=0&gdpr_consent=

0
340 B

392ms
392ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=29&uid=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed&gdpr=0&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:35 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://onetag-sys.com/match/?int_id=29&uid=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 233

GET
H2

200

/
onetag-sys.com/match/ Frame 6B46
Redirect Chain

https://x.bidswitch.net/sync?ssp=onetag&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match/?party=24&bidswitch_ssp_id=onetag
https://x.bidswitch.net/sync?dsp_id=70&user_id=2057151992493556101&ssp=onetag
https://onetag-sys.com/match/?int_id=30&uid=397a0df4-c51f-47bf-845f-0bfb88f30687&gdpr=&gdpr_consent=&us_privacy=

0
340 B

397ms
397ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=30&uid=397a0df4-c51f-47bf-845f-0bfb88f30687&gdpr=&gdpr_consent=&us_privacy=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Location: //onetag-sys.com/match/?int_id=30&uid=397a0df4-c51f-47bf-845f-0bfb88f30687&gdpr=&gdpr_consent=&us_privacy=
Date: Fri, 11 Nov 2022 04:46:36 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2 200 sync
ads.servenobid.com/ Frame 6B46 0
364 B 405ms
404ms Image
image/avif 34.252.126.43
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=318&uid=g9g4wLGp0efm6qjv_6bMeI9v-Gb5yRo_ANOgl2APmok
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.252.126.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-252-126-43.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:35 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame E64B 42 B
64 B 288ms
287ms Fetch
image/gif 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuEFkVE9QmkgtMo6eAB_6yTnoMF1lsZe4RRWtk1T4HutX-r-QSSec72ThG7XH30TYZ1VfBnWa4DU-z-d2GpdxbVeIEB9dkHuwMVRmyEaPrXvtKCn0XKrCLQKyAoPlslODCeN8k&sai=AMfl-YRsTuXZR_v2qiMBQBOAlC_-QufVRE_rYzwo83gtnO4jirlwfWOgQDV_eSPDO4T0APsGdT2ZwOEAZmaCjAXcAS3V0D5B7YtBY6vQP0iaO0LRZ5muj7uW1uwl2g7pJQ&sig=Cg0ArKJSzGqRfwG8Z_wHEAE&cid=CAQSOwDq26N9D1OUO62QOb7sr66XT4QCAc6gGRkHYi1qr0S__aPdP-aPhvbhjOFm_70kTKXeRDLPGqZCSrxpGAEgEw&id=lidar2&mcvt=1000&p=60,450,314,750&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20221109&bin=7&avms=nio&bs=0,0&mc=0.98&if=1&app=0&itpl=20&adk=1420297610&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1668141991417&rpt=2617&isd=0&lsd=0&met=mue&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 bids Show response
prebid-asia.creativecdn.com/bidder/prebid/ Frame 3F32 0
172 B 240ms
237ms XHR
text/plain 103.132.192.30
RTBHOUSE-AS-AP RT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-asia.creativecdn.com/bidder/prebid/bids
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.132.192.30 , Singapore, ASN138552 (RTBHOUSE-AS-AP RTB HOUSE PTE. LTD., SG),
Reverse DNS: ip-103-132-192-30.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://www.bg3.co
date: Fri, 11 Nov 2022 04:46:35 GMT
access-control-allow-credentials: true
vary: Origin
access-control-max-age: 3600
access-control-allow-methods: POST

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame AE15 5 KB
6 KB 707ms
236ms Script
text/html 67.199.150.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=92897471&p=159463&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dpba%26refUrl%3D%26vid%3D81419942253111435947443605000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 67.199.150.81 Los Angeles, United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 0dac438ac02302e2c328801e7dca9d51ad9ef035d362b72aa1d6bf853a961923

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Fri, 11 Nov 2022 04:46:35 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 drawV2.js Show response
cdn.holmesmind.com/js/ Frame 3F32 10 KB
10 KB 259ms
258ms Script
application/javascript 13.227.254.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.holmesmind.com/js/drawV2.js
Requested by: Host: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=14006&rf=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&n=981&o=1&d=1&b=2&ts=1&ii=2&FPCK=3302-XjJVpHJmOewoiMYXi0wErpQlJ2hUUO19&initver=210830P
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.254.22 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-254-22.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f3fc929a36ee5db31a8a9b4743845474bdeb425edb019eb4e75a441cdb8ab032

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: null
date: Fri, 11 Nov 2022 04:46:36 GMT
via: 1.1 db75d9999621c662b2eccf4f496b12aa.cloudfront.net (CloudFront)
last-modified: Fri, 16 Oct 2020 09:58:46 GMT
server: AmazonS3
x-amz-cf-pop: SIN52-C3
age: 11
etag: "84d8b1a745228113e60f5e62f0eff6d3"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 10359
x-amz-cf-id: OLNuUjjaNGht8qGOPnhV272bB0CZQjinhWa-229nHQGH5WvEomivrQ==

POST
H3

200

bid Show response
ad2.apx.appier.net/v1/prebid/ Frame 3F32
Redirect Chain

https://ad2.apx.appier.net/v1/prebid/bid
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid
https://ad2.apx.appier.net/v1/prebid/bid?acid=ETgc6mymDHOx9giKqtNtYw

2 B
19 B

322ms
321ms

XHR
application/json

34.96.119.68
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ad2.apx.appier.net/v1/prebid/bid?acid=ETgc6mymDHOx9giKqtNtYw
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H3
Server: 34.96.119.68 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 68.119.96.34.bc.googleusercontent.com
Software: nginx/1.19.0 /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:35 GMT
via: 1.1 google
server: nginx/1.19.0
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-store
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2

Redirect headers

date: Fri, 11 Nov 2022 04:46:35 GMT
server: nginx
p3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: null
location: https://ad2.apx.appier.net/v1/prebid/bid?acid=ETgc6mymDHOx9giKqtNtYw
cache-control: no-store
access-control-allow-credentials: true
content-length: 0

POST
H3

200

bid Show response
ad2.apx.appier.net/v1/prebid/ Frame 3F32
Redirect Chain

https://ad2.apx.appier.net/v1/prebid/bid
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid
https://ad2.apx.appier.net/v1/prebid/bid?acid=ETgc6mymDHOx9giKqtNtYw

10 KB
4 KB

357ms
356ms

XHR
application/json

34.96.119.68
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ad2.apx.appier.net/v1/prebid/bid?acid=ETgc6mymDHOx9giKqtNtYw
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H3
Server: 34.96.119.68 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 68.119.96.34.bc.googleusercontent.com
Software: nginx/1.19.0 /
Resource Hash: ab82304ce713e1aa1efd44145b714c2a17e874433f2e9960056eddfa74e74a00

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:35 GMT
content-encoding: gzip
via: 1.1 google
server: nginx/1.19.0
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-store
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

Redirect headers

date: Fri, 11 Nov 2022 04:46:35 GMT
server: nginx
p3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: null
location: https://ad2.apx.appier.net/v1/prebid/bid?acid=ETgc6mymDHOx9giKqtNtYw
cache-control: no-store
access-control-allow-credentials: true
content-length: 0

POST
H3

200

bid Show response
ad2.apx.appier.net/v1/prebid/ Frame 3F32
Redirect Chain

https://ad2.apx.appier.net/v1/prebid/bid
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid
https://ad2.apx.appier.net/v1/prebid/bid?acid=ETgc6mymDHOx9giKqtNtYw

2 B
19 B

350ms
349ms

XHR
application/json

34.96.119.68
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ad2.apx.appier.net/v1/prebid/bid?acid=ETgc6mymDHOx9giKqtNtYw
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H3
Server: 34.96.119.68 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 68.119.96.34.bc.googleusercontent.com
Software: nginx/1.19.0 /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:35 GMT
via: 1.1 google
server: nginx/1.19.0
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-store
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2

Redirect headers

date: Fri, 11 Nov 2022 04:46:35 GMT
server: nginx
p3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: null
location: https://ad2.apx.appier.net/v1/prebid/bid?acid=ETgc6mymDHOx9giKqtNtYw
cache-control: no-store
access-control-allow-credentials: true
content-length: 0

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame BDE3 36 B
403 B 290ms
290ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

3e8d845feef76090f4c2578023ac5e78b5a8a9b45de90062881935c4962546ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:35 GMT
strict-transport-security: max-age=0
content-encoding: gzip
server: nginx
vary: Accept-Encoding, Origin
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, private
access-control-allow-credentials: true

POST
H2 200 cdb Show response
bidder.criteo.com/ Frame 3F32 177 B
427 B 240ms
240ms XHR
application/json 182.161.73.145
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?ptv=132&profileId=184&bundle=zIyLfl9pYXdmUG44a1RTZnZJVGJvTCUyQmF3WDRacVN3OVN6dUFlb3Rjc2NXVU4lMkYxVjlxcXZuN1Y5YXU2VFRoQ0Flek96Qk5QYmZVTEJrR3J2Ykk3cmNPUm9LJTJGaHk2Zm4xb0xHaURvJTJGREJWb3V4cDFVJTNE&cb=13695162816

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.145 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

6f01fcd1230fbb663b2409041b5e481eea96698333ec426c0eb7b17a1d581c14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Fri, 11 Nov 2022 04:46:34 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bg3.co
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 163

POST
H2 200 cdb Show response
bidder.criteo.com/ Frame 3F32 177 B
428 B 237ms
237ms XHR
application/json 182.161.73.145
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.145 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

950eee090eb5e89b317c1587cc3b2d8a78138713d410770f890d931e9a455d73

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Fri, 11 Nov 2022 04:46:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bg3.co
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 164

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 10A7
Redirect Chain

https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
https://usersync.gumgum.com/usersync?b=apn&i=3680859315881377104

35 B
250 B

1151ms
245ms

Image
image/gif

13.112.54.241
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=apn&i=3680859315881377104
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 13.112.54.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-112-54-241.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:36 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Date: Fri, 11 Nov 2022 04:46:35 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 116.90.74.196; 116.90.74.196; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 4eda8ebc-c428-49c3-a2dc-2220d143d7bd
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://usersync.gumgum.com/usersync?b=apn&i=3680859315881377104
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 10A7
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=a_fb733eb7-45a5-4951-8c48-35e888fbdb12&gdpr=0&gdpr_consent=&us_privacy=1---
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=gumgum2&bsw_custom_parameter=397a0df4-c51f-47bf-845f-0bfb88f30687
https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=gumgum2&bsw_custom_parameter=397a0df4-c51f-47bf-845f-0bfb88f30687
https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=cdd07264-9075-489d-813c-2350d6e4d42f&user_group=1&ssp=gumgum2&bsw_param=397a0df4-c51f-47bf-845f-0bfb88f30687
https://usersync.gumgum.com/usersync?b=bsw&i=397a0df4-c51f-47bf-845f-0bfb88f30687

35 B
250 B

245ms
244ms

Image
image/gif

13.112.54.241
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=bsw&i=397a0df4-c51f-47bf-845f-0bfb88f30687
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 13.112.54.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-112-54-241.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:37 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: //usersync.gumgum.com/usersync?b=bsw&i=397a0df4-c51f-47bf-845f-0bfb88f30687
Date: Fri, 11 Nov 2022 04:46:37 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 10A7
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sta&i=0-cc8a2f52-6500-4184-5aee-ace5fd252964$ip$116.90.74.196

35 B
250 B

1144ms
247ms

Image
image/gif

13.112.54.241
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sta&i=0-cc8a2f52-6500-4184-5aee-ace5fd252964$ip$116.90.74.196
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 13.112.54.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-112-54-241.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:36 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=sta&i=0-cc8a2f52-6500-4184-5aee-ace5fd252964$ip$116.90.74.196
Date: Fri, 11 Nov 2022 04:46:35 GMT
Connection: keep-alive
Content-Length: 127
Content-Type: text/html; charset=utf-8

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 10A7
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=a_fb733eb7-45a5-4951-8c48-35e888fbdb12&gdpr=0&gdpr_consent=&us_privacy=1---&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__
https://stags.bluekai.com/site/23178?id=3rHWJlvPuTgRwAcp3o9-&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LO...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2M3SJBLUU3DWKB2VIZ2SO5AWG4BTN44S2...
https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=3rHWJlvPuTgRwAcp3o9-&us_privacy=1---

35 B
250 B

245ms
244ms

Image
image/gif

13.112.54.241
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=3rHWJlvPuTgRwAcp3o9-&us_privacy=1---
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 13.112.54.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-112-54-241.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:38 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:38 GMT
Content-Type: text/html; charset=utf-8
Location: https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=3rHWJlvPuTgRwAcp3o9-&us_privacy=1---
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 123
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 10A7
Redirect Chain

https://sync.1rx.io/usersync2/floor6?gdpr=0&gdpr_consent=&dspret=1&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync2/floor6?zcc=1&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3D%5BRX_UUID%5D&cb=1668141995433
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=8458516871
https://sync.1rx.io/usersync/tradedesk/1bc1ccf6-de8d-48ed-908c-c2e129bce8ed
https://sync.targeting.unrulymedia.com/csync/RX-056f8bf3-1476-4990-8f0a-8faca5760f23-004?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3DRX-056f8bf3-1476-4990-8f0a-8faca5760f23-004
https://usersync.gumgum.com/usersync?b=rhy&i=RX-056f8bf3-1476-4990-8f0a-8faca5760f23-004

35 B
250 B

248ms
246ms

Image
image/gif

13.112.54.241
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=rhy&i=RX-056f8bf3-1476-4990-8f0a-8faca5760f23-004
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 13.112.54.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-112-54-241.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:37 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=rhy&i=RX-056f8bf3-1476-4990-8f0a-8faca5760f23-004
date: Fri, 11 Nov 2022 04:46:37 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RX056f8bf3147649908f0a8faca5760f23004
content-type: text/html

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 10A7
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://usersync.gumgum.com/usersync?b=pln&i=H4BhyKapLQ7U&ev=1&pid=558355

35 B
250 B

628ms
245ms

Image
image/gif

13.112.54.241
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=pln&i=H4BhyKapLQ7U&ev=1&pid=558355
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 13.112.54.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-112-54-241.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:36 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
location: https://usersync.gumgum.com/usersync?b=pln&i=H4BhyKapLQ7U&ev=1&pid=558355
content-language: en-NZ
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-6d97b86c77-8kxs7
expires: -1

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame 10A7
Redirect Chain

https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobR...
https://usersync.gumgum.com/usersync?b=obn&i=ENC%289W2pqcNdpu4QpsdgdaMDBhmh1gK9upnWvq7QObv_sUsvJM9XBNMsB_rL9UGxj2-N%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%...
https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=a_fb733eb7-45a5-4951-8c48-35e888fbdb12&obuid=ENC(9W2pqcNdpu4QpsdgdaMDBhmh1gK9upnWvq7QObv_sUsvJM9XBNMsB_rL9UGxj2-N)
https://sync.outbrain.com/syncPartner?platformId=GUMGU18H7EL9NI653I7DPEH51
https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=15268&gdpr=$GDPR_APPLIES&gdpr_consent=$CONSNT_STRING&us_privacy=$CCPA
https://sync.outbrain.com/cookie-sync?p=rubicon&uid=LAC0O423-1K-IQAL&gdpr_consent=$CONSNT_STRING&us_privacy=$CCPA

0
145 B

297ms
295ms

Image
text/plain

38.133.127.127
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=rubicon&uid=LAC0O423-1K-IQAL&gdpr_consent=$CONSNT_STRING&us_privacy=$CCPA
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 38.133.127.127 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:37 GMT
Cache-Control: no-cache
X-TraceId: c614c0cfbb89cc2f00ba540f26a01c76
Content-Length: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://sync.outbrain.com/cookie-sync?p=rubicon&uid=LAC0O423-1K-IQAL&gdpr_consent=$CONSNT_STRING&us_privacy=$CCPA
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: ad49a0f18e050afeb6359164ab3bd56e
Expires: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 10A7
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://usersync.gumgum.com/usersync?b=opx&i=31978ff2-38ea-4413-9b85-8f117cf4bdcb

35 B
250 B

1062ms
245ms

Image
image/gif

13.112.54.241
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=opx&i=31978ff2-38ea-4413-9b85-8f117cf4bdcb
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 13.112.54.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-112-54-241.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:36 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Fri, 11 Nov 2022 04:46:35 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://usersync.gumgum.com/usersync?b=opx&i=31978ff2-38ea-4413-9b85-8f117cf4bdcb
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 10A7
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=oth&i=y-F1GWM21E2pdCZVijd6Ftuuc8YabgNca0851A~A

35 B
250 B

246ms
246ms

Image
image/gif

13.112.54.241
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=oth&i=y-F1GWM21E2pdCZVijd6Ftuuc8YabgNca0851A~A
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 13.112.54.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-112-54-241.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:36 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Fri, 11 Nov 2022 04:46:36 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://usersync.gumgum.com/usersync?b=oth&i=y-F1GWM21E2pdCZVijd6Ftuuc8YabgNca0851A~A
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 10A7
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=1---&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fuser...
https://usersync.gumgum.com/usersync?b=vnt&i=32f2cc4a-feb7-46a6-bce1-cc53d1ea80f5

35 B
250 B

244ms
244ms

Image
image/gif

13.112.54.241
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=vnt&i=32f2cc4a-feb7-46a6-bce1-cc53d1ea80f5
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 13.112.54.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-112-54-241.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:38 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=vnt&i=32f2cc4a-feb7-46a6-bce1-cc53d1ea80f5
Date: Fri, 11 Nov 2022 04:46:37 GMT
Connection: keep-alive
X-CI-RTID: 79b67a27-3cef-494c-8719-1540fc22978f
Content-Length: 108
Content-Type: text/html; charset=utf-8

GET
H2 204 services
sync.technoratimedia.com/ Frame 10A7 0
293 B 1019ms
338ms Image
text/plain 129.159.70.95
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=1---&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 129.159.70.95 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:37 GMT
via: 1.1 varnish
server: nginx
age: 0
access-control-allow-methods: POST,GET,HEAD,OPTIONS
x-varnish: 614940694
access-control-allow-origin: https://g2.gumgum.com/
access-control-allow-credentials: true

GET
H2 200 142
match.deepintent.com/usersync/ Frame 10A7 0
44 B 1021ms
338ms Image
text/plain 169.197.150.7
DEEPINTENT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.deepintent.com/usersync/142?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Ddit%26i%3D%24%7BDI_USER_ID%7D
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS: g.deepintent.com
Software: c /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:36 GMT
content-length: 0
server: c

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 10A7
Redirect Chain

https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://usersync.gumgum.com/usersync?b=idi&i=ee7d135b-4bda-4039-b634-efb359b159c7

35 B
250 B

246ms
245ms

Image
image/gif

13.112.54.241
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=idi&i=ee7d135b-4bda-4039-b634-efb359b159c7
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 13.112.54.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-112-54-241.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:38 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=idi&i=ee7d135b-4bda-4039-b634-efb359b159c7
access-control-allow-origin: *
date: Fri, 11 Nov 2022 04:46:37 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 10A7
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sad&i=3522029429720563423

35 B
250 B

246ms
246ms

Image
image/gif

13.112.54.241
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sad&i=3522029429720563423
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 13.112.54.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-112-54-241.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:37 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=sad&i=3522029429720563423
date: Fri, 11 Nov 2022 04:46:37 GMT
content-length: 0

GET
H2 200 sync
ads.servenobid.com/ Frame 10A7 0
358 B 405ms
404ms Image
image/avif 34.252.126.43
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=309&uid=a_fb733eb7-45a5-4951-8c48-35e888fbdb12
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.252.126.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-252-126-43.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:38 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 76FA 15 KB
6 KB 291ms
279ms Document
text/html 23.78.217.19
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.78.217.19 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-78-217-19.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=32258
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Fri, 11 Nov 2022 04:46:35 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Fri, 11 Nov 2022 13:44:13 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 656E
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=ttd&i=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed

35 B
250 B

972ms
242ms

Document
image/gif

13.112.54.241
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=ttd&i=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.112.54.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-112-54-241.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 11 Nov 2022 04:46:36 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: private,no-cache, must-revalidate
content-length: 193
content-type: text/html
date: Fri, 11 Nov 2022 04:46:35 GMT
location: https://usersync.gumgum.com/usersync?b=ttd&i=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 4E88
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2fusersync.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
https://usersync.gumgum.com/usersync?b=mmh&i=635a636d-d3aa-4200-b3a0-f12363f77230&gdpr=0&gdpr_consent=

35 B
250 B

980ms
245ms

Document
image/gif

13.112.54.241
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=mmh&i=635a636d-d3aa-4200-b3a0-f12363f77230&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.112.54.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-112-54-241.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 11 Nov 2022 04:46:36 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Fri, 11 Nov 2022 04:46:35 GMT
Expires: Fri, 11 Nov 2022 04:46:34 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 4629 97bee97 master nrt-pixel-x21 config:1.0.0
location: https://usersync.gumgum.com/usersync?b=mmh&i=635a636d-d3aa-4200-b3a0-f12363f77230&gdpr=0&gdpr_consent=

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 91F6
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=&_test=Y23TqwAAAflkLwAT
https://usersync.gumgum.com/usersync?b=atm&i=Y23TqwAAAflkLwAT&gdpr=0&gdpr_consent=&_test=Y23TqwAAAflkLwAT

35 B
250 B

714ms
244ms

Document
image/gif

13.112.54.241
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=atm&i=Y23TqwAAAflkLwAT&gdpr=0&gdpr_consent=&_test=Y23TqwAAAflkLwAT
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.112.54.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-112-54-241.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 11 Nov 2022 04:46:36 GMT
Expires: 0
Pragma: no-cache

Redirect headers

accept-ranges: bytes
cache-control: no-cache
content-length: 0
date: Fri, 11 Nov 2022 04:46:35 GMT
location: https://usersync.gumgum.com/usersync?b=atm&i=Y23TqwAAAflkLwAT&gdpr=0&gdpr_consent=&_test=Y23TqwAAAflkLwAT
pragma: no-cache
retry-after: 0
server: Varnish
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 0
x-served-by: cache-mel11220-MEL
x-timer: S1668141996.778344,VS0,VE0

GET
H3 200 pixel Show response
cm.g.doubleclick.net/ Frame B617 170 B
188 B 291ms
281ms Document
image/png 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=YV9mYjczM2ViNy00NWE1LTQ5NTEtOGM0OC0zNWU4ODhmYmRiMTI=&gdpr=0&gdpr_consent=

Requested by

Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 170
content-type: image/png
cross-origin-resource-policy: cross-origin
date: Fri, 11 Nov 2022 04:46:35 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H2 200 um Show response
cs.emxdgt.com/ Frame 0BBF 0
67 B 788ms
338ms Document
text/plain 3.228.33.18
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://cs.emxdgt.com/um?redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24UID&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.228.33.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-228-33-18.compute-1.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

content-length: 0
content-type: text/plain; charset=utf-8
date: Fri, 11 Nov 2022 04:46:35 GMT
server: awselb/2.0

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame B9F2
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=gumgum
https://usersync.gumgum.com/usersync?b=sus&i=Y23TqcCo8YAAABA1dDIAAAAA

35 B
250 B

959ms
246ms

Document
image/gif

13.112.54.241
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=sus&i=Y23TqcCo8YAAABA1dDIAAAAA
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.112.54.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-112-54-241.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 11 Nov 2022 04:46:36 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Cache-Control: private
Connection: keep-alive
Content-Length: 0
Date: Fri, 11 Nov 2022 04:46:35 GMT
Location: https://usersync.gumgum.com/usersync?b=sus&i=Y23TqcCo8YAAABA1dDIAAAAA
P3P: CP="See also http://www.scaleout.jp/privacy/"
Server: nginx
X-SO-Ads-Time: 1
X-SO-Cluster-ID: 34
X-SO-HostName: m-ad290.dc4p.scaleout.jp
X-SO-IP: 116.90.74.196
X-SO-Key: Y23TqcCo8YAAABA1dDIAAAAA
X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":34,"gdpr":false,"ipv4":"116.90.74.196","key":"Y23TqcCo8YAAABA1dDIAAAAA","privacy_sensitive":false,"uid":"Y23TqcCo8YAAABA1dDIAAAAA","upstream_id":"m-ad290"}
X-SO-LB-Hostname: m-tgng24.dc4p.scaleout.jp
X-SO-UID: Y23TqcCo8YAAABA1dDIAAAAA
X-SO-Upstream-ID: m-ad290

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 924E
Redirect Chain

https://cs.admanmedia.com/sync/gumgum?puid=[UID]&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Daad%26i%3D%5BDSP_USER_ID%5D&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]&ccpa=[CCPA]
https://usersync.gumgum.com/usersync?b=aad&i=42d263c1-ac7d-48a7-a33f-a1e9577cc6ab

35 B
250 B

353ms
241ms

Document
image/gif

13.112.54.241
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=aad&i=42d263c1-ac7d-48a7-a33f-a1e9577cc6ab
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.112.54.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-112-54-241.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 11 Nov 2022 04:46:36 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Date: Fri, 11 Nov 2022 04:46:36 GMT
Expires: 0
Location: https://usersync.gumgum.com/usersync?b=aad&i=42d263c1-ac7d-48a7-a33f-a1e9577cc6ab
Pragma: no-cache
Server: nginx
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Transfer-Encoding: chunked
X-Frame-Options: DENY

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame F50A
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=189872&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diex%26i%3D
https://usersync.gumgum.com/usersync?b=iex&i=Y23TqrR.H1tu5-PMWLBNCQAA%265331

35 B
250 B

964ms
247ms

Document
image/gif

13.112.54.241
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=iex&i=Y23TqrR.H1tu5-PMWLBNCQAA%265331
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.112.54.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-112-54-241.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 11 Nov 2022 04:46:36 GMT
Expires: 0
Pragma: no-cache

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 7684628f1908eeaa-AKL
content-length: 0
date: Fri, 11 Nov 2022 04:46:35 GMT
expires: 0
location: https://usersync.gumgum.com/usersync?b=iex&i=Y23TqrR.H1tu5-PMWLBNCQAA%265331
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pdjoSLnn6RkyDqUj41rq6AKZSMcVDzSNziCaqQAVh4NnW%2BiBz3Lgx9a0LiqOTQ37s2zKjhWw9TKKOXAdGggmVaRgfq%2FP2wu0DROSg6BSstZcHdi71sLOtYf0jQE%2FM44QaiwrZ%2B9zf9n69Q%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 94C8
Redirect Chain

https://creativecdn.com/cm-notify?pi=gumgum
https://creativecdn.com/cm-notify?pi=gumgum&tc=1
https://usersync.gumgum.com/usersync?b=rth&i=iCAnswDAh6Gacmti4JIi&pi=gumgum&tc=1

35 B
250 B

245ms
244ms

Document
image/gif

13.112.54.241
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=rth&i=iCAnswDAh6Gacmti4JIi&pi=gumgum&tc=1
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.112.54.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-112-54-241.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 11 Nov 2022 04:46:36 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Fri, 11 Nov 2022 04:46:36 GMT Fri, 11 Nov 2022 04:46:36 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://usersync.gumgum.com/usersync?b=rth&i=iCAnswDAh6Gacmti4JIi&pi=gumgum&tc=1
pragma: no-cache

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 3F99
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

281 B
554 B

294ms
269ms

Document
text/html

23.75.85.227
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.75.85.227 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-75-85-227.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 11 Nov 2022 04:46:35 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Fri, 11 Nov 2022 04:46:35 GMT
location: https://eus.rubiconproject.com/usync.html?p=gumgum
server: AkamaiGHost

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 2991 33 KB
10 KB 312ms
312ms Script
text/html 23.75.85.227
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.75.85.227 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-75-85-227.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 701e63b36146442c60d37618e26c0a0d8efd675766377047a5f96c2d953f119c

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:35 GMT
Content-Encoding: gzip
Last-Modified: Fri, 11 Nov 2022 00:59:42 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=72787
Connection: keep-alive
Content-Length: 9884
Expires: Sat, 12 Nov 2022 00:59:42 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 1231 33 KB
10 KB 271ms
270ms Script
text/html 23.75.85.227
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=medianet
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.75.85.227 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-75-85-227.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 701e63b36146442c60d37618e26c0a0d8efd675766377047a5f96c2d953f119c

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=medianet
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:35 GMT
Content-Encoding: gzip
Last-Modified: Fri, 11 Nov 2022 00:59:42 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=72787
Connection: keep-alive
Content-Length: 9884
Expires: Sat, 12 Nov 2022 00:59:42 GMT

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame 3F32 36 B
403 B 291ms
290ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

3e8d845feef76090f4c2578023ac5e78b5a8a9b45de90062881935c4962546ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:35 GMT
strict-transport-security: max-age=0
content-encoding: gzip
server: nginx
vary: Accept-Encoding, Origin
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, private
access-control-allow-credentials: true

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 33A4 42 B
64 B 289ms
288ms Fetch
image/gif 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsugRY6OUL7hMX4q6cJf2d2QqwooiqAhlc3N7_EL8pJ996pczEacnNkEuNmhVs26vpODhx07utbBxkx9U9DdRWrPrcJ0oI4QKTO-2taI-VM2_xyvdn9ZjcbpdO3B_516HBp2DOc&sai=AMfl-YS-E3PmI9A6F-xinCV04V9qD2KZ-Np8aqd9Fcn1eua8RbNA6nYuHbg-lhWSfp8GMx7rgNjiGVVAa339Gbnzzh-KLWR85jpL2a2OofV0dSkUJ4XacBYSJi5jMJdsMg&sig=Cg0ArKJSzLy7R8iQR84PEAE&cid=CAQSOwDq26N9D1OUO62QOb7sr66XT4QCAc6gGRkHYi1qr0S__aPdP-aPhvbhjOFm_70kTKXeRDLPGqZCSrxpGAEgEw&id=lidar2&mcvt=1000&p=300,5,900,125&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20221109&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=4082231052&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1668141991444&rpt=2944&isd=0&lsd=0&met=ie&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://4acf04584da536634e4596e537e96396.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 events
bidder.criteo.com/csm/ Frame 3F32 0
211 B 237ms
236ms Ping
text/plain 182.161.73.145
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/csm/events

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.145 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 11 Nov 2022 04:46:36 GMT
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
access-control-allow-origin: https://www.bg3.co
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *

POST
H2 204 events
bidder.criteo.com/csm/ Frame 3F32 0
211 B 235ms
234ms Ping
text/plain 182.161.73.145
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/csm/events

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.145 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 11 Nov 2022 04:46:36 GMT
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
access-control-allow-origin: https://www.bg3.co
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *

GET
H2 200 sync
ads.servenobid.com/ Frame 1E35 0
344 B 405ms
404ms Image
image/avif 34.252.126.43
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=317&uid=3522029429720563423&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.252.126.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-252-126-43.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:35 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 1E35
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=30&p=273&cp=smartortb&cu=1&url=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D79%26partneruserid%3D%40%40CRITEO_USERID%40%4...
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=c62c6115-8947-4602-9b43-1c37ae8765fd&gdpr=0&gdpr_consent=

43 B
425 B

1555ms
236ms

Image
image/gif

23.106.127.165
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=c62c6115-8947-4602-9b43-1c37ae8765fd&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 23.106.127.165 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Fri, 11 Nov 2022 04:46:36 GMT
cache-control: no-cache,no-store
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:35 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=c62c6115-8947-4602-9b43-1c37ae8765fd&gdpr=0&gdpr_consent=
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1204932
content-length: 0
expires: Fri, 11 Nov 2022 00:00:00 GMT

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 1E35
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=10&sspurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D22%26partneruserid%3DYOUR_USER_ID&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=2057151992493556101&gdpr=0&gdpr_consent=

43 B
408 B

1517ms
235ms

Image
image/gif

23.106.127.165
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=2057151992493556101&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 23.106.127.165 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Fri, 11 Nov 2022 04:46:36 GMT
cache-control: no-cache,no-store
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=2057151992493556101&gdpr=0&gdpr_consent=
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 1E35
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=560288&ev=1&rurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D92%26partneruserid%3D%25%25VGUID%25%25&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=92&partneruserid=xPWHuwF6QnVW&ev=1&pid=560288&gdpr_consent=&gdpr=0

43 B
401 B

1112ms
235ms

Image
image/gif

23.106.127.165
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=92&partneruserid=xPWHuwF6QnVW&ev=1&pid=560288&gdpr_consent=&gdpr=0
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 23.106.127.165 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Fri, 11 Nov 2022 04:46:36 GMT
cache-control: no-cache,no-store
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=92&partneruserid=xPWHuwF6QnVW&ev=1&pid=560288&gdpr_consent=&gdpr=0
content-language: en-NZ
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-stage-0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1E35
Redirect Chain

https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=134&partneruserid=OB_OK&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmart_adserver_eb%26google_hm%3DSMART_USER_ID_...
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=MzUyMjAyOTQyOTcyMDU2MzQyMw==&gdpr=0&gdpr_consent=

170 B
188 B

281ms
281ms

Image
image/png

142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=MzUyMjAyOTQyOTcyMDU2MzQyMw==&gdpr=0&gdpr_consent=

Requested by

Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID

Protocol

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=MzUyMjAyOTQyOTcyMDU2MzQyMw==&gdpr=0&gdpr_consent=
pragma: no-cache
date: Fri, 11 Nov 2022 04:46:36 GMT
cache-control: no-cache,no-store
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

GET
H2 200 emome2 Show response
t.ssp.hinet.net/ Frame BDE3 30 B
273 B 295ms
289ms XHR
application/json 203.75.214.136
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL

https://t.ssp.hinet.net/emome2?u=edce82ca-49f3-4338-a029-73e3c0c320f3

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

365fc555dbd2149871a77b9485dbb0cbd487a0553f7a90163444349fee756f60

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:35 GMT
strict-transport-security: max-age=0
content-encoding: gzip
server: nginx
vary: Accept-Encoding, Origin
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, private
access-control-allow-credentials: true

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 0051 0
859 B 341ms
336ms Script
text/html 68.67.179.87
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.87 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:35 GMT
AN-X-Request-Uuid: 401c9775-a70c-49c3-90c0-890bf1005353
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 116.90.74.196; 116.90.74.196; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 prebid.aspx Show response
prebid.scupio.com/recweb/ Frame 3F32 0
50 B 297ms
294ms XHR
text/html 210.59.219.181
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.scupio.com/recweb/prebid.aspx?cb=0.32227772488348383
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 210.59.219.181 New Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 11 Nov 2022 04:46:34 GMT
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
content-type: text/html
access-control-allow-origin: https://www.bg3.co
cache-control: private
access-control-allow-credentials: true

POST
H2 204 prebid.aspx Show response
prebid.scupio.com/recweb/ Frame 3F32 0
27 B 309ms
306ms XHR
text/html 210.59.219.181
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.scupio.com/recweb/prebid.aspx?cb=0.3700945478390927
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 210.59.219.181 New Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 11 Nov 2022 04:46:34 GMT
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
content-type: text/html
access-control-allow-origin: https://www.bg3.co
cache-control: private
access-control-allow-credentials: true

GET
H2

200

cksync.php
contextual.media.net/ Frame 1231
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=medianet&khaos=LAC0O423-1K-IQAL
https://contextual.media.net/cksync.php?type=rbcn&ovsid=LAC0O423-1K-IQAL

45 B
451 B

295ms
295ms

Image
image/gif

104.71.48.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?type=rbcn&ovsid=LAC0O423-1K-IQAL

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=medianet

Protocol

Server

104.71.48.26 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Fri, 11 Nov 2022 04:46:36 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Fri, 11 Nov 2022 04:46:36 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://contextual.media.net/cksync.php?type=rbcn&ovsid=LAC0O423-1K-IQAL
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: f60a7260b0ebb7a40a81234af4a9e826
Expires: 0

GET
H2 200 emome2 Show response
t.ssp.hinet.net/ Frame 3F32 30 B
273 B 290ms
290ms XHR
application/json 203.75.214.136
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL

https://t.ssp.hinet.net/emome2?u=edce82ca-49f3-4338-a029-73e3c0c320f3

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

365fc555dbd2149871a77b9485dbb0cbd487a0553f7a90163444349fee756f60

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:35 GMT
strict-transport-security: max-age=0
content-encoding: gzip
server: nginx
vary: Accept-Encoding, Origin
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, private
access-control-allow-credentials: true

GET
H2

200

sync
ads.servenobid.com/ Frame 2991
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=duration_media&khaos=LAC0O423-1K-IQAL
https://ads.servenobid.com/sync?pid=323&uid=LAC0O423-1K-IQAL

0
343 B

405ms
404ms

Image
image/avif

34.252.126.43
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=323&uid=LAC0O423-1K-IQAL
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
Protocol: H2
Server: 34.252.126.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-252-126-43.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:37 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://ads.servenobid.com/sync?pid=323&uid=LAC0O423-1K-IQAL
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: ad49a0f18e050afeb6359164ab3bd56e
Expires: 0

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame BDE3 0
189 B 294ms
294ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=1854-1rrzahWCu6AIS59nm5OKx2miLWnjqAHD&mp=edce82ca-49f3-4338-a029-73e3c0c320f3

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:35 GMT
strict-transport-security: max-age=0
server: nginx
vary: Origin
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, private
access-control-allow-credentials: true

GET
H2 200 pixel
edce82ca-49f3-4338-a029-73e3c0c320f3.t.ssp.hinet.net/ Frame BDE3 0
79 B 444ms
294ms Image
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://edce82ca-49f3-4338-a029-73e3c0c320f3.t.ssp.hinet.net/pixel?bd=edce82ca-49f3-4338-a029-73e3c0c320f3&t=50ef57&referrer=https%3A%2F%2Fwww.bg3.co

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:36 GMT
strict-transport-security: max-age=0
server: nginx
content-length: 0
content-type: image/png

GET
H2 200 match Show response
c1.adform.net/serving/cookie/ Frame 33F0 35 B
468 B 327ms
266ms Document
image/gif 185.84.60.23
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?party=14&cid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dpba%26refUrl%3D%26vid%3D81419942253111435947443605000V10%26ovsid%3DPM_UID

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.84.60.23 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Fri, 11 Nov 2022 04:46:35 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2

200

/ Show response
onetag-sys.com/match/ Frame 1AAC
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:635a636d-d3aa-4200-b3a0-f12363f77230&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

0
340 B

395ms
392ms

Document
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

Redirect headers

cache-control: private,max-age=86400
content-length: 108
content-type: text/html; charset=utf-8
date: Fri, 11 Nov 2022 04:46:00 GMT
location: https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 9D3F
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Y23TqwAAAflkLwAT&gdpr=0&gdpr_consent=

1 B
451 B

700ms
234ms

Document
text/html

67.199.150.86
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Y23TqwAAAflkLwAT&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dpba%26refUrl%3D%26vid%3D81419942253111435947443605000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 67.199.150.86 Los Angeles, United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Fri, 11 Nov 2022 04:46:36 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ranges: bytes
cache-control: no-cache
content-length: 0
date: Fri, 11 Nov 2022 04:46:35 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Y23TqwAAAflkLwAT&gdpr=0&gdpr_consent=
pragma: no-cache
retry-after: 0
server: Varnish
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 0
x-served-by: cache-mel11220-MEL
x-timer: S1668141996.939109,VS0,VE0

GET
H2

200

/ Show response
onetag-sys.com/match/ Frame C8C6
Redirect Chain

https://cm.ambientdsp.com/cm/send?vc=pmj
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQ0OSZ0bD00MzIwMA==&piggybackCookie=xrrw02dx3mw
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

0
340 B

393ms
390ms

Document
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

Redirect headers

cache-control: private,max-age=86400
content-length: 108
content-type: text/html; charset=utf-8
date: Fri, 11 Nov 2022 04:46:37 GMT
location: https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

/ Show response
onetag-sys.com/match/ Frame 11B6
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=h_maZ9X5zWGc-542hP2BMNWunDSc_p06g69jnkWd
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

0
340 B

392ms
391ms

Document
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

Redirect headers

cache-control: private,max-age=86400
content-length: 108
content-type: text/html; charset=utf-8
date: Fri, 11 Nov 2022 04:46:36 GMT
location: https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

/ Show response
onetag-sys.com/match/ Frame C8D3
Redirect Chain

https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3680859315881377104&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

0
340 B

394ms
393ms

Document
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

Redirect headers

cache-control: private,max-age=86400
content-length: 108
content-type: text/html; charset=utf-8
date: Fri, 11 Nov 2022 04:46:36 GMT
location: https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

/ Show response
onetag-sys.com/match/ Frame E20C
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCooki...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

0
340 B

396ms
393ms

Document
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

Redirect headers

cache-control: private,max-age=86400
content-length: 108
content-type: text/html; charset=utf-8
date: Fri, 11 Nov 2022 04:46:36 GMT
location: https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

/ Show response
onetag-sys.com/match/ Frame EE46
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=zIovUmUAQYRa7qzl_SUpZHRaSsQ
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

0
340 B

395ms
391ms

Document
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

Redirect headers

cache-control: private,max-age=86400
content-length: 108
content-type: text/html; charset=utf-8
date: Fri, 11 Nov 2022 04:46:36 GMT
location: https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H/1.1 200
OK send Show response
sync-dsp.ad-m.asia/dsp/api/sync/ Frame D447 43 B
243 B 1016ms
248ms Document
image/gif 202.131.200.84
BIT-ISLE Equinix ...

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-dsp.ad-m.asia/dsp/api/sync/send?s=pubmatic&rd=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyNTMmdGw9MTI5NjAw%26piggybackCookie%3D
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dpba%26refUrl%3D%26vid%3D81419942253111435947443605000V10%26ovsid%3DPM_UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 202.131.200.84 , Japan, ASN17941 (BIT-ISLE Equinix Japan Enterprise K.K., JP),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Cache-Control: no-store,no-cache
Connection: close
Content-Length: 43
Content-Type: image/gif
Date: Fri, 11 Nov 2022 04:46:36 GMT
Pragma: no-cache
Server: nginx
expires: -1

GET
H2

200

/ Show response
onetag-sys.com/match/ Frame 008C
Redirect Chain

https://gocm.c.appier.net/pubmatic
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=ETgc6mymDHOx9giKqtNtYw
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

0
340 B

392ms
392ms

Document
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

Redirect headers

cache-control: private,max-age=86400
content-length: 108
content-type: text/html; charset=utf-8
date: Fri, 11 Nov 2022 04:46:36 GMT
location: https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

/ Show response
onetag-sys.com/match/ Frame 0B74
Redirect Chain

https://ipac.ctnsnet.com/int/cm?exc=14&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA%3D%26piggybackCookie%3D%5Buser_id%5D
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=19b92c9bb22748c6a53e901a6415a669
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

0
340 B

398ms
394ms

Document
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

Redirect headers

cache-control: private,max-age=86400
content-length: 108
content-type: text/html; charset=utf-8
date: Fri, 11 Nov 2022 04:46:36 GMT
location: https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 cm Show response
ipac.ctnsnet.com/int/ Frame 4F2B 43 B
369 B 594ms
276ms Document
image/gif 35.186.193.173
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ipac.ctnsnet.com/int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id]
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dpba%26refUrl%3D%26vid%3D81419942253111435947443605000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.193.173 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 173.193.186.35.bc.googleusercontent.com
Software: Apache-Coyote/1.1 /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 43
content-type: image/gif
date: Fri, 11 Nov 2022 04:46:35 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="NOI DSP COR NID CUR OUR NOR"
pragma: no-cache
server: Apache-Coyote/1.1
via: 1.1 google

GET
H/1.1 200
OK pxd Show response
dps.jp.cinarra.com/ Frame F597 95 B
220 B 1019ms
247ms Document
image/png 18.176.115.166
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dps.jp.cinarra.com/pxd?PLATFORM_ID=D&USER_ID=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dpba%26refUrl%3D%26vid%3D81419942253111435947443605000V10%26ovsid%3DPM_UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.176.115.166 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-176-115-166.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Connection: keep-alive
Content-Length: 95
Content-Type: image/png
Date: Fri, 11 Nov 2022 04:46:36 GMT

GET
H2

200

/ Show response
onetag-sys.com/match/ Frame 92D0
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:mnUB4g691OTlW35&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

0
340 B

395ms
393ms

Document
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

Redirect headers

cache-control: private,max-age=86400
content-length: 108
content-type: text/html; charset=utf-8
date: Fri, 11 Nov 2022 04:46:36 GMT
location: https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 bridge Show response
cm.adgrx.com/ Frame 5B72 0
230 B 739ms
237ms Document
text/plain 52.74.118.249
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dpba%26refUrl%3D%26vid%3D81419942253111435947443605000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.74.118.249 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-74-118-249.ap-southeast-1.compute.amazonaws.com
Software: Cowboy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, proxy-revalidate
content-length: 0
date: Fri, 11 Nov 2022 04:46:36 GMT
expires: Thu, 23 Sep 2004 17:42:04 GMT
p3p: CP="NOI OTC OTP OUR NOR"
pragma: no-cache
server: Cowboy
x-realserver-nx: aws-apsoutheast1b-delivery-2

GET
H2

200

RX-696a581e-8d06-4a82-8bcb-7fe19581bee0-004 Show response
sync.targeting.unrulymedia.com/csync/ Frame C96A
Redirect Chain

https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=3363239122
https://sync.1rx.io/usersync/tradedesk/1bc1ccf6-de8d-48ed-908c-c2e129bce8ed
https://sync.targeting.unrulymedia.com/csync/RX-696a581e-8d06-4a82-8bcb-7fe19581bee0-004

43 B
377 B

772ms
384ms

Document
image/gif

74.118.186.45
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-696a581e-8d06-4a82-8bcb-7fe19581bee0-004
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dpba%26refUrl%3D%26vid%3D81419942253111435947443605000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 74.118.186.45 Serangoon, Singapore, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

content-length: 43
date: Fri, 11 Nov 2022 04:46:37 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

cache-control: no-store, no-cache, must-revalidate
content-type: text/html
date: Fri, 11 Nov 2022 04:46:36 GMT
expires: 0
location: https://sync.targeting.unrulymedia.com/csync/RX-696a581e-8d06-4a82-8bcb-7fe19581bee0-004
pragma: no-cache

GET
H2

200

i.match Show response
s.tribalfusion.com/z/ Frame 19F9
Redirect Chain

https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATI...
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMA...

43 B
412 B

269ms
263ms

Document
image/gif

104.18.24.173
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dpba%26refUrl%3D%26vid%3D81419942253111435947443605000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.173 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 76846295bbb6eea2-AKL
content-length: 43
content-type: image/gif; charset=utf-8
date: Fri, 11 Nov 2022 04:46:36 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 302

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 768462940966eea2-AKL
content-type: text/html
date: Fri, 11 Nov 2022 04:46:36 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 206
x-reuse-index: 541

GET
H/1.1 200
OK cookiesync Show response
core.iprom.net/ Frame E2F0 43 B
279 B 1647ms
414ms Document
image/gif 195.5.165.20
IPROM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://core.iprom.net/cookiesync?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dpba%26refUrl%3D%26vid%3D81419942253111435947443605000V10%26ovsid%3DPM_UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 195.5.165.20 , Slovenia, ASN44968 (IPROM-AS, SI),
Reverse DNS
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Connection: close
Content-Length: 43
Content-Type: image/gif
Date: Fri, 11 Nov 2022 04:46:37 GMT
Vary: Accept-Encoding
X-adserver-worker: komodo-bb893ccc65bd@version_1.530v3
X-core-time: 0ms
X-server-arch: v2

GET /
csync.loopme.me/ Frame 156C 0
0

GET
H2 200 cksync.php Show response
contextual.media.net/ Frame 4989 45 B
468 B 313ms
292ms Document
image/gif 104.71.48.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3111435947443605000V10&type=pba&refUrl=&vid=81419942253111435947443605000V10&ovsid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.71.48.26 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-length: 45
content-type: image/gif
date: Fri, 11 Nov 2022 04:46:36 GMT
expires: Fri, 11 Nov 2022 04:46:36 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA" CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
pragma: no-cache
server: Apache
strict-transport-security: max-age=31536000
x-mnet-hl2: E

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame AE15
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=-enOS0ksQfaf_RCSiv4aEA%3D%3D&gdpr=0&gdpr_consent=
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

13 KB
13 KB

281ms
281ms

Image
text/html

23.78.217.19
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dpba%26refUrl%3D%26vid%3D81419942253111435947443605000V10%26ovsid%3DPM_UID
Protocol: H2
Server: 23.78.217.19 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-78-217-19.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:36 GMT
content-encoding: gzip
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
server: Apache
etag: "1300708-3de4-5d6ef246ef4cf"
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=32257
accept-ranges: bytes
content-length: 5549
expires: Fri, 11 Nov 2022 13:44:13 GMT

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:35 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

458249.gif
idsync.rlcdn.com/ Frame AE15
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10
https://pippio.com/api/sync?pid=5324&it=1&iv=e38eebd2c9a71c30b4a9419be0404d471e66697ab511f71da4ab24b1e792e0c0791426b5417dce21&_=2
https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlBlMzhlZWJkMmM5YTcxYzMwYjRhOTQxOWJlMDQwNGQ0NzFlNjY2OTdhYjUxMWY3MWRhNGFiMjRiMWU3OTJlMGMwNzkxNDI2YjU...
https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlBlMzhlZWJkMmM5YTcxYzMwYjRhOTQxOWJlMDQwNGQ0NzFlNjY2OTdhYjUxMWY3MWRhNGFiMjRiMWU3OTJlMGMwNzkxNDI2YjU0MTdkY2UyMRAAGgwIrKe3mwYSBAgCEABCAEoA&goog...
https://tags.rd.linksynergy.com/rcs?ns=lr&uid3=
https://idsync.rlcdn.com/458249.gif?partner_uid=d58134fd-fefd-4f35-ba84-50b8b32d8dc7

42 B
60 B

320ms
320ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/458249.gif?partner_uid=d58134fd-fefd-4f35-ba84-50b8b32d8dc7
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dpba%26refUrl%3D%26vid%3D81419942253111435947443605000V10%26ovsid%3DPM_UID
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:38 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

location: https://idsync.rlcdn.com/458249.gif?partner_uid=d58134fd-fefd-4f35-ba84-50b8b32d8dc7
date: Fri, 11 Nov 2022 04:46:38 GMT
via: 1.1 google
x-samesite: secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 111
content-type: text/html; charset=utf-8

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame AE15
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=635a636d-d3aa-4200-b3a0-f12363f77230

0
260 B

707ms
235ms

Image
text/plain

67.199.150.85
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=635a636d-d3aa-4200-b3a0-f12363f77230
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dpba%26refUrl%3D%26vid%3D81419942253111435947443605000V10%26ovsid%3DPM_UID
Protocol: H2
Server: 67.199.150.85 Los Angeles, United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:36 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Fri, 11 Nov 2022 04:46:35 GMT
Server: MT3 4629 97bee97 master nrt-pixel-x14 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=635a636d-d3aa-4200-b3a0-f12363f77230
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Fri, 11 Nov 2022 04:46:34 GMT

GET
H2

200

/
onetag-sys.com/match/ Frame AE15
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RjlFOUNFNEItNDkyQy00MUY2LTlGRkQtMTA5MjhBRkUxQTEw&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

0
340 B

394ms
392ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

Requested by

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10
date: Fri, 11 Nov 2022 04:46:37 GMT
cache-control: private,max-age=86400
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 108
content-type: text/html; charset=utf-8

GET
H2

200

/
onetag-sys.com/match/ Frame AE15
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEGyZgvgME86Q0h_OFbclgvA&google_cver=1
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

0
340 B

393ms
392ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

Requested by

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10
date: Fri, 11 Nov 2022 04:46:00 GMT
cache-control: private,max-age=86400
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 108
content-type: text/html; charset=utf-8

GET
H2

200

/
onetag-sys.com/match/ Frame AE15
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:DEA4A601E7C34F7B8A65CB6EF47D4DCC
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

0
340 B

393ms
391ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

Requested by

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

ec2-18-141-128-115.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10
date: Fri, 11 Nov 2022 04:46:01 GMT
cache-control: private,max-age=86400
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 108
content-type: text/html; charset=utf-8

GET
H2 200 F9E9CE4B-492C-41F6-9FFD-10928AFE1A10
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame AE15 43 B
601 B 274ms
240ms Image
image/gif 18.141.128.115
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/F9E9CE4B-492C-41F6-9FFD-10928AFE1A10?gdpr=0&gdpr_consent=

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.141.128.115 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:35 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame AE15
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed&gdpr=0&gdpr_consent=

42 B
294 B

708ms
236ms

Image
image/gif

67.199.150.86
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dpba%26refUrl%3D%26vid%3D81419942253111435947443605000V10%26ovsid%3DPM_UID
Protocol: H2
Server: 67.199.150.86 Los Angeles, United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Fri, 11 Nov 2022 04:46:36 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:35 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 355

GET
H2

200

/
onetag-sys.com/match/ Frame AE15
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=2057151992493556101
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

0
340 B

395ms
395ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10

Requested by

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=114&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10
date: Fri, 11 Nov 2022 04:46:36 GMT
cache-control: private,max-age=86400
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 108
content-type: text/html; charset=utf-8

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame AE15
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://dsp.nrich.ai/bidswitch/sync?bidswitch_ssp_id=pubmatic&bsw_custom_parameter=397a0df4-c51f-47bf-845f-0bfb88f30687&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=
https://x.bidswitch.net/sync?dsp_id=283&user_id=0204438a-154e-4391-81e1-818bd70790f4&expires=1&user_group=5&ssp=pubmatic&bsw_param=397a0df4-c51f-47bf-845f-0bfb88f30687
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=397a0df4-c51f-47bf-845f-0bfb88f30687&gdpr=&gdpr_consent=&gdpr_pd=

1 B
246 B

236ms
235ms

Image
text/html

67.199.150.86
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=397a0df4-c51f-47bf-845f-0bfb88f30687&gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dpba%26refUrl%3D%26vid%3D81419942253111435947443605000V10%26ovsid%3DPM_UID
Protocol: H2
Server: 67.199.150.86 Los Angeles, United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Fri, 11 Nov 2022 04:46:38 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=397a0df4-c51f-47bf-845f-0bfb88f30687&gdpr=&gdpr_consent=&gdpr_pd=
Date: Fri, 11 Nov 2022 04:46:38 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame AE15
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-qvwpIY1E2uXAKvf2om65O7m24sK7DUQ-~A&gdpr=0&gdpr_consent=

0
128 B

236ms
235ms

Image
text/plain

67.199.150.85
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-qvwpIY1E2uXAKvf2om65O7m24sK7DUQ-~A&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dpba%26refUrl%3D%26vid%3D81419942253111435947443605000V10%26ovsid%3DPM_UID
Protocol: H2
Server: 67.199.150.85 Los Angeles, United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:37 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-qvwpIY1E2uXAKvf2om65O7m24sK7DUQ-~A&gdpr=0&gdpr_consent=
date: Fri, 11 Nov 2022 04:46:36 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame AE15
Redirect Chain

https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=3680859315881377104

42 B
95 B

235ms
235ms

Image
image/gif

67.199.150.86
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=3680859315881377104
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dpba%26refUrl%3D%26vid%3D81419942253111435947443605000V10%26ovsid%3DPM_UID
Protocol: H2
Server: 67.199.150.86 Los Angeles, United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Fri, 11 Nov 2022 04:46:37 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Fri, 11 Nov 2022 04:46:37 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 116.90.74.196; 116.90.74.196; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: a39c63a2-ed46-4274-aea3-dd159ff8879a
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=3680859315881377104
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame AE15
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2777667461208195544&gdpr=0&gdpr_consent=&us_privacy=

1 B
255 B

235ms
235ms

Image
text/html

67.199.150.86
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2777667461208195544&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dpba%26refUrl%3D%26vid%3D81419942253111435947443605000V10%26ovsid%3DPM_UID
Protocol: H2
Server: 67.199.150.86 Los Angeles, United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Fri, 11 Nov 2022 04:46:37 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2777667461208195544&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Fri, 11 Nov 2022 04:46:36 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame AE15
Redirect Chain

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=325fa4a18b8020a8&is_secure=true&networkId=17100&version=1&nuid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAMTBVrh1uqRwNBEhTNAAAAAAA&expiration=1668228399&nuid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10&...

42 B
345 B

237ms
236ms

Image
image/gif

67.199.150.86
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAMTBVrh1uqRwNBEhTNAAAAAAA&expiration=1668228399&nuid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dpba%26refUrl%3D%26vid%3D81419942253111435947443605000V10%26ovsid%3DPM_UID
Protocol: H2
Server: 67.199.150.86 Los Angeles, United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Fri, 11 Nov 2022 04:46:39 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:39 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAMTBVrh1uqRwNBEhTNAAAAAAA&expiration=1668228399&nuid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10&is_secure=true&gdpr_consent=&gdpr=0
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H2 200 d1ba4609
rtb.gumgum.com/getuid/ Frame AE15 35 B
209 B 739ms
243ms Image
image/gif 35.72.214.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/getuid/d1ba4609?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw%26piggybackCookie%3D
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dpba%26refUrl%3D%26vid%3D81419942253111435947443605000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.72.214.213 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-72-214-213.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:38 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

GET
H2 200 pixel
edce82ca-49f3-4338-a029-73e3c0c320f3.t.ssp.hinet.net/ Frame 3F32 0
79 B 383ms
294ms Image
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://edce82ca-49f3-4338-a029-73e3c0c320f3.t.ssp.hinet.net/pixel?bd=edce82ca-49f3-4338-a029-73e3c0c320f3&t=50ef57&referrer=https%3A%2F%2Fwww.bg3.co

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:36 GMT
strict-transport-security: max-age=0
server: nginx
content-length: 0
content-type: image/png

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame 3F32 0
189 B 300ms
291ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=1854-1rrzahWCu6AIS59nm5OKx2miLWnjqAHD&mp=edce82ca-49f3-4338-a029-73e3c0c320f3

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:36 GMT
strict-transport-security: max-age=0
server: nginx
vary: Origin
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, private
access-control-allow-credentials: true

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 3F99 33 KB
10 KB 310ms
310ms Script
text/html 23.75.85.227
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.75.85.227 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-75-85-227.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 701e63b36146442c60d37618e26c0a0d8efd675766377047a5f96c2d953f119c

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:36 GMT
Content-Encoding: gzip
Last-Modified: Fri, 11 Nov 2022 00:59:42 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=72786
Connection: keep-alive
Content-Length: 9884
Expires: Sat, 12 Nov 2022 00:59:42 GMT

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 315ms
270ms Ping
text/plain 142.250.4.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-Z0TZ7TDHS1&gtm=2oeb90&_p=7888&cid=1042930634.1668141991&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=2&sid=1668141990&sct=1&seg=0&dl=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&dt=%E5%9C%B0%E7%90%83%E9%A6%96%E4%BD%8D%E5%B7%B2%E7%9F%A5%E6%98%9F%E9%9A%9B%E8%A8%AA%E5%AE%A2%E7%8D%B2%E7%A2%BA%E8%AA%8D%20-%20%E5%A4%A9%E5%A4%A9%E8%A6%81%E8%81%9E&en=link_preview&_ee=1&epn.value=1&epn.siteid=42753&ep.error_msg=no_mapping_failed&_et=3
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-Z0TZ7TDHS1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.4.138 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sm-in-f138.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:37 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 3F99
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&khaos=LAC0O423-1K-IQAL
https://usersync.gumgum.com/usersync?b=mag&i=LAC0O423-1K-IQAL

35 B
250 B

375ms
243ms

Image
image/gif

13.112.54.241
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=mag&i=LAC0O423-1K-IQAL
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Server: 13.112.54.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-112-54-241.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 11 Nov 2022 04:46:36 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://usersync.gumgum.com/usersync?b=mag&i=LAC0O423-1K-IQAL
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 38ddff6a66d3988dfd0c6ea3be81c5f1
Expires: 0

GET
H/1.1 200
OK ad-s.css
s3-ap-southeast-2.amazonaws.com/adtrek/7387f6fa-a109-45b5-9a4f-d45813c5ad8b/ Frame 7C2D 549 B
642 B 154ms
154ms Stylesheet
text/css 52.95.129.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/7387f6fa-a109-45b5-9a4f-d45813c5ad8b/ad-s.css
Requested by: Host: www.adtrek.co
URL: https://www.adtrek.co/adserver/frm?cc=32c8794c-79f1-49bb-a03f-85569be09a9f&clk=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCNM5XptNtY_KXLL_mz7sPw5KGiAPSsKT5bPfi_MeUEb_N9fyaLRABILqEwDNgq-yxheAYoAGwgquTAcgBCakCkH4H2_wxpD6oAwGqBPEBT9CSguzHfUkAq6IzG8ExV6kFkoONOdgXlPee5Hoqqx0wT4BIVP3dCx8x9WgqpOusFrQ93ErG09QaZ32s1NJig6tIoq8-9sk4r7sAGVFdTGwwPnULQVbepBPkmnNj6FrGb-h7UL1gyqv-8euSqdILYEwz1jcrTDpyzqwXhOToI8oBKfnBocyYf2M0iOCaCPj4o2YBNGQIzHq12YTKHV-opmUmfVXjDtWCPELKv3ed1xg1CS_ZEUKHXD4S724UzxcXneimct5XwGfMTUtgyZYmJYU2519s2yHB_0FzlkqBVKrxwMEqkPp85w0UjPuBlSwzwMAEze_J7IYE4AQDkAYBoAZNgAe4_dTsAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgGEQARgdMgKKAjoCgEDyCBthZHgtc3Vic3luLTUyMzk5MzgyMTM4NzAzODCACgOYCwHICwGADAGwE9vp8RDIE7eMpOED0BMA2BMK2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9D1OUO62QOb7sr66XT4QCAc6gGRkHYi1qr0S__aPdP-aPhvbhjOFm_70kTKXeRDLPGqZCSrxpGAEgEw%26sig%3DAOD64_3-z_XYl25mDV_X5Jrm6Hx4s_49tg%26client%3Dca-pub-8933329999391104%26dbm_c%3DAKAmf-Bhb7WnPP7_QB_ysexA7T8kXDNDYsxagqKkaMz06HCcWZF_kdCxW1Ub_CEG2n99dAl__Z7cdgQbKdtYhpoRPBUMDDt0yx34NtxQsBlZQ1ZtXQ-BohFcyDD0guLORGNTdSi5_zSUF76Ghpdu7DqiKvFAOUCMuuBDIGxzS8C216th0Gr6xlU%26cry%3D1%26dbm_d%3DAKAmf-BZklHQByQhP1Z1xgI29jLUfCKPEK7gATj8_rrVO6_UIt1aNclTbcijE_h8yrXMLaYpusPdWPMtgNbg42b2tYRwH5OENsu02LGe7CN4qUmZ7aPLcB76lcaInld_e4GtqynCAP4Gqf6pIF-nk2r1uXCZpt_8PnLNXvoyc2TWD_V6T1nceHHzlhdcYTncI61FgITXSGVxsNvkC0mNIkJ8LTsWz8Q9UM3RGZQ-O9ikh3x_FcwDKAiMl3mOMTbbM_ByQeY6Lweerk5YFy8zfGyEgzDLTr_3c6vB9Uh0ZyFC-xV9zL8_0bhDxQ2rFH9QFklJbJfik7pK-Ju6KP52qvQnPRLMgJ3oRg1JxMQGb-EaSlAPAnHvX4fzFMPxt6nJ1Z2LVdxBfKuH0P4191C-lcwQUy0PVgpprp2zy2EI-ABWnbjpuLOF9nfo0SU6p271kS7-5l42n6X2uDAccOHQ07XR1AemP-LYWpyy7Txj8U_OLWe3744aob0sME_gxSsLTVSYd2fwdP_cIqiLsGsxCltxOLyrClUGQrH2Nx-cPcqe4bPYYhDrD4othhYWYoydJFYVPJIBke7KcNCc2eW4XC7SyXv62XHhDs2xjgx2mktr_57KY48X_FU%26adurl%3Dhttps%3a%2f%2fwww.adtrek.co%2fadserver%2fclick%3fcc%3d32c8794c-79f1-49bb-a03f-85569be09a9f&ord=1668141990723954
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.129.116 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 3affb7138a23846fc1abd98ec56528e801dc9967fa0a9115c5ed4d80aa511183

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:37 GMT
Content-Encoding: gzip
Last-Modified: Wed, 12 Oct 2022 01:38:25 GMT
Server: AmazonS3
x-amz-request-id: 4CVDWPZV5W6SMPMC
ETag: "fff088d095049a532e08414ffbf79c8b"
x-amz-meta-info: inline html5 ForScript
Content-Type: text/css
Accept-Ranges: bytes
Content-Length: 222
x-amz-id-2: rLCZBD5vh7e9h2HqOAYcNFeEjvbfUvs615Dz5l6n2GkGL/mFvrXuSjx3lvcVqLqyU9NxwfubALk=

GET
H/1.1 200
OK hype_generated_script.js Show response
s3-ap-southeast-2.amazonaws.com/adtrek/7387f6fa-a109-45b5-9a4f-d45813c5ad8b/ Frame 7C2D 31 KB
7 KB 312ms
158ms Script
application/x-javascript 52.95.129.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/7387f6fa-a109-45b5-9a4f-d45813c5ad8b/hype_generated_script.js?497
Requested by: Host: www.adtrek.co
URL: https://www.adtrek.co/adserver/frm?cc=32c8794c-79f1-49bb-a03f-85569be09a9f&clk=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCNM5XptNtY_KXLL_mz7sPw5KGiAPSsKT5bPfi_MeUEb_N9fyaLRABILqEwDNgq-yxheAYoAGwgquTAcgBCakCkH4H2_wxpD6oAwGqBPEBT9CSguzHfUkAq6IzG8ExV6kFkoONOdgXlPee5Hoqqx0wT4BIVP3dCx8x9WgqpOusFrQ93ErG09QaZ32s1NJig6tIoq8-9sk4r7sAGVFdTGwwPnULQVbepBPkmnNj6FrGb-h7UL1gyqv-8euSqdILYEwz1jcrTDpyzqwXhOToI8oBKfnBocyYf2M0iOCaCPj4o2YBNGQIzHq12YTKHV-opmUmfVXjDtWCPELKv3ed1xg1CS_ZEUKHXD4S724UzxcXneimct5XwGfMTUtgyZYmJYU2519s2yHB_0FzlkqBVKrxwMEqkPp85w0UjPuBlSwzwMAEze_J7IYE4AQDkAYBoAZNgAe4_dTsAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgGEQARgdMgKKAjoCgEDyCBthZHgtc3Vic3luLTUyMzk5MzgyMTM4NzAzODCACgOYCwHICwGADAGwE9vp8RDIE7eMpOED0BMA2BMK2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9D1OUO62QOb7sr66XT4QCAc6gGRkHYi1qr0S__aPdP-aPhvbhjOFm_70kTKXeRDLPGqZCSrxpGAEgEw%26sig%3DAOD64_3-z_XYl25mDV_X5Jrm6Hx4s_49tg%26client%3Dca-pub-8933329999391104%26dbm_c%3DAKAmf-Bhb7WnPP7_QB_ysexA7T8kXDNDYsxagqKkaMz06HCcWZF_kdCxW1Ub_CEG2n99dAl__Z7cdgQbKdtYhpoRPBUMDDt0yx34NtxQsBlZQ1ZtXQ-BohFcyDD0guLORGNTdSi5_zSUF76Ghpdu7DqiKvFAOUCMuuBDIGxzS8C216th0Gr6xlU%26cry%3D1%26dbm_d%3DAKAmf-BZklHQByQhP1Z1xgI29jLUfCKPEK7gATj8_rrVO6_UIt1aNclTbcijE_h8yrXMLaYpusPdWPMtgNbg42b2tYRwH5OENsu02LGe7CN4qUmZ7aPLcB76lcaInld_e4GtqynCAP4Gqf6pIF-nk2r1uXCZpt_8PnLNXvoyc2TWD_V6T1nceHHzlhdcYTncI61FgITXSGVxsNvkC0mNIkJ8LTsWz8Q9UM3RGZQ-O9ikh3x_FcwDKAiMl3mOMTbbM_ByQeY6Lweerk5YFy8zfGyEgzDLTr_3c6vB9Uh0ZyFC-xV9zL8_0bhDxQ2rFH9QFklJbJfik7pK-Ju6KP52qvQnPRLMgJ3oRg1JxMQGb-EaSlAPAnHvX4fzFMPxt6nJ1Z2LVdxBfKuH0P4191C-lcwQUy0PVgpprp2zy2EI-ABWnbjpuLOF9nfo0SU6p271kS7-5l42n6X2uDAccOHQ07XR1AemP-LYWpyy7Txj8U_OLWe3744aob0sME_gxSsLTVSYd2fwdP_cIqiLsGsxCltxOLyrClUGQrH2Nx-cPcqe4bPYYhDrD4othhYWYoydJFYVPJIBke7KcNCc2eW4XC7SyXv62XHhDs2xjgx2mktr_57KY48X_FU%26adurl%3Dhttps%3a%2f%2fwww.adtrek.co%2fadserver%2fclick%3fcc%3d32c8794c-79f1-49bb-a03f-85569be09a9f&ord=1668141990723954
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.129.116 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: c156e2771927ce196034439e75f43effeb52ad6875d40bd12daf6f8124a8d445

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:37 GMT
Content-Encoding: gzip
Last-Modified: Wed, 12 Oct 2022 01:38:25 GMT
Server: AmazonS3
x-amz-request-id: 4CV349ZEADP5EA5Q
ETag: "3d9647ddaddf09c9cf8fe85132809967"
x-amz-meta-info: main HYPE file
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Length: 7156
x-amz-id-2: 4uRNYcTPzo3GvgAmUndZB2MAjFIGkZ5IM4fgpMr+HfeFLkWeWJyQYr+8mcppkE2005qG7o++ojM=

GET
H/1.1 200
OK HYPE-740.thin.min.js Show response
s3-ap-southeast-2.amazonaws.com/adtrek/7387f6fa-a109-45b5-9a4f-d45813c5ad8b/ Frame 7C2D 56 KB
25 KB 154ms
154ms Script
application/x-javascript 52.95.129.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/7387f6fa-a109-45b5-9a4f-d45813c5ad8b/HYPE-740.thin.min.js
Requested by: Host: s3-ap-southeast-2.amazonaws.com
URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/7387f6fa-a109-45b5-9a4f-d45813c5ad8b/hype_generated_script.js?497
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.129.116 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 1b672d771ea2e2d6cf15df45fa4978c98d571b4521e5ebedb7b060e65577c127

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:37 GMT
Content-Encoding: gzip
Last-Modified: Wed, 12 Oct 2022 01:38:25 GMT
Server: AmazonS3
x-amz-request-id: 4CV6DT5Z0E4AS5Y0
ETag: "9e7db1868051997b3db193c0cefceb81"
x-amz-meta-info: HYPE file
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Length: 24698
x-amz-id-2: IFpD/uo9A5t0dNhQDX8/gSd3xTdqZ/mGKfANk4G2gv09vtNI2HdzdUWOJnZpDnYg2zSvVtZ0Fac=

GET
H2 200 chtmp.php
ccm.holmesmind.com/ Frame A293 0
216 B 1037ms
542ms Image
text/html 54.178.200.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ccm.holmesmind.com/chtmp.php?u=https%3A%2F%2Fapi.cf.dsp.hinet.net%2Fcktagv2.php%3FUID%3D294809-1RJvsDAbN6ETpKGQafQuLXRIVzZ0zlr1%26SID%3D55976%26Tags%3D2527%2C2621%2C2583%2C2618%2C2091%2C2090%2C2390%2C2391%2C2304%2C2307
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.178.200.1 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-178-200-1.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: https://www.bg3.co
date: Fri, 11 Nov 2022 04:46:37 GMT
content-encoding: gzip
access-control-allow-credentials: true
server: nginx/1.14.0 (Ubuntu)
vary: Accept-Encoding
content-type: text/html; charset=UTF-8

GET
H2 200 chtmp.php
ccm.holmesmind.com/ Frame A293 0
217 B 994ms
523ms Image
text/html 54.178.200.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ccm.holmesmind.com/chtmp.php?u=https%3A%2F%2Fapi.cf.dsp.hinet.net%2Fcktagv2.php%3FUID%3D294809-1RJvsDAbN6ETpKGQafQuLXRIVzZ0zlr1%26SID%3D55974%26Tags%3D2390%2C2352%2C2391%2C2903
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.178.200.1 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-178-200-1.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: https://www.bg3.co
date: Fri, 11 Nov 2022 04:46:37 GMT
content-encoding: gzip
access-control-allow-credentials: true
server: nginx/1.14.0 (Ubuntu)
vary: Accept-Encoding
content-type: text/html; charset=UTF-8

GET
H2 200 chtmp.php
ccm.holmesmind.com/ Frame EDCB 0
216 B 901ms
530ms Image
text/html 54.178.200.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ccm.holmesmind.com/chtmp.php?u=https%3A%2F%2Fapi.cf.dsp.hinet.net%2Fcktagv2.php%3FUID%3D294809-1RJvsDAbN6ETpKGQafQuLXRIVzZ0zlr1%26SID%3D55976%26Tags%3D2527%2C2621%2C2583%2C2618%2C2091%2C2090%2C2390%2C2391%2C2304%2C2307
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.178.200.1 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-178-200-1.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: https://www.bg3.co
date: Fri, 11 Nov 2022 04:46:37 GMT
content-encoding: gzip
access-control-allow-credentials: true
server: nginx/1.14.0 (Ubuntu)
vary: Accept-Encoding
content-type: text/html; charset=UTF-8

GET
H2 200 chtmp.php
ccm.holmesmind.com/ Frame EDCB 0
216 B 837ms
538ms Image
text/html 54.178.200.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ccm.holmesmind.com/chtmp.php?u=https%3A%2F%2Fapi.cf.dsp.hinet.net%2Fcktagv2.php%3FUID%3D294809-1RJvsDAbN6ETpKGQafQuLXRIVzZ0zlr1%26SID%3D55974%26Tags%3D2390%2C2352%2C2391%2C2903
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.178.200.1 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-178-200-1.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: https://www.bg3.co
date: Fri, 11 Nov 2022 04:46:37 GMT
content-encoding: gzip
access-control-allow-credentials: true
server: nginx/1.14.0 (Ubuntu)
vary: Accept-Encoding
content-type: text/html; charset=UTF-8

GET
H2 200 css
fonts.googleapis.com/ Frame 7C2D 986 B
507 B 579ms
278ms Stylesheet
text/css 74.125.24.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Alkalami&subset=latin

Requested by

Host: s3-ap-southeast-2.amazonaws.com
URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/7387f6fa-a109-45b5-9a4f-d45813c5ad8b/HYPE-740.thin.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f95.1e100.net

Software

ESF /

Resource Hash

f3ebfd3bcea84282729c9026fc76647b7bd47fe90e58732e1a4404e4b3f7d2b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 11 Nov 2022 04:46:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 11 Nov 2022 04:46:37 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 11 Nov 2022 04:46:37 GMT

GET
H/1.1 200
OK van_welkam_logo.svg
s3-ap-southeast-2.amazonaws.com/adtrek/7387f6fa-a109-45b5-9a4f-d45813c5ad8b/ Frame 7C2D 77 KB
22 KB 155ms
154ms Image
image/svg+xml 52.95.129.116
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/7387f6fa-a109-45b5-9a4f-d45813c5ad8b/van_welkam_logo.svg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.129.116 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: c44d01dcc4b5ec2d67d2a22a65507a24f24b2c95efa5fb3bd370dace12515d69

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:38 GMT
Content-Encoding: gzip
Last-Modified: Wed, 12 Oct 2022 01:38:25 GMT
Server: AmazonS3
x-amz-request-id: SKCPSKX7HSEBWJ8G
ETag: "96759fdcbaf3c91daf647466f0c91cc3"
x-amz-meta-info: resource files
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 22006
x-amz-id-2: Ntra+2oHZDr3elc+eMv6jQ6RMPKOjwrYp6gyIJnLFWQ5bGnjqIptZ8IwXMuLRM7GElRyw/sjsUE=

GET
H/1.1 200
OK Experience%20BTN.svg
s3-ap-southeast-2.amazonaws.com/adtrek/7387f6fa-a109-45b5-9a4f-d45813c5ad8b/ Frame 7C2D 9 KB
3 KB 156ms
154ms Image
image/svg+xml 52.95.129.116
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/7387f6fa-a109-45b5-9a4f-d45813c5ad8b/Experience%20BTN.svg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.129.116 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 3eff40b5baa173579a18a83e983bc913aa99df9cdde0df72849e6c9309c5ab88

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:38 GMT
Content-Encoding: gzip
Last-Modified: Wed, 12 Oct 2022 01:38:24 GMT
Server: AmazonS3
x-amz-request-id: SKCJ31KNMK1M1NG5
ETag: "6e9e34eefd6a9eb35a7a4da3a5372ccc"
x-amz-meta-info: resource files
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 2534
x-amz-id-2: b+CLnvNgny8XQJ2MS65HpxLz+YT8RuwuXW44g5omhQP/UhCdgN37LJf/uGbzH9OWIKyw9KxXkvQ=

GET
H/1.1 200
OK Youre%20invited.svg
s3-ap-southeast-2.amazonaws.com/adtrek/7387f6fa-a109-45b5-9a4f-d45813c5ad8b/ Frame 7C2D 206 KB
34 KB 308ms
152ms Image
image/svg+xml 52.95.129.116
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/7387f6fa-a109-45b5-9a4f-d45813c5ad8b/Youre%20invited.svg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.129.116 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 682ffa5a005176cfbe0c4e5e062b7d9aa5e406c4031e289a4c220d1c00211642

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:38 GMT
Content-Encoding: gzip
Last-Modified: Wed, 12 Oct 2022 01:38:25 GMT
Server: AmazonS3
x-amz-request-id: SKCX3D8JQRR0XYTW
ETag: "e9a3e2a0f2f489ba28339460153e64f5"
x-amz-meta-info: resource files
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 34234
x-amz-id-2: XkD+1K3Mr4FmuRcwB9B+S7xNjEvyWXFcPpo3LoNYhCcK+O9dGRiv2ylHeOdVPSGVJPjdnScH5Lk=

GET
H/1.1 200
OK Arrow_1.svg
s3-ap-southeast-2.amazonaws.com/adtrek/7387f6fa-a109-45b5-9a4f-d45813c5ad8b/ Frame 7C2D 473 B
754 B 309ms
153ms Image
image/svg+xml 52.95.129.116
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/7387f6fa-a109-45b5-9a4f-d45813c5ad8b/Arrow_1.svg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.129.116 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: be524e23870aef024868b813321f41497da19f0eac18c195fa22865f5027c555

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:38 GMT
Content-Encoding: gzip
Last-Modified: Wed, 12 Oct 2022 01:38:24 GMT
Server: AmazonS3
x-amz-request-id: SKCXYRP68JTWVPQR
ETag: "7eba75f19981f3d2ddf658dcc42973d1"
x-amz-meta-info: resource files
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 337
x-amz-id-2: +obTORkbVmPploe3MhMdwnIN2Nt2dWPhAUgMQ+ng+f54Vca0+oNz+wyoetBK8VTEYJetXC91d0c=

GET
H/1.1 200
OK van_welkam_logo.svg
s3-ap-southeast-2.amazonaws.com/adtrek/7387f6fa-a109-45b5-9a4f-d45813c5ad8b/ Frame 7C2D 77 KB
22 KB 155ms
154ms Image
image/svg+xml 52.95.129.116
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/7387f6fa-a109-45b5-9a4f-d45813c5ad8b/van_welkam_logo.svg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.129.116 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: c44d01dcc4b5ec2d67d2a22a65507a24f24b2c95efa5fb3bd370dace12515d69

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:38 GMT
Content-Encoding: gzip
Last-Modified: Wed, 12 Oct 2022 01:38:25 GMT
Server: AmazonS3
x-amz-request-id: SKCKKJYEJCJHYK9R
ETag: "96759fdcbaf3c91daf647466f0c91cc3"
x-amz-meta-info: resource files
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 22006
x-amz-id-2: oNQXYLtGv8SqmYGLqS8xzEc5fvnRkLN26eMnRedPOHqq79IV+2Hn07nKNkQyUW+Fsqndt9tum5k=

GET
H/1.1 200
OK 300x250-bungalow.jpg
s3-ap-southeast-2.amazonaws.com/adtrek/d2653d59-0488-404e-a515-ea99c7e389c3/bc6ba6f0-d4ea-40c9-a9a3-83601911d4aa/ Frame 7C2D 78 KB
77 KB 161ms
159ms Image
image/jpeg 52.95.129.116
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/d2653d59-0488-404e-a515-ea99c7e389c3/bc6ba6f0-d4ea-40c9-a9a3-83601911d4aa/300x250-bungalow.jpg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.129.116 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: d2187ce826f2afaa50bfe067ee39423e6e8ce003d82b0c236076f972cd97185b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:38 GMT
Content-Encoding: gzip
Last-Modified: Wed, 12 Oct 2022 01:41:44 GMT
Server: AmazonS3
x-amz-request-id: SKCKRSYNQ50MVX5R
ETag: "1fdc20431768782ff88a0325f5e57ea1"
x-amz-meta-info: feed-image
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 78919
x-amz-id-2: r16MqMVm+WRyH6d29lFSMshyyJH9QQlT71cI7ZMtqnyiLr//f9xEXRpoYsQ9MKgzZq240nhkacE=

GET
H/1.1 200
OK Experience%20BTN.svg
s3-ap-southeast-2.amazonaws.com/adtrek/7387f6fa-a109-45b5-9a4f-d45813c5ad8b/ Frame 7C2D 9 KB
3 KB 155ms
152ms Image
image/svg+xml 52.95.129.116
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/7387f6fa-a109-45b5-9a4f-d45813c5ad8b/Experience%20BTN.svg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.129.116 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 3eff40b5baa173579a18a83e983bc913aa99df9cdde0df72849e6c9309c5ab88

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:38 GMT
Content-Encoding: gzip
Last-Modified: Wed, 12 Oct 2022 01:38:24 GMT
Server: AmazonS3
x-amz-request-id: SKCXVHKD79PQ6WPR
ETag: "6e9e34eefd6a9eb35a7a4da3a5372ccc"
x-amz-meta-info: resource files
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 2534
x-amz-id-2: kAWxyBMv5u0/iAuWYbLsF3mtI1ZNxhhx03ZutpzmSV3AXxkdOkBKRQbILMrRKOGXrqAiINT20js=

GET
DATA 200
OK truncated
/ Frame 7C2D 68 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK Youre%20invited.svg
s3-ap-southeast-2.amazonaws.com/adtrek/7387f6fa-a109-45b5-9a4f-d45813c5ad8b/ Frame 7C2D 206 KB
34 KB 156ms
154ms Image
image/svg+xml 52.95.129.116
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/7387f6fa-a109-45b5-9a4f-d45813c5ad8b/Youre%20invited.svg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.129.116 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 682ffa5a005176cfbe0c4e5e062b7d9aa5e406c4031e289a4c220d1c00211642

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:38 GMT
Content-Encoding: gzip
Last-Modified: Wed, 12 Oct 2022 01:38:25 GMT
Server: AmazonS3
x-amz-request-id: SKCNFRPKZ25V3CD7
ETag: "e9a3e2a0f2f489ba28339460153e64f5"
x-amz-meta-info: resource files
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 34234
x-amz-id-2: Ru438HSzK6IkIW4AYGxha67Yonscpp12yYB1Q2BIOgkA1dQA6fgqb8V1mTBIrih1WsDQUNbkOk8=

GET
H/1.1 200
OK 300x250-cave.jpg
s3-ap-southeast-2.amazonaws.com/adtrek/d2653d59-0488-404e-a515-ea99c7e389c3/10466870-7186-4c07-bcd2-f264ffcfd3d8/ Frame 7C2D 38 KB
37 KB 310ms
153ms Image
image/jpeg 52.95.129.116
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/d2653d59-0488-404e-a515-ea99c7e389c3/10466870-7186-4c07-bcd2-f264ffcfd3d8/300x250-cave.jpg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.129.116 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 7b27d72ec213466a9eedc936600d0569188d2ec1a568baabc0836a16f95f4398

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:38 GMT
Content-Encoding: gzip
Last-Modified: Wed, 12 Oct 2022 01:41:48 GMT
Server: AmazonS3
x-amz-request-id: SKCWSXW7DVTZQBAB
ETag: "e4e52234a216dbed36bef68e215239d4"
x-amz-meta-info: feed-image
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 37753
x-amz-id-2: 5pKrh8sxnwAUco0QQ9LOmahBRgv1SryDALC3pNiYGVq5Re5VNJFmf26qiH0cyfrI8NOKyymtTUw=

GET
H/1.1 200
OK Arrow_1.svg
s3-ap-southeast-2.amazonaws.com/adtrek/7387f6fa-a109-45b5-9a4f-d45813c5ad8b/ Frame 7C2D 473 B
754 B 308ms
154ms Image
image/svg+xml 52.95.129.116
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/7387f6fa-a109-45b5-9a4f-d45813c5ad8b/Arrow_1.svg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.129.116 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: be524e23870aef024868b813321f41497da19f0eac18c195fa22865f5027c555

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:38 GMT
Content-Encoding: gzip
Last-Modified: Wed, 12 Oct 2022 01:38:24 GMT
Server: AmazonS3
x-amz-request-id: SKCK03FGYQ71NCWR
ETag: "7eba75f19981f3d2ddf658dcc42973d1"
x-amz-meta-info: resource files
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 337
x-amz-id-2: qQ1KShAFARw0pNfApybH2qFtLJi3JqQHS+mPA9rTnyL85aIwWkLRx7cOyg4nfOMV3Z439wiIooA=

GET
H/1.1 200
OK Aleo-Regular.ttf
www.adtrek.co/content/webkits/Aleo/ Frame 7C2D 91 KB
91 KB 145ms
143ms Font
application/octet-stream 13.239.108.8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.adtrek.co/content/webkits/Aleo/Aleo-Regular.ttf
Requested by: Host: s3-ap-southeast-2.amazonaws.com
URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/7387f6fa-a109-45b5-9a4f-d45813c5ad8b/ad-s.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.239.108.8 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-239-108-8.ap-southeast-2.compute.amazonaws.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: d17006c0a81b02af292eb3d83777bc7ad87a6b26e6f50062facf44b1a7ee75aa

Request headers

Referer: https://s3-ap-southeast-2.amazonaws.com/
Origin: https://www.adtrek.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:36 GMT
Last-Modified: Wed, 21 Sep 2022 10:49:02 GMT
Server: Microsoft-IIS/8.5
ETag: "023dec2a7cdd81:0"
X-Powered-By: ASP.NET
Content-Type: application/octet-stream
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 93380

GET
H/1.1 200
OK AcrylicHandSans-Regular.ttf
www.adtrek.co/content/webkits/AcrylicHandSans/ Frame 7C2D 729 KB
730 KB 569ms
285ms Font
application/octet-stream 13.239.108.8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.adtrek.co/content/webkits/AcrylicHandSans/AcrylicHandSans-Regular.ttf
Requested by: Host: s3-ap-southeast-2.amazonaws.com
URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/7387f6fa-a109-45b5-9a4f-d45813c5ad8b/ad-s.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.239.108.8 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-239-108-8.ap-southeast-2.compute.amazonaws.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: b724a00eaaac0b61ee07c77736bdcaa23cfec8abc478a81b9c13d9c032ad6bcf

Request headers

Referer: https://s3-ap-southeast-2.amazonaws.com/
Origin: https://www.adtrek.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:36 GMT
Last-Modified: Wed, 21 Sep 2022 10:49:02 GMT
Server: Microsoft-IIS/8.5
ETag: "023dec2a7cdd81:0"
X-Powered-By: ASP.NET
Content-Type: application/octet-stream
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 746956

GET
H/1.1 200
OK AstLd Show response
www.adtrek.co/adserver/ Frame 7C2D 16 B
292 B 449ms
165ms XHR
application/json 13.239.108.8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.adtrek.co/adserver/AstLd?cc=32c8794c-79f1-49bb-a03f-85569be09a9f
Requested by: Host: www.adtrek.co
URL: https://www.adtrek.co/adserver/frm?cc=32c8794c-79f1-49bb-a03f-85569be09a9f&clk=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCNM5XptNtY_KXLL_mz7sPw5KGiAPSsKT5bPfi_MeUEb_N9fyaLRABILqEwDNgq-yxheAYoAGwgquTAcgBCakCkH4H2_wxpD6oAwGqBPEBT9CSguzHfUkAq6IzG8ExV6kFkoONOdgXlPee5Hoqqx0wT4BIVP3dCx8x9WgqpOusFrQ93ErG09QaZ32s1NJig6tIoq8-9sk4r7sAGVFdTGwwPnULQVbepBPkmnNj6FrGb-h7UL1gyqv-8euSqdILYEwz1jcrTDpyzqwXhOToI8oBKfnBocyYf2M0iOCaCPj4o2YBNGQIzHq12YTKHV-opmUmfVXjDtWCPELKv3ed1xg1CS_ZEUKHXD4S724UzxcXneimct5XwGfMTUtgyZYmJYU2519s2yHB_0FzlkqBVKrxwMEqkPp85w0UjPuBlSwzwMAEze_J7IYE4AQDkAYBoAZNgAe4_dTsAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgGEQARgdMgKKAjoCgEDyCBthZHgtc3Vic3luLTUyMzk5MzgyMTM4NzAzODCACgOYCwHICwGADAGwE9vp8RDIE7eMpOED0BMA2BMK2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9D1OUO62QOb7sr66XT4QCAc6gGRkHYi1qr0S__aPdP-aPhvbhjOFm_70kTKXeRDLPGqZCSrxpGAEgEw%26sig%3DAOD64_3-z_XYl25mDV_X5Jrm6Hx4s_49tg%26client%3Dca-pub-8933329999391104%26dbm_c%3DAKAmf-Bhb7WnPP7_QB_ysexA7T8kXDNDYsxagqKkaMz06HCcWZF_kdCxW1Ub_CEG2n99dAl__Z7cdgQbKdtYhpoRPBUMDDt0yx34NtxQsBlZQ1ZtXQ-BohFcyDD0guLORGNTdSi5_zSUF76Ghpdu7DqiKvFAOUCMuuBDIGxzS8C216th0Gr6xlU%26cry%3D1%26dbm_d%3DAKAmf-BZklHQByQhP1Z1xgI29jLUfCKPEK7gATj8_rrVO6_UIt1aNclTbcijE_h8yrXMLaYpusPdWPMtgNbg42b2tYRwH5OENsu02LGe7CN4qUmZ7aPLcB76lcaInld_e4GtqynCAP4Gqf6pIF-nk2r1uXCZpt_8PnLNXvoyc2TWD_V6T1nceHHzlhdcYTncI61FgITXSGVxsNvkC0mNIkJ8LTsWz8Q9UM3RGZQ-O9ikh3x_FcwDKAiMl3mOMTbbM_ByQeY6Lweerk5YFy8zfGyEgzDLTr_3c6vB9Uh0ZyFC-xV9zL8_0bhDxQ2rFH9QFklJbJfik7pK-Ju6KP52qvQnPRLMgJ3oRg1JxMQGb-EaSlAPAnHvX4fzFMPxt6nJ1Z2LVdxBfKuH0P4191C-lcwQUy0PVgpprp2zy2EI-ABWnbjpuLOF9nfo0SU6p271kS7-5l42n6X2uDAccOHQ07XR1AemP-LYWpyy7Txj8U_OLWe3744aob0sME_gxSsLTVSYd2fwdP_cIqiLsGsxCltxOLyrClUGQrH2Nx-cPcqe4bPYYhDrD4othhYWYoydJFYVPJIBke7KcNCc2eW4XC7SyXv62XHhDs2xjgx2mktr_57KY48X_FU%26adurl%3Dhttps%3a%2f%2fwww.adtrek.co%2fadserver%2fclick%3fcc%3d32c8794c-79f1-49bb-a03f-85569be09a9f&ord=1668141990723954
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.239.108.8 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-239-108-8.ap-southeast-2.compute.amazonaws.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/adserver/frm?cc=32c8794c-79f1-49bb-a03f-85569be09a9f&clk=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCNM5XptNtY_KXLL_mz7sPw5KGiAPSsKT5bPfi_MeUEb_N9fyaLRABILqEwDNgq-yxheAYoAGwgquTAcgBCakCkH4H2_wxpD6oAwGqBPEBT9CSguzHfUkAq6IzG8ExV6kFkoONOdgXlPee5Hoqqx0wT4BIVP3dCx8x9WgqpOusFrQ93ErG09QaZ32s1NJig6tIoq8-9sk4r7sAGVFdTGwwPnULQVbepBPkmnNj6FrGb-h7UL1gyqv-8euSqdILYEwz1jcrTDpyzqwXhOToI8oBKfnBocyYf2M0iOCaCPj4o2YBNGQIzHq12YTKHV-opmUmfVXjDtWCPELKv3ed1xg1CS_ZEUKHXD4S724UzxcXneimct5XwGfMTUtgyZYmJYU2519s2yHB_0FzlkqBVKrxwMEqkPp85w0UjPuBlSwzwMAEze_J7IYE4AQDkAYBoAZNgAe4_dTsAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgGEQARgdMgKKAjoCgEDyCBthZHgtc3Vic3luLTUyMzk5MzgyMTM4NzAzODCACgOYCwHICwGADAGwE9vp8RDIE7eMpOED0BMA2BMK2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9D1OUO62QOb7sr66XT4QCAc6gGRkHYi1qr0S__aPdP-aPhvbhjOFm_70kTKXeRDLPGqZCSrxpGAEgEw%26sig%3DAOD64_3-z_XYl25mDV_X5Jrm6Hx4s_49tg%26client%3Dca-pub-8933329999391104%26dbm_c%3DAKAmf-Bhb7WnPP7_QB_ysexA7T8kXDNDYsxagqKkaMz06HCcWZF_kdCxW1Ub_CEG2n99dAl__Z7cdgQbKdtYhpoRPBUMDDt0yx34NtxQsBlZQ1ZtXQ-BohFcyDD0guLORGNTdSi5_zSUF76Ghpdu7DqiKvFAOUCMuuBDIGxzS8C216th0Gr6xlU%26cry%3D1%26dbm_d%3DAKAmf-BZklHQByQhP1Z1xgI29jLUfCKPEK7gATj8_rrVO6_UIt1aNclTbcijE_h8yrXMLaYpusPdWPMtgNbg42b2tYRwH5OENsu02LGe7CN4qUmZ7aPLcB76lcaInld_e4GtqynCAP4Gqf6pIF-nk2r1uXCZpt_8PnLNXvoyc2TWD_V6T1nceHHzlhdcYTncI61FgITXSGVxsNvkC0mNIkJ8LTsWz8Q9UM3RGZQ-O9ikh3x_FcwDKAiMl3mOMTbbM_ByQeY6Lweerk5YFy8zfGyEgzDLTr_3c6vB9Uh0ZyFC-xV9zL8_0bhDxQ2rFH9QFklJbJfik7pK-Ju6KP52qvQnPRLMgJ3oRg1JxMQGb-EaSlAPAnHvX4fzFMPxt6nJ1Z2LVdxBfKuH0P4191C-lcwQUy0PVgpprp2zy2EI-ABWnbjpuLOF9nfo0SU6p271kS7-5l42n6X2uDAccOHQ07XR1AemP-LYWpyy7Txj8U_OLWe3744aob0sME_gxSsLTVSYd2fwdP_cIqiLsGsxCltxOLyrClUGQrH2Nx-cPcqe4bPYYhDrD4othhYWYoydJFYVPJIBke7KcNCc2eW4XC7SyXv62XHhDs2xjgx2mktr_57KY48X_FU%26adurl%3Dhttps%3a%2f%2fwww.adtrek.co%2fadserver%2fclick%3fcc%3d32c8794c-79f1-49bb-a03f-85569be09a9f&ord=1668141990723954
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:34 GMT
X-AspNetMvc-Version: 5.2
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: application/json; charset=utf-8
Cache-Control: private
Connection: keep-alive
Content-Length: 16

GET
H3 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame 928B 121 KB
39 KB 290ms
290ms Script
text/javascript 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cbb0bb4083e0f3d0f5ee023551f4537ece506edb97661b8d34149df5908cc481

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:37 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39921
x-xss-protection: 0
server: cafe
etag: 9532564079797560563
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 11 Nov 2022 04:46:37 GMT

GET
H3 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame B155 121 KB
39 KB 383ms
378ms Script
text/javascript 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

50578e6624075692944317d1e20cdf95f0a5f26dc70c7107942a4f2dc90acc72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:37 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39940
x-xss-protection: 0
server: cafe
etag: 3824027950873948575
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 11 Nov 2022 04:46:37 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame F992 42 B
64 B 286ms
286ms Image
image/gif 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuiaODErA3220y8y1l5HzlPCFOYrHpiOkDtOhdtsPwWb3FW4b_xwLepB9gpEZvE3q85lBWfzPpQ4j994LjlKhH6A0k87jOjqiSHKCR42XA588_iH5tLVDSH80J1mXdeuul5XIo&sai=AMfl-YSgj10KHZjjeDfev2-d2weKsMB66EJ7tpQf9OPZXA3ZMLrYq2DYol2FRalq6s-lXXQ_E4DIPzsz2r6XbL1TyoakbU_tB08aQjmYcx90WAxtdk3Prk4MXA4L1X-TGA&sig=Cg0ArKJSzEt4lm58h3iAEAE&cid=CAQSOwDq26N9D1OUO62QOb7sr66XT4QCAc6gGRkHYi1qr0S__aPdP-aPhvbhjOFm_70kTKXeRDLPGqZCSrxpGAEgEw&id=ampim&o=436,1110&d=728,90&ss=1600,1200&bs=1600,1200&mcvt=1001&mtos=0,0,1001,1001,1001&tos=0,0,1001,0,0&tfs=5245&tls=6246&g=100&h=100&tt=6246&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211090101/ Frame 928B 355 KB
117 KB 581ms
581ms Script
text/javascript 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211090101/show_ads_impl_fy2021.js?bust=31070831

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6349f7ddfdfc126218705bc540e0ec9f2fa8f1baa1c5bdff3effe9d20ec24ae7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:38 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 119540
x-xss-protection: 0
server: cafe
etag: 1230922421603176759
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 11 Nov 2022 04:46:38 GMT

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame AE15 0
48 B 238ms
235ms Script
text/plain 67.199.150.85
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=159463&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3111435947443605000V10%26type%3Dpba%26refUrl%3D%26vid%3D81419942253111435947443605000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 67.199.150.85 Los Angeles, United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:37 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211030101/ Frame B155 355 KB
117 KB 312ms
312ms Script
text/javascript 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211030101/show_ads_impl_fy2021.js?bust=31070785

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

193.244.178.107.bc.googleusercontent.com

Software

cafe /

Resource Hash

8fcbf0a35090e7d63fa97b6e39a54ab9dcc7cd5637fae2a200519a8d63ce589b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:38 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 119466
x-xss-protection: 0
server: cafe
etag: 10798441246845020499
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 11 Nov 2022 04:46:38 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame D2D4 812 B
1 KB 235ms
235ms Script
text/html 67.199.150.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=23977519&p=162412&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1YN-
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 67.199.150.81 Los Angeles, United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 31e28526900b0edc501bf451faa6c7c7d4ab4bcc9ec9eba2d1666fe17824d54f

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 11 Nov 2022 04:46:38 GMT
content-length: 812
content-type: text/html; charset=UTF-8

GET
H2 200 141 Show response
match.deepintent.com/usersync/ Frame FCAC 0
39 B 339ms
338ms Document
text/plain 169.197.150.7
DEEPINTENT

General

Check archive.org

Show headers Download Go to

Full URL: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS: g.deepintent.com
Software: c /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

content-length: 0
date: Fri, 11 Nov 2022 04:46:37 GMT
server: c

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame AA22
Redirect Chain

https://um.simpli.fi/pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:DEA4A601E7C34F7B8A65CB6EF47D4DCC&gdpr=0&gdpr_consent=

1 B
53 B

236ms
235ms

Document
text/html

67.199.150.86
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:DEA4A601E7C34F7B8A65CB6EF47D4DCC&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 67.199.150.86 Los Angeles, United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Fri, 11 Nov 2022 04:46:37 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-length: 142
content-type: text/html
date: Fri, 11 Nov 2022 04:46:38 GMT
expires: Thu, 10 Nov 2022 04:46:38 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:DEA4A601E7C34F7B8A65CB6EF47D4DCC&gdpr=0&gdpr_consent=
server: openresty
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff

GET
H2 200 sync Show response
ads.servenobid.com/ Frame AF83 0
357 B 406ms
404ms Document
text/html 34.252.126.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/sync?pid=316&uid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.252.126.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-252-126-43.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
amp-access-control-allow-source-origin: *
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
content-length: 0
content-type: text/html;charset=ISO-8859-1
date: Fri, 11 Nov 2022 04:46:38 GMT

GET
H/1.1 200
OK info
uipglob.semasio.net/pubmatic/1/ Frame D2D4 42 B
220 B 1148ms
601ms Image
image/gif 119.9.108.180
RACKSPACE-AP Rack...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10&sInitiator=external&gdpr=0&gdpr_consent=
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 119.9.108.180 , Hong Kong, ASN45187 (RACKSPACE-AP Rackspace IT Hosting AS IT Hosting Provider Hong Kong, HK),
Reverse DNS
Software: /
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

uip-response-status: FallbackResponse
date: Fri, 11 Nov 2022 04:46:32 GMT
frontend-id: 0
content-length: 42
routing-server-id: 1
content-type: image/gif

GET
H2

200

qmap
sync.crwdcntrl.net/ Frame D2D4
Redirect Chain

https://sync.crwdcntrl.net/qmap?c=240&tp=PUBM&tpid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10&gdpr=0&gdpr_consent=
https://sync.crwdcntrl.net/qmap?c=240&tp=PUBM&tpid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10&gdpr=0&gdpr_consent=&ct=y

49 B
544 B

258ms
257ms

Image
image/gif

54.169.203.49
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/qmap?c=240&tp=PUBM&tpid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10&gdpr=0&gdpr_consent=&ct=y
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.169.203.49 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-169-203-49.ap-southeast-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:39 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.42.7.84
content-length: 49
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:38 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location: https://sync.crwdcntrl.net/qmap?c=240&tp=PUBM&tpid=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10&gdpr=0&gdpr_consent=&ct=y
cache-control: no-cache
x-server: 10.42.9.135
content-length: 0
expires: 0

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame D2D4
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=2e6ef4c9-5467-4781-94ca-38db754fa6b5%252C&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed&ttd_puid=2e6ef4c9-5467-4781-94ca-38db754fa6b5%2C

95 B
122 B

275ms
274ms

Image
image/png

107.178.244.193
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed&ttd_puid=2e6ef4c9-5467-4781-94ca-38db754fa6b5%2C

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Server

107.178.244.193 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:38 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type: image/png
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:38 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed&ttd_puid=2e6ef4c9-5467-4781-94ca-38db754fa6b5%2C
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 353

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 76FA 47 B
222 B 235ms
234ms Script
text/html 67.199.150.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=78282126&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 67.199.150.81 Los Angeles, United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 09343d3b3473e1c994b2d603c99feb8a0f63fbd3ff20be7432ff18b973dbe651

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 11 Nov 2022 04:46:38 GMT
content-length: 47
content-type: text/html; charset=UTF-8

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ Frame B155 210 B
359 B 289ms
278ms Script
text/javascript 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.bg3.co&callback=_gfp_s_&client=ca-pub-4485239425924787&cookie=ID%3D7424e70c42b0e229%3AT%3D1668141990%3AS%3DALNI_Ma_zn52qfbC-C-Sn8uIzpzkw6TYWg&gpic=UID%3D00000b795b7e4242%3AT%3D1668141990%3ART%3D1668141990%3AS%3DALNI_MbHNmAN3NzQn7wiMpFb07Wpx4hRoQ&gpid_exp=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211030101/show_ads_impl_fy2021.js?bust=31070785

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d624374cde6bd574d5b31161ce4ca8e028425eefab7d0cf95065d49673ca93a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 197
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.co.nz/adsid/ Frame B155 107 B
122 B 283ms
282ms Script
application/javascript 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.nz/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211030101/show_ads_impl_fy2021.js?bust=31070785

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame B155 107 B
122 B 278ms
278ms Script
application/javascript 142.251.12.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211030101/show_ads_impl_fy2021.js?bust=31070785

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 70B2 23 KB
11 KB 943ms
942ms Document
text/html 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2844491747&adf=53498480&pi=t.ma~as.3006%2F14006&w=336&lmt=1668141998&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1668141997921&bpp=13&bdt=580&idt=721&shv=r20221109&mjsv=m202211030101&ptt=5&saldr=sa&cookie=ID%3D7424e70c42b0e229%3AT%3D1668141990%3AS%3DALNI_Ma_zn52qfbC-C-Sn8uIzpzkw6TYWg&gpic=UID%3D00000b795b7e4242%3AT%3D1668141990%3ART%3D1668141990%3AS%3DALNI_MbHNmAN3NzQn7wiMpFb07Wpx4hRoQ&correlator=2851980570204&frm=23&ife=1&pv=2&ga_vid=1042930634.1668141991&ga_sid=1668141999&ga_hid=106843725&ga_fc=1&nhd=3&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=1050797798&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531705%2C44777508%2C31070617%2C31070762%2C31070785%2C44775017&oid=2&pvsid=74479620173393&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.927lrfg0iy36&fsb=1&dtd=740

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211030101/show_ads_impl_fy2021.js?bust=31070785

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36fbc0e4254558de986baf58489db0480bb7277c2f91e2d41e6e580e40f49efe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 11197
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 11 Nov 2022 04:46:39 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ Frame 928B 210 B
262 B 278ms
278ms Script
text/javascript 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211090101/show_ads_impl_fy2021.js?bust=31070831

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

292871413f8ffa79e4c665d7d9829dec333f8b76b97a8a134020e3ae67d1b71a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 197
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.co.nz/adsid/ Frame 928B 107 B
122 B 282ms
282ms Script
application/javascript 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.nz/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211090101/show_ads_impl_fy2021.js?bust=31070831

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame 928B 107 B
122 B 278ms
278ms Script
application/javascript 142.251.12.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211090101/show_ads_impl_fy2021.js?bust=31070831

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 9873 31 KB
12 KB 508ms
508ms Document
text/html 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2844491747&adf=53498479&pi=t.ma~as.3006%2F14006&w=336&lmt=1668141998&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1668141997737&bpp=15&bdt=428&idt=990&shv=r20221109&mjsv=m202211090101&ptt=5&saldr=sa&cookie=ID%3D7424e70c42b0e229%3AT%3D1668141990%3AS%3DALNI_Ma_zn52qfbC-C-Sn8uIzpzkw6TYWg&gpic=UID%3D00000b795b7e4242%3AT%3D1668141990%3ART%3D1668141990%3AS%3DALNI_MbHNmAN3NzQn7wiMpFb07Wpx4hRoQ&correlator=2851980570204&frm=23&ife=1&pv=1&ga_vid=1042930634.1668141991&ga_sid=1668141999&ga_hid=2004020352&ga_fc=1&nhd=3&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=1210&biw=1600&bih=1200&isw=336&ish=280&ifk=1050797798&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44767166%2C44776361%2C31070831%2C44775016&oid=2&pvsid=2111563423550059&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.eg5n3ed7gyfy&btvi=1&fsb=1&dtd=1009

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211090101/show_ads_impl_fy2021.js?bust=31070831

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ac3594b99dedce01c508c6a65f7cbcf7e8342c39916c769f712d8818e4f968d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 12626
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 11 Nov 2022 04:46:39 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200 usersync Show response
usersync.gumgum.com/ Frame F674 35 B
250 B 254ms
253ms Document
image/gif 13.112.54.241
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=pbm&i=F9E9CE4B-492C-41F6-9FFD-10928AFE1A10
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.112.54.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-112-54-241.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 11 Nov 2022 04:46:38 GMT
Expires: 0
Pragma: no-cache

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 05A6 0
0 285ms
284ms Fetch
text/html 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CH5RzrtNtY8PKNfWCjMwP-5OnYJj80bFcqoTM5IUBwI23ARABIABgq-yxheAYggEXY2EtcHViLTQ0ODUyMzk0MjU5MjQ3ODfIAQmpAtHg8CULLaY-qAMBqgT0AU_QNIXX-pC86yN1fTGlb2-KJlNApgW2r-wBdw6EO4U0BuQgZZy-sFIid8A6NDbYSvE8_2VoH2TmHUKaUSSS0EsN7GlUgh13eO7Nz03615Lury49aUbngrXVZkWDNN0iXHiiBRcUh-HfI2vSU_1BIWKVb6QR_xK5dFN_Dgl2T5y35gzSQ8aQEDFX--PiQPmA2x3xB7fMwY0C62Qj3XBO_cje6u8CU_sOtCmVrGxrTUhdNsLq09uo3fPAR2vd4imInO5gopR4sO4girHk_H8A-kOPsCqlhFQeqKy21RUpotnnjqlyDmHQjzyyK25dM94dsVcUDxSABvmh7dS30vndYqAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBAgAoD-gsCCAGADAHQFQGAFwGyFxwKGhIUcHViLTQ0ODUyMzk0MjU5MjQ3ODcY4swZ&sigh=upar8YcTbPk&uach_m=[UACH]&cid=CAQSOwDq26N9at516WKtS0nUpY06tJ5AE8spPqhz77AutxwB9wiMn38TOOXpZihwT6DuP9-cJbXJYekoMuNVGAEgEw

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2844491747&adf=53498479&pi=t.ma~as.3006%2F14006&w=336&lmt=1668141998&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1668141997737&bpp=15&bdt=428&idt=990&shv=r20221109&mjsv=m202211090101&ptt=5&saldr=sa&cookie=ID%3D7424e70c42b0e229%3AT%3D1668141990%3AS%3DALNI_Ma_zn52qfbC-C-Sn8uIzpzkw6TYWg&gpic=UID%3D00000b795b7e4242%3AT%3D1668141990%3ART%3D1668141990%3AS%3DALNI_MbHNmAN3NzQn7wiMpFb07Wpx4hRoQ&correlator=2851980570204&frm=23&ife=1&pv=1&ga_vid=1042930634.1668141991&ga_sid=1668141999&ga_hid=2004020352&ga_fc=1&nhd=3&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=1210&biw=1600&bih=1200&isw=336&ish=280&ifk=1050797798&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44767166%2C44776361%2C31070831%2C44775016&oid=2&pvsid=2111563423550059&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.eg5n3ed7gyfy&btvi=1&fsb=1&dtd=1009
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 11 Nov 2022 04:46:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.jp2.as.criteo.com/google/auction/ Frame 05A6 0
0 927ms
307ms Fetch 182.161.74.19
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.jp2.as.criteo.com/google/auction/notify?profile=14&payload=k8z_FPz1BqwC-gFi-C0SAgAAACE5AQwCW-6I5uT8IWU3JEEQrtNtY0sVHYSGD_gpnu4oABIAAA&wp=Y23TrgANZUMDgwF1AAnJ-6I6Sctolp5oadosmw

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.74.19 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:39 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
server-processing-duration-in-ticks: 161532
content-length: 0

GET
H2 200 afr.php Show response
ads.as.criteo.com/delivery/r/ Frame 9EB6 51 KB
20 KB 949ms
469ms Document
text/html 182.161.73.148
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.as.criteo.com/delivery/r/afr.php?z=Y23TrgANZUMDgwF1AAnJ-6I6Sctolp5oadosmw&u=%7CT8X2drWCLzn8TjB31gTPsHsEbiBUjwL5KhQkK6owNTA%3D%7C&c1=wLMhjbQtwRerfuYQvtYvucUfx71c_57oZ7-4NEldJVPEcquQgoC5ayq1XBwsz6hbCNpksUhOYIG9jsbcdhUPUASS9TekPJg-As5Ce6q-DLN0-Sne60wEQ-VoTshP9T-Z8t9SqI7hzTiSTQqPbCdc1muRZLgODpDKCVOACJ2kBsR0GVJjl289ip7NZ_sc6q_s-bGSZwYLVEVoq8aCyZ7WpS6yNazhairwURQ4MRst_Urposek7FKbX_44VyOCNIfiqPnCy2hgeva43WHhFS0XspbYZUj8zzuB-dutXivhMEJfhrbg0xHMPju0-_xExIvIYSh5Wh7WMPOhPOCWCbqYh49BvfV5WAnehksriFL5ZKHoBDDz5NW56WNMQ4vrjrLb8Ddpqz5bwzPJfkWs1lLTQsJKb5c-kEiSmtVl1vhnzy1RS_rVQ3HayP9bPejPTooCOsHHY1zlPSy3TG2fczgNp7MENFv2aUgSB6ii59jIb3IVkGgR3GKq1ApwdxbVmXMe8tFceiLN8RE1Z4fvylwnFXzPsA32h_Zz7m-t3SqmdnRfVKBJAjBuNqo5Oz_cyh-VdD7Hzjx4NhOD19KUeIRaZAcgQRsAF23zoxRK6u34hvOjYYhpzLWg985wMSsLrKHrtQnguQw9bb8&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCY8HwrtNtY8PKNfWCjMwP-5OnYJj80bFcqoTM5IUBwI23ARABIABgq-yxheAYggEXY2EtcHViLTQ0ODUyMzk0MjU5MjQ3ODfIAQmpAtHg8CULLaY-qAMBqgT3AU_QNIXX-pC86yN1fTGlb2-KJlNApgW2r-wBdw6EO4U0BuQgZZy-sFIid8A6NDbYSvE8_2VoH2TmHUKaUSSS0EsN7GlUgh13eO7Nz03615Lury49aUbngrXVZkWDNN0iXHiiBRcUh-HfI2vSU_1BIWKVb6QR_xK5dFN_Dgl2T5y35gzSQ8aQEDFX--PiQPmA2x3xB7fMwY0C62Qj3XBO_cje6u8CU_sOtCmVrGxrTUhdNsLq09uo3fPAR2vd4imInO5gopR4sO4girHk_H8AuEGuIs9rDSrhId0oPkOzYfDzhD54IHk4B8_ksafjLfIFVryFceuxmAWABvmh7dS30vndYqAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_1nY5ghb_gkh2hlXCxoP7VrpNJrjA%26client%3Dca-pub-4485239425924787%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2844491747&adf=53498479&pi=t.ma~as.3006%2F14006&w=336&lmt=1668141998&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1668141997737&bpp=15&bdt=428&idt=990&shv=r20221109&mjsv=m202211090101&ptt=5&saldr=sa&cookie=ID%3D7424e70c42b0e229%3AT%3D1668141990%3AS%3DALNI_Ma_zn52qfbC-C-Sn8uIzpzkw6TYWg&gpic=UID%3D00000b795b7e4242%3AT%3D1668141990%3ART%3D1668141990%3AS%3DALNI_MbHNmAN3NzQn7wiMpFb07Wpx4hRoQ&correlator=2851980570204&frm=23&ife=1&pv=1&ga_vid=1042930634.1668141991&ga_sid=1668141999&ga_hid=2004020352&ga_fc=1&nhd=3&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=1210&biw=1600&bih=1200&isw=336&ish=280&ifk=1050797798&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44767166%2C44776361%2C31070831%2C44775016&oid=2&pvsid=2111563423550059&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.eg5n3ed7gyfy&btvi=1&fsb=1&dtd=1009

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.148 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

a3590042b3ded066cfeba5a2e3ce9a54cd76558d27529373ff7f739ee3ece962

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Fri, 11 Nov 2022 04:46:39 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.as.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.as.criteo.net/heavyad?cppv=3&cpp=eoYPJi8zCWPu3AKBEmH7782UYq4L0gWFs9pS0VkdIIhNGaAJWEp6JVOrGjveJuAShI3UHGFxKGrbxWQ9jU9OnPUOUxDMhhIvyaRwfVLc-Aokzkeq_ROCJwwoL-XtHRv8CyF6NpxZjqSkARGFCKYRkw3pevxegdR-up64gkLhjxpyNCEwAtEj7C3KzGz07OBksP_i25NYtHoF2roT55ddoPsQZ5KElQmKwpyi_DAJgInQygocjJ10HtEmJX9jZaxwOH4Tt6rRezoReVMZ"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 5689538
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221109/r20110914/client/ Frame 05A6 3 KB
1 KB 274ms
273ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221109/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 10 Nov 2022 20:31:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29716
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Nov 2022 20:31:23 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame CD94 1 KB
643 B 277ms
275ms Document
text/html 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

age: 82011
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 10 Nov 2022 05:59:48 GMT
etag: 48472445140208031
expires: Fri, 11 Nov 2022 05:59:48 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221109/r20110914/client/ Frame 05A6 18 KB
7 KB 274ms
273ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f841e16a15c87fd62a9fd964cbe0f0a42e8c4a890a8b4f706729c0cc53054dc2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 10 Nov 2022 20:31:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29716
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7417
x-xss-protection: 0
server: cafe
etag: 18318620284716439044
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Nov 2022 20:31:23 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 05A6 154 KB
47 KB 581ms
280ms Script
text/javascript 74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

74e5d27c3ce88edecaa16bdd847929fae0ebe21d23da8e419564ced5bd844977

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48226
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1667997631252355"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 11 Nov 2022 04:46:39 GMT

GET
DATA 200
OK truncated
/ Frame 05A6 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 15edbdc66379986d1a87ac4722417020a14fe6db42455e7f0ecc39efd4da1f93

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame CD94
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEB2Y_O1TP4b4wLuyI1HyW2I&google_cver=1&google_push=ASkJ3FahbZb6D7fSvou62q4GCfTkMMr8VWO3Dc9a--nvKtd-2dyzUetXRYIiF801-D4kJ32Eqm6mq3TNIoQ4WTyooCH0G8J0Ba9Eg...
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=Mjc3NzY2NzQ2MTIwODE5NTU0NA==&gdpr=0&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=0&gdpr_consent=&google_gid=CAESEB2Y_O1TP4b4wLuyI1HyW2I&google_cver=1

43 B
398 B

457ms
264ms

Image
image/gif

50.116.239.135
TURN-US-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=0&gdpr_consent=&google_gid=CAESEB2Y_O1TP4b4wLuyI1HyW2I&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2844491747&adf=53498479&pi=t.ma~as.3006%2F14006&w=336&lmt=1668141998&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1668141997737&bpp=15&bdt=428&idt=990&shv=r20221109&mjsv=m202211090101&ptt=5&saldr=sa&cookie=ID%3D7424e70c42b0e229%3AT%3D1668141990%3AS%3DALNI_Ma_zn52qfbC-C-Sn8uIzpzkw6TYWg&gpic=UID%3D00000b795b7e4242%3AT%3D1668141990%3ART%3D1668141990%3AS%3DALNI_MbHNmAN3NzQn7wiMpFb07Wpx4hRoQ&correlator=2851980570204&frm=23&ife=1&pv=1&ga_vid=1042930634.1668141991&ga_sid=1668141999&ga_hid=2004020352&ga_fc=1&nhd=3&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=1210&biw=1600&bih=1200&isw=336&ish=280&ifk=1050797798&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44767166%2C44776361%2C31070831%2C44775016&oid=2&pvsid=2111563423550059&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.eg5n3ed7gyfy&btvi=1&fsb=1&dtd=1009
Protocol: H2
Server: 50.116.239.135 , United States, ASN6336 (TURN-US-ASN, US),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Fri, 11 Nov 2022 04:46:39 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:40 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=0&gdpr_consent=&google_gid=CAESEB2Y_O1TP4b4wLuyI1HyW2I&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 330
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 i.match
a.tribalfusion.com/ Frame CD94 43 B
663 B 388ms
263ms Image
image/gif 104.18.24.173
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.tribalfusion.com/i.match?p=b6&u=CAESEAfLPn04qAy4xikz7uGvVDU&google_cver=1&google_push=ASkJ3FYc3hlLukj24qLQjbc9wJdwcGJTVRWqaw8Sj9MGm5F4HwgO5yWMKNZHkzQeJspjAO6eyukzKQlCFQvYUHbopM3Pst7xcMFlr4YjJ6uCNFrIjgqVxZlzXx3Yh5c_idQBvuYOha9YqYhnaNko0b5iyz0&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DASkJ3FYc3hlLukj24qLQjbc9wJdwcGJTVRWqaw8Sj9MGm5F4HwgO5yWMKNZHkzQeJspjAO6eyukzKQlCFQvYUHbopM3Pst7xcMFlr4YjJ6uCNFrIjgqVxZlzXx3Yh5c_idQBvuYOha9YqYhnaNko0b5iyz0%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2844491747&adf=53498479&pi=t.ma~as.3006%2F14006&w=336&lmt=1668141998&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1668141997737&bpp=15&bdt=428&idt=990&shv=r20221109&mjsv=m202211090101&ptt=5&saldr=sa&cookie=ID%3D7424e70c42b0e229%3AT%3D1668141990%3AS%3DALNI_Ma_zn52qfbC-C-Sn8uIzpzkw6TYWg&gpic=UID%3D00000b795b7e4242%3AT%3D1668141990%3ART%3D1668141990%3AS%3DALNI_MbHNmAN3NzQn7wiMpFb07Wpx4hRoQ&correlator=2851980570204&frm=23&ife=1&pv=1&ga_vid=1042930634.1668141991&ga_sid=1668141999&ga_hid=2004020352&ga_fc=1&nhd=3&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=1210&biw=1600&bih=1200&isw=336&ish=280&ifk=1050797798&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44767166%2C44776361%2C31070831%2C44775016&oid=2&pvsid=2111563423550059&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.eg5n3ed7gyfy&btvi=1&fsb=1&dtd=1009
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.173 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:39 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 768462aacf51fb8c-AKL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CD94
Redirect Chain

https://match.adsrvr.org/track/cmf/google?google_gid=CAESEA4jo_qfdQeVCR2KoeDt5tw&google_cver=1&google_push=ASkJ3FZdQWV7mtgvxHAn3hOFY_4-PwrTqal1IYCb6Uzy6ij0lEReBOYeYXVdOq0Ft01nFm8Q9_hU41irACGErpGkwJ...
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=MWJjMWNjZjYtZGU4ZC00OGVkLTkwOGMtYzJlMTI5YmNlOGVk&google_push&gdpr=0&gdpr_consent=&ttd_tdid=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed

170 B
188 B

282ms
281ms

Image
image/png

142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=MWJjMWNjZjYtZGU4ZC00OGVkLTkwOGMtYzJlMTI5YmNlOGVk&google_push&gdpr=0&gdpr_consent=&ttd_tdid=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed

Requested by

Protocol

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:39 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:39 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=MWJjMWNjZjYtZGU4ZC00OGVkLTkwOGMtYzJlMTI5YmNlOGVk&google_push&gdpr=0&gdpr_consent=&ttd_tdid=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 423

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CD94
Redirect Chain

https://a.c.appier.net/gcm?google_gid=CAESEGZ14DgfXTqKAif0ZPLUF0U&google_cver=1&google_push=ASkJ3FbkZjAnI7aPWwdRr5K7QjkUrq_k4PYwmKHr5qR-R3Kwv09lkpeXeMkZyEe-MLb9Iq2O118d4UEK2dm-pv0Dz9yB3XePphBhaWZyP...
https://cm.g.doubleclick.net/pixel?google_nid=appier&google_hm=RVRnYzZteW1ESE94OWdpS3F0TnRZdw%3D%3D&google_push=ASkJ3FbkZjAnI7aPWwdRr5K7QjkUrq_k4PYwmKHr5qR-R3Kwv09lkpeXeMkZyEe-MLb9Iq2O118d4UEK2dm-p...

170 B
188 B

285ms
285ms

Image
image/png

142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appier&google_hm=RVRnYzZteW1ESE94OWdpS3F0TnRZdw%3D%3D&google_push=ASkJ3FbkZjAnI7aPWwdRr5K7QjkUrq_k4PYwmKHr5qR-R3Kwv09lkpeXeMkZyEe-MLb9Iq2O118d4UEK2dm-pv0Dz9yB3XePphBhaWZyPSiKKnJcVLekvtDOdEnpQ6jDgzvXxZOFCbAwQ-8AyCya7MT3kA

Requested by

Protocol

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=appier&google_hm=RVRnYzZteW1ESE94OWdpS3F0TnRZdw%3D%3D&google_push=ASkJ3FbkZjAnI7aPWwdRr5K7QjkUrq_k4PYwmKHr5qR-R3Kwv09lkpeXeMkZyEe-MLb9Iq2O118d4UEK2dm-pv0Dz9yB3XePphBhaWZyPSiKKnJcVLekvtDOdEnpQ6jDgzvXxZOFCbAwQ-8AyCya7MT3kA
date: Fri, 11 Nov 2022 04:46:40 GMT
cache-control: no-store
content-type: text/html; charset=utf-8
server: nginx
content-length: 297
p3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

GET

pixel
cm.g.doubleclick.net/ Frame CD94
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEGeYmM0wDOnKiZtjcVYwQ38&google_cver=1&google_push=ASkJ3FbyNOxhFZatbiXrCbPNWPyYiQ1mh5II69vLrUr4cRxAyIiT8VfRLreBzvjeqYLo0wZJARhrYghUBq327nDZjKo2...
https://a.sportradarserving.com/sync?ssp=bidswitch&bidswitch_ssp_id=google
https://a.sportradarserving.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=google
https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=1&user_id=7e847225-5ee5-4edd-8da1-3b2ac40edbe8&ssp=google
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ASkJ3FbyNOxhFZatbiXrCbPNWPyYiQ1mh5II69vLrUr4cRxAyIiT8VfRLreBzvjeqYLo0wZJARhrYghUBq327nDZjKo2UnsXLT0AnNGTi7bCfHZj389__MNZXDEU1tVKChokEr...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CD94
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEHOgnYZiOVC4jxuwFLuIawo&google_cver=1&google_push=ASkJ3FbledLK07uHUr7SKrqH4WexxIm319g4ZFRonDtAMPH1QQzZS9nLoD9wcFmYt6EuFl4VU6B8PnOw...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjA1NzE1MTk5MjQ5MzU1NjEwMQ&google_push=ASkJ3FbledLK07uHUr7SKrqH4WexxIm319g4ZFRonDtAMPH1QQzZS9nLoD9wcFmYt6EuFl4VU6B8Pn...

170 B
188 B

284ms
283ms

Image
image/png

142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjA1NzE1MTk5MjQ5MzU1NjEwMQ&google_push=ASkJ3FbledLK07uHUr7SKrqH4WexxIm319g4ZFRonDtAMPH1QQzZS9nLoD9wcFmYt6EuFl4VU6B8PnOwMA5zvgVq-HFTQkLRNvqlCTUAyjKnwFtk-a74hnAGEejmZCB-zUrHReQokwSt7YBob35ZFjrB2Jo

Requested by

Protocol

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjA1NzE1MTk5MjQ5MzU1NjEwMQ&google_push=ASkJ3FbledLK07uHUr7SKrqH4WexxIm319g4ZFRonDtAMPH1QQzZS9nLoD9wcFmYt6EuFl4VU6B8PnOwMA5zvgVq-HFTQkLRNvqlCTUAyjKnwFtk-a74hnAGEejmZCB-zUrHReQokwSt7YBob35ZFjrB2Jo
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET pub
cs.chocolateplatform.com/ Frame CD94 0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame CD94 0
12 B 283ms
279ms Image
text/html 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JeJhaKJrR-aHCzYwKmdDwb0hcJiZb8b8wQwKiw2sUtLh7BA4QpokJwg1dQH_4Ht7PXhyel

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:39 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 8747 482 B
213 B 280ms
279ms Document
text/html 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COXuopICELGQ6u0CGIjy_9QBMAE&v=APEucNWv-u4dakH-q3VVVhoGP2wyXjdW_t_J1XnGgoKsr7zi8LMSKE16ACgKU2pjP4nnoc_6qYvBafIYf0OhMnNk_8AtDs1bvg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2844491747&adf=53498480&pi=t.ma~as.3006%2F14006&w=336&lmt=1668141998&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1668141997921&bpp=13&bdt=580&idt=721&shv=r20221109&mjsv=m202211030101&ptt=5&saldr=sa&cookie=ID%3D7424e70c42b0e229%3AT%3D1668141990%3AS%3DALNI_Ma_zn52qfbC-C-Sn8uIzpzkw6TYWg&gpic=UID%3D00000b795b7e4242%3AT%3D1668141990%3ART%3D1668141990%3AS%3DALNI_MbHNmAN3NzQn7wiMpFb07Wpx4hRoQ&correlator=2851980570204&frm=23&ife=1&pv=2&ga_vid=1042930634.1668141991&ga_sid=1668141999&ga_hid=106843725&ga_fc=1&nhd=3&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=1050797798&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531705%2C44777508%2C31070617%2C31070762%2C31070785%2C44775017&oid=2&pvsid=74479620173393&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.927lrfg0iy36&fsb=1&dtd=740

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7599e0a5ce1ba2a12f036e998e19e60b6e982178e4363d4630ab3a91ca73bf62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2844491747&adf=53498480&pi=t.ma~as.3006%2F14006&w=336&lmt=1668141998&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1668141997921&bpp=13&bdt=580&idt=721&shv=r20221109&mjsv=m202211030101&ptt=5&saldr=sa&cookie=ID%3D7424e70c42b0e229%3AT%3D1668141990%3AS%3DALNI_Ma_zn52qfbC-C-Sn8uIzpzkw6TYWg&gpic=UID%3D00000b795b7e4242%3AT%3D1668141990%3ART%3D1668141990%3AS%3DALNI_MbHNmAN3NzQn7wiMpFb07Wpx4hRoQ&correlator=2851980570204&frm=23&ife=1&pv=2&ga_vid=1042930634.1668141991&ga_sid=1668141999&ga_hid=106843725&ga_fc=1&nhd=3&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=1050797798&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531705%2C44777508%2C31070617%2C31070762%2C31070785%2C44775017&oid=2&pvsid=74479620173393&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.927lrfg0iy36&fsb=1&dtd=740
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 193
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 11 Nov 2022 04:46:39 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame B819 15 KB
11 KB 314ms
313ms Script
text/javascript 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BEEycUf1IXAA5HcJZDq808NvGrUkLqKAIsW5sNZSjQ9xUUE7y72o74dgvJjMM3GlFN-sP6a_pknMPPGFdvFXtM_G0X9Pp1ELOqm-Ny5eHi-AlaaOy9R5FeiJTdYjTALEOQr8By8tV0kOTuncdkV9cqV5-sir-Aps4t6LNcMVOIJBa-cjs&cry=1&dbm_d=AKAmf-CLlGIe0MLk5CdYje3mDjmoufpoCKe_32BwGwvJGQns04PrJuqy37lsMStvSn6FtCIETvowElPhk5SGgDFg1mf5mxjDljAmvxUGcVkG1olt1p5IMj4RzXR9Sak-NZz7WmSRT269XyJWxbcjvn6tOZR3M4mybQZxH0B3bPm-5VJBim1YrRVrX6MWHIqH_Gu1jhscNowBUDbs_mbcSC6LLJ70oe_0oUIHCd7iFPf96DsVN1s3TVPmkShTww29VUnkaeylLL684XbYGEXf4TyBoG1_-t45S-zMnNzn4CMPqiUAathIlZP3_YWwRApop7OVDbmROQjvBMVR2BFcx4_wrG7_38FFKlhFboS8ZuP49304-7P2t8uzsXfpvrrBUfJLAy09fFBafeu9vFGtqzDJg9aEm072ePD1V75rF0fsk0OA1EQiaNG6yoNhs2TqN5ipEYadgVzPsKehhprXrLtMym9m-nN9L0l2oNQ_pFNwI6XdQmqX7qMsKrvbANQYuRBRCd8-GI-dnF8m6ZKZyDhcKvbTTti75uWXiBMLcXSnWdfPPGNAx7ZC-1R_3t8-z-Bswbpug8-DCS_3y4ogPPtBPclv3kUIAuun9ShzUVCxRiDGw8V4LBkZgq2A5mvWaZbji2wJznktCRd5KlpBw3m5fyw1zCtF8dktbdi4F61fE5llu8BBy4SdWRsqH3cGho0LapcqDufmMhxAKMpSCc7p4LlKEG7qCGTCC6yhvfiJDMjea6nDDxmYi7FarSJOa-0jIRXNh62hY4azxPWUs77CA465f-iSypMXawi9hVoTYYv8cNfDz1jMhoO5lTCeiET7uZkAczTYOs9GHuhh4ZS_QvsfZfIm0do1qMuSZFNu4qMcYURx_BLrGE5A1ksOUmSEcc3gW0IJWLTGE4UIpHptfa77OuNC1bktJoV8_B5pPo6EGD2mCc3WonJz-jkkhj-QQguQ4TpR-ibH3EyEdo5tPiqNCiuhgsGAjWV7fonqYFZNySTI6fG8_9cQgL8HCw6YTsjBxzMIcCpXI6QFk9VcOsUMoBVF0dzRH4fFrwo22BfCoa182BSPdjikeuJc5ugdXxM8laPQg95_wVc3CMieQNEszQ-jTlFLoafgIjm8vrNKcHfDLEzqEt42v7N5mGx9lsNgyMaxU-hwIfdaADm5qdIFE2e9XqrvpJ-IPUxBQvRPhmtVSINkxAwSghwy8MWUlFv1EL4K24TjHMpvBTAfuD6tzeFIbhAtgLKjXaoiGGL2tf4l3TnQ-01KoYsnSzWAvuoGZ1sNno5YFUgHbvRXN1tfQvqlskIflUz6mPe0CkB_TwV7xhXUH9S_VbLFyFfxfUfi4KE9Qzjb3dqwuj4CGQjg9dVMXheRIzj8aaDXJXblxPpAeNqGHquXIlPdGL4JI-dRUpWOf2URX4wcYIh9Hp7_l9lrPSgGjc4K8W9fey6-Nm_hGmYCHRCYRmUdY6ks68R3BQ3dqppyVVaMIMojYiR8Xtj3YmOLj2NzU-q56jy_jbolFW_4trrikLpHk-xEBvZ3lnjSYXF0qmwT93lbESpQ0NW_XqSaWnTheQISbBq_AkO3i0IxFcb1rJlwFF0Lw8ekSRx2L0f3Ae_Bh9xIo57LWgGsIaqXfRqsF0ymr_-QJK1heR4mhBmmn2UVgMTkGJU1vzg4sa8Mmlhi9K0-YfON4etRpBjZlb0B1pHfWPSHG06FAgVWoFHCBSI6RPxoUodVily-b-iar-lhkMbKynwQcyW1NkAQ0-fqP9I-Nd-DqLjO93_Cj5VZ4vqhoMEGhQRGS0mYGpx5-zshP6LW0gRxDY0r6WOxol6lRo4GeN1QSdrLuCPNd6VoS5KZkfLXvwefJg1kpp75USA4WcajtrdjnrkmhlxKn_O39QruAb54VlzrIOnEoDI2-YQRIV03DClz4afMEF5DjezMkmI_V9rK_fUwC7dHULX3NqawfzxOb8eLESImdR-P1n4xTe1bD_h72StNNeVBY4OpbZmEk64gWO32g9g6MfwGeZ4txcVkTlcBn49T3OCOqeB1u7WtDR_rzbgesMymvEG0rOICR6-yf5Hw0PX_T4H8t6NWoM9wKPvdQe202NWGjZQ5W8_M3RyBZT-WAA602e-uRTqhWBZbMha5YRe6uOTDfSIX0dff1ChJasvN8iz3TztJ4iNLU8Zx9knBwAOgy2stOYuDXO5fBdUu0rdMe4CT3iWM-592FHlwmJU8h5xa-kN1kYwdcBO4ZVH2B6zJSKXfPVDkhBNmRYmC--dlVNBiL_xfU_e1C285RWHD_KX0RC-6nOlBUMbjoGuNrjisgaSkRc9-w2Z2ljxNh1m2IBPC08fW6fnVEHS_-UUorDhC2EvcSRK29tbA51yowzIZhCD_EyxY8JF-olTCxiuyFLy2bYv3i--JJfcGiURmQWDt_Es6VUeY-hUOgYg9l5WG2FKrfl_xf2iHJ6SsKdcTVkSLN_mgNYH-7NssVlicy4RHyLOWwz5JOlPLXJ8dWuPiLeYtc3lWccYscI9FIjiMn_gSn_w5zOczE46chNlFZtocuaSDL5z16y0DqbdRqQ0nUMgea8V2b1w6Yz4_f8fjGm3Y-u-zejBVUc1YFzO9Jl6ZuxhDFzgg5IpWmFPIxenKXFAGP9LMi0YBrqwps8-4U_D6_96W8ggOiO-jbLX9jhE6H80tDCl5jGAx4j7dl5KNbM1aX3sMqqJWF03LM8PNB-FaQXA9LtUsfvl5nAq6QrEmFOPfE9N0OrS_zgPnxD7FR9IDOnyMq3iVbtGbz8a_zQQF7MR0lQ2WbaNJBSJ4_L80VQqQJR4lRv_QNHD6Ut2V8K7_tQv39TGjpmRRPpmAKp-bmdlqDMm35KrxWl7jgi0t2aMVpxksdx-7qwBC9hOfb5zICutbswkfgIR_f3RliwmVg_YxjhffhvJXJqDrUrdccRYVPavmGGJPCs9LKiXTLpIqS13uSyHaOuOZ6ED6g_XEB76lPnLqY5O93qmskIWODYKulfA5G5q1o5UV1Ck8spEwZ_tCc7qIi2lpRZPn20qJXLXXFWohDTqlPe8oeL5TwJmS8gnwVDsLmKCD-xp7ryeujuvZLZ45a2ORgKGgbRVqBVSLSvbe-i2NWhBGYQmBPuDPZHxnHWgVIS24RpQexP7od-KMv8_UXObu8at4YNM1xxe2PAtx346_knbCI_IKcpb_aoYw4dkSqoRb33ggasdXJfcVSYzdAIFfH3KICEFxua9Nm2vl5_nWaaeKIquqqcTUGxBSySIZBDhTLRQBqyS9gWzKUZW_4gvUiqYiPweVGzJZvTvLWc_XwKW1jz9hMd_TbZk7x1lJsI_IFjLXGUMcxAefyltrrPDML9I443RUaSLo7eUWcQEJ8m8&cid=CAQSOwDq26N97c_roqBMwG2uih2V2UicfdL_XAmRC9vdfbaTGdnmWxSum1MHSAJ5TBIQTK5UTW7CmKZunEf_GAEgEw&rfl=5%2Chttps%253A%252F%252Fwww.bg3.co%242%2C%2C%2Chttps%253A%252F%252Fwww.bg3.co%252F%240

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/di-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

72b8d03b6538b339b263ed1f8b4708324e6c81093a94c46eb5b897459e167b4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2844491747&adf=53498480&pi=t.ma~as.3006%2F14006&w=336&lmt=1668141998&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1668141997921&bpp=13&bdt=580&idt=721&shv=r20221109&mjsv=m202211030101&ptt=5&saldr=sa&cookie=ID%3D7424e70c42b0e229%3AT%3D1668141990%3AS%3DALNI_Ma_zn52qfbC-C-Sn8uIzpzkw6TYWg&gpic=UID%3D00000b795b7e4242%3AT%3D1668141990%3ART%3D1668141990%3AS%3DALNI_MbHNmAN3NzQn7wiMpFb07Wpx4hRoQ&correlator=2851980570204&frm=23&ife=1&pv=2&ga_vid=1042930634.1668141991&ga_sid=1668141999&ga_hid=106843725&ga_fc=1&nhd=3&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=1050797798&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531705%2C44777508%2C31070617%2C31070762%2C31070785%2C44775017&oid=2&pvsid=74479620173393&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.927lrfg0iy36&fsb=1&dtd=740
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:39 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11343
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221109/r20110914/client/ Frame B819 3 KB
1 KB 275ms
273ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221109/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2844491747&adf=53498480&pi=t.ma~as.3006%2F14006&w=336&lmt=1668141998&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1668141997921&bpp=13&bdt=580&idt=721&shv=r20221109&mjsv=m202211030101&ptt=5&saldr=sa&cookie=ID%3D7424e70c42b0e229%3AT%3D1668141990%3AS%3DALNI_Ma_zn52qfbC-C-Sn8uIzpzkw6TYWg&gpic=UID%3D00000b795b7e4242%3AT%3D1668141990%3ART%3D1668141990%3AS%3DALNI_MbHNmAN3NzQn7wiMpFb07Wpx4hRoQ&correlator=2851980570204&frm=23&ife=1&pv=2&ga_vid=1042930634.1668141991&ga_sid=1668141999&ga_hid=106843725&ga_fc=1&nhd=3&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=1050797798&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531705%2C44777508%2C31070617%2C31070762%2C31070785%2C44775017&oid=2&pvsid=74479620173393&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.927lrfg0iy36&fsb=1&dtd=740

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 10 Nov 2022 20:31:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29716
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Nov 2022 20:31:23 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221109/r20110914/client/ Frame B819 18 KB
7 KB 276ms
274ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2844491747&adf=53498480&pi=t.ma~as.3006%2F14006&w=336&lmt=1668141998&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1668141997921&bpp=13&bdt=580&idt=721&shv=r20221109&mjsv=m202211030101&ptt=5&saldr=sa&cookie=ID%3D7424e70c42b0e229%3AT%3D1668141990%3AS%3DALNI_Ma_zn52qfbC-C-Sn8uIzpzkw6TYWg&gpic=UID%3D00000b795b7e4242%3AT%3D1668141990%3ART%3D1668141990%3AS%3DALNI_MbHNmAN3NzQn7wiMpFb07Wpx4hRoQ&correlator=2851980570204&frm=23&ife=1&pv=2&ga_vid=1042930634.1668141991&ga_sid=1668141999&ga_hid=106843725&ga_fc=1&nhd=3&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=1050797798&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531705%2C44777508%2C31070617%2C31070762%2C31070785%2C44775017&oid=2&pvsid=74479620173393&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.927lrfg0iy36&fsb=1&dtd=740

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f841e16a15c87fd62a9fd964cbe0f0a42e8c4a890a8b4f706729c0cc53054dc2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 10 Nov 2022 20:31:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29716
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7417
x-xss-protection: 0
server: cafe
etag: 18318620284716439044
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Nov 2022 20:31:23 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame B819 0
0 329ms
328ms Image
text/html 142.251.12.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTZkSTuG3eFX3oHl4OT2evVWg0XHsyHaRTXGuCPz6MFr7kaS9bGoZPLkpc9Mbhb4p4jNOr6GPuQBaUf2bJ9Kw3bzF1tDg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2844491747&adf=53498480&pi=t.ma~as.3006%2F14006&w=336&lmt=1668141998&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1668141997921&bpp=13&bdt=580&idt=721&shv=r20221109&mjsv=m202211030101&ptt=5&saldr=sa&cookie=ID%3D7424e70c42b0e229%3AT%3D1668141990%3AS%3DALNI_Ma_zn52qfbC-C-Sn8uIzpzkw6TYWg&gpic=UID%3D00000b795b7e4242%3AT%3D1668141990%3ART%3D1668141990%3AS%3DALNI_MbHNmAN3NzQn7wiMpFb07Wpx4hRoQ&correlator=2851980570204&frm=23&ife=1&pv=2&ga_vid=1042930634.1668141991&ga_sid=1668141999&ga_hid=106843725&ga_fc=1&nhd=3&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=1050797798&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531705%2C44777508%2C31070617%2C31070762%2C31070785%2C44775017&oid=2&pvsid=74479620173393&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.927lrfg0iy36&fsb=1&dtd=740
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.12.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f147.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B819 154 KB
47 KB 304ms
300ms Script
text/javascript 74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2844491747&adf=53498480&pi=t.ma~as.3006%2F14006&w=336&lmt=1668141998&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1668141997921&bpp=13&bdt=580&idt=721&shv=r20221109&mjsv=m202211030101&ptt=5&saldr=sa&cookie=ID%3D7424e70c42b0e229%3AT%3D1668141990%3AS%3DALNI_Ma_zn52qfbC-C-Sn8uIzpzkw6TYWg&gpic=UID%3D00000b795b7e4242%3AT%3D1668141990%3ART%3D1668141990%3AS%3DALNI_MbHNmAN3NzQn7wiMpFb07Wpx4hRoQ&correlator=2851980570204&frm=23&ife=1&pv=2&ga_vid=1042930634.1668141991&ga_sid=1668141999&ga_hid=106843725&ga_fc=1&nhd=3&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=1050797798&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531705%2C44777508%2C31070617%2C31070762%2C31070785%2C44775017&oid=2&pvsid=74479620173393&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.927lrfg0iy36&fsb=1&dtd=740

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

74e5d27c3ce88edecaa16bdd847929fae0ebe21d23da8e419564ced5bd844977

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48226
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1667997631252355"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 11 Nov 2022 04:46:40 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame B819 42 B
63 B 280ms
278ms Image
image/gif 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BVoQ-EJbheb3SRFcgXHXeY2CdLgebILLNHqd0iFDhYxMazYZWJfSr_5TrdPxro1z8d2nyjU35-ZFQd0JXOEN4mc_YxmEf_qqC9sejq2rdygG_hRxM

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2844491747&adf=53498480&pi=t.ma~as.3006%2F14006&w=336&lmt=1668141998&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1668141997921&bpp=13&bdt=580&idt=721&shv=r20221109&mjsv=m202211030101&ptt=5&saldr=sa&cookie=ID%3D7424e70c42b0e229%3AT%3D1668141990%3AS%3DALNI_Ma_zn52qfbC-C-Sn8uIzpzkw6TYWg&gpic=UID%3D00000b795b7e4242%3AT%3D1668141990%3ART%3D1668141990%3AS%3DALNI_MbHNmAN3NzQn7wiMpFb07Wpx4hRoQ&correlator=2851980570204&frm=23&ife=1&pv=2&ga_vid=1042930634.1668141991&ga_sid=1668141999&ga_hid=106843725&ga_fc=1&nhd=3&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=1050797798&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531705%2C44777508%2C31070617%2C31070762%2C31070785%2C44775017&oid=2&pvsid=74479620173393&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.927lrfg0iy36&fsb=1&dtd=740

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:40 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sync
partners.tremorhub.com/ Frame 8747
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=tremor_video_dbm&google_cm&google_dbm
https://partners.tremorhub.com/sync?UIGL=CAESEARrdoZ53s7jSb9adhk_VAU&google_cver=1

43 B
183 B

1028ms
339ms

Image
image/gif

18.211.109.126

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partners.tremorhub.com/sync?UIGL=CAESEARrdoZ53s7jSb9adhk_VAU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COXuopICELGQ6u0CGIjy_9QBMAE&v=APEucNWv-u4dakH-q3VVVhoGP2wyXjdW_t_J1XnGgoKsr7zi8LMSKE16ACgKU2pjP4nnoc_6qYvBafIYf0OhMnNk_8AtDs1bvg
Protocol: H2
Server: 18.211.109.126 -, , ASN (),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Fri, 11 Nov 2022 04:46:41 GMT
server: Apache-Coyote/1.1
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:40 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://partners.tremorhub.com/sync?UIGL=CAESEARrdoZ53s7jSb9adhk_VAU&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 283
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200

partner
sync.search.spotxchange.com/ Frame 8747
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEKuyagnYUrOLlIUGXMKXwtg&google_cver=1
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEKuyagnYUrOLlIUGXMKXwtg&google_cver=1&__user_check__=1&sync_id=d598c4b0-617b-11ed-a259-172ab80b0207

43 B
548 B

236ms
236ms

Image
image/gif

103.71.26.125

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEKuyagnYUrOLlIUGXMKXwtg&google_cver=1&__user_check__=1&sync_id=d598c4b0-617b-11ed-a259-172ab80b0207
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COXuopICELGQ6u0CGIjy_9QBMAE&v=APEucNWv-u4dakH-q3VVVhoGP2wyXjdW_t_J1XnGgoKsr7zi8LMSKE16ACgKU2pjP4nnoc_6qYvBafIYf0OhMnNk_8AtDs1bvg
Protocol: HTTP/1.1
Server: 103.71.26.125 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:41 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 16
Connection: keep-alive
Content-Length: 43

Redirect headers

Date: Fri, 11 Nov 2022 04:46:41 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Location: /partner?adv_id=7025&uid=CAESEKuyagnYUrOLlIUGXMKXwtg&google_cver=1&__user_check__=1&sync_id=d598c4b0-617b-11ed-a259-172ab80b0207
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 1
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8747
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID
https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID&__user_check__=1&sync_i...
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=ZDU5OGE5NzItNjE3Yi0xMWVkLWExMmQtMTY1YTI2MzcwMjA3

170 B
188 B

282ms
281ms

Image
image/png

142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=ZDU5OGE5NzItNjE3Yi0xMWVkLWExMmQtMTY1YTI2MzcwMjA3

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COXuopICELGQ6u0CGIjy_9QBMAE&v=APEucNWv-u4dakH-q3VVVhoGP2wyXjdW_t_J1XnGgoKsr7zi8LMSKE16ACgKU2pjP4nnoc_6qYvBafIYf0OhMnNk_8AtDs1bvg

Protocol

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 11 Nov 2022 04:46:41 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Location: https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=ZDU5OGE5NzItNjE3Yi0xMWVkLWExMmQtMTY1YTI2MzcwMjA3
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 50
Connection: keep-alive
Content-Length: 0

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame B819 41 KB
15 KB 274ms
274ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BEEycUf1IXAA5HcJZDq808NvGrUkLqKAIsW5sNZSjQ9xUUE7y72o74dgvJjMM3GlFN-sP6a_pknMPPGFdvFXtM_G0X9Pp1ELOqm-Ny5eHi-AlaaOy9R5FeiJTdYjTALEOQr8By8tV0kOTuncdkV9cqV5-sir-Aps4t6LNcMVOIJBa-cjs&cry=1&dbm_d=AKAmf-CLlGIe0MLk5CdYje3mDjmoufpoCKe_32BwGwvJGQns04PrJuqy37lsMStvSn6FtCIETvowElPhk5SGgDFg1mf5mxjDljAmvxUGcVkG1olt1p5IMj4RzXR9Sak-NZz7WmSRT269XyJWxbcjvn6tOZR3M4mybQZxH0B3bPm-5VJBim1YrRVrX6MWHIqH_Gu1jhscNowBUDbs_mbcSC6LLJ70oe_0oUIHCd7iFPf96DsVN1s3TVPmkShTww29VUnkaeylLL684XbYGEXf4TyBoG1_-t45S-zMnNzn4CMPqiUAathIlZP3_YWwRApop7OVDbmROQjvBMVR2BFcx4_wrG7_38FFKlhFboS8ZuP49304-7P2t8uzsXfpvrrBUfJLAy09fFBafeu9vFGtqzDJg9aEm072ePD1V75rF0fsk0OA1EQiaNG6yoNhs2TqN5ipEYadgVzPsKehhprXrLtMym9m-nN9L0l2oNQ_pFNwI6XdQmqX7qMsKrvbANQYuRBRCd8-GI-dnF8m6ZKZyDhcKvbTTti75uWXiBMLcXSnWdfPPGNAx7ZC-1R_3t8-z-Bswbpug8-DCS_3y4ogPPtBPclv3kUIAuun9ShzUVCxRiDGw8V4LBkZgq2A5mvWaZbji2wJznktCRd5KlpBw3m5fyw1zCtF8dktbdi4F61fE5llu8BBy4SdWRsqH3cGho0LapcqDufmMhxAKMpSCc7p4LlKEG7qCGTCC6yhvfiJDMjea6nDDxmYi7FarSJOa-0jIRXNh62hY4azxPWUs77CA465f-iSypMXawi9hVoTYYv8cNfDz1jMhoO5lTCeiET7uZkAczTYOs9GHuhh4ZS_QvsfZfIm0do1qMuSZFNu4qMcYURx_BLrGE5A1ksOUmSEcc3gW0IJWLTGE4UIpHptfa77OuNC1bktJoV8_B5pPo6EGD2mCc3WonJz-jkkhj-QQguQ4TpR-ibH3EyEdo5tPiqNCiuhgsGAjWV7fonqYFZNySTI6fG8_9cQgL8HCw6YTsjBxzMIcCpXI6QFk9VcOsUMoBVF0dzRH4fFrwo22BfCoa182BSPdjikeuJc5ugdXxM8laPQg95_wVc3CMieQNEszQ-jTlFLoafgIjm8vrNKcHfDLEzqEt42v7N5mGx9lsNgyMaxU-hwIfdaADm5qdIFE2e9XqrvpJ-IPUxBQvRPhmtVSINkxAwSghwy8MWUlFv1EL4K24TjHMpvBTAfuD6tzeFIbhAtgLKjXaoiGGL2tf4l3TnQ-01KoYsnSzWAvuoGZ1sNno5YFUgHbvRXN1tfQvqlskIflUz6mPe0CkB_TwV7xhXUH9S_VbLFyFfxfUfi4KE9Qzjb3dqwuj4CGQjg9dVMXheRIzj8aaDXJXblxPpAeNqGHquXIlPdGL4JI-dRUpWOf2URX4wcYIh9Hp7_l9lrPSgGjc4K8W9fey6-Nm_hGmYCHRCYRmUdY6ks68R3BQ3dqppyVVaMIMojYiR8Xtj3YmOLj2NzU-q56jy_jbolFW_4trrikLpHk-xEBvZ3lnjSYXF0qmwT93lbESpQ0NW_XqSaWnTheQISbBq_AkO3i0IxFcb1rJlwFF0Lw8ekSRx2L0f3Ae_Bh9xIo57LWgGsIaqXfRqsF0ymr_-QJK1heR4mhBmmn2UVgMTkGJU1vzg4sa8Mmlhi9K0-YfON4etRpBjZlb0B1pHfWPSHG06FAgVWoFHCBSI6RPxoUodVily-b-iar-lhkMbKynwQcyW1NkAQ0-fqP9I-Nd-DqLjO93_Cj5VZ4vqhoMEGhQRGS0mYGpx5-zshP6LW0gRxDY0r6WOxol6lRo4GeN1QSdrLuCPNd6VoS5KZkfLXvwefJg1kpp75USA4WcajtrdjnrkmhlxKn_O39QruAb54VlzrIOnEoDI2-YQRIV03DClz4afMEF5DjezMkmI_V9rK_fUwC7dHULX3NqawfzxOb8eLESImdR-P1n4xTe1bD_h72StNNeVBY4OpbZmEk64gWO32g9g6MfwGeZ4txcVkTlcBn49T3OCOqeB1u7WtDR_rzbgesMymvEG0rOICR6-yf5Hw0PX_T4H8t6NWoM9wKPvdQe202NWGjZQ5W8_M3RyBZT-WAA602e-uRTqhWBZbMha5YRe6uOTDfSIX0dff1ChJasvN8iz3TztJ4iNLU8Zx9knBwAOgy2stOYuDXO5fBdUu0rdMe4CT3iWM-592FHlwmJU8h5xa-kN1kYwdcBO4ZVH2B6zJSKXfPVDkhBNmRYmC--dlVNBiL_xfU_e1C285RWHD_KX0RC-6nOlBUMbjoGuNrjisgaSkRc9-w2Z2ljxNh1m2IBPC08fW6fnVEHS_-UUorDhC2EvcSRK29tbA51yowzIZhCD_EyxY8JF-olTCxiuyFLy2bYv3i--JJfcGiURmQWDt_Es6VUeY-hUOgYg9l5WG2FKrfl_xf2iHJ6SsKdcTVkSLN_mgNYH-7NssVlicy4RHyLOWwz5JOlPLXJ8dWuPiLeYtc3lWccYscI9FIjiMn_gSn_w5zOczE46chNlFZtocuaSDL5z16y0DqbdRqQ0nUMgea8V2b1w6Yz4_f8fjGm3Y-u-zejBVUc1YFzO9Jl6ZuxhDFzgg5IpWmFPIxenKXFAGP9LMi0YBrqwps8-4U_D6_96W8ggOiO-jbLX9jhE6H80tDCl5jGAx4j7dl5KNbM1aX3sMqqJWF03LM8PNB-FaQXA9LtUsfvl5nAq6QrEmFOPfE9N0OrS_zgPnxD7FR9IDOnyMq3iVbtGbz8a_zQQF7MR0lQ2WbaNJBSJ4_L80VQqQJR4lRv_QNHD6Ut2V8K7_tQv39TGjpmRRPpmAKp-bmdlqDMm35KrxWl7jgi0t2aMVpxksdx-7qwBC9hOfb5zICutbswkfgIR_f3RliwmVg_YxjhffhvJXJqDrUrdccRYVPavmGGJPCs9LKiXTLpIqS13uSyHaOuOZ6ED6g_XEB76lPnLqY5O93qmskIWODYKulfA5G5q1o5UV1Ck8spEwZ_tCc7qIi2lpRZPn20qJXLXXFWohDTqlPe8oeL5TwJmS8gnwVDsLmKCD-xp7ryeujuvZLZ45a2ORgKGgbRVqBVSLSvbe-i2NWhBGYQmBPuDPZHxnHWgVIS24RpQexP7od-KMv8_UXObu8at4YNM1xxe2PAtx346_knbCI_IKcpb_aoYw4dkSqoRb33ggasdXJfcVSYzdAIFfH3KICEFxua9Nm2vl5_nWaaeKIquqqcTUGxBSySIZBDhTLRQBqyS9gWzKUZW_4gvUiqYiPweVGzJZvTvLWc_XwKW1jz9hMd_TbZk7x1lJsI_IFjLXGUMcxAefyltrrPDML9I443RUaSLo7eUWcQEJ8m8&cid=CAQSOwDq26N97c_roqBMwG2uih2V2UicfdL_XAmRC9vdfbaTGdnmWxSum1MHSAJ5TBIQTK5UTW7CmKZunEf_GAEgEw&rfl=5%2Chttps%253A%252F%252Fwww.bg3.co%242%2C%2C%2Chttps%253A%252F%252Fwww.bg3.co%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 06:54:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 165148
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 09 Nov 2023 06:54:12 GMT

GET
H/1.1 200
OK frm Show response
www.adtrek.co/adserver/ Frame A288 19 KB
19 KB 147ms
146ms Document
text/html 13.239.108.8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.adtrek.co/adserver/frm?cc=fcb3f972-9db4-4f65-b7c1-38e0868ff0c1&clk=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DClq7HrtNtY_28MM-1yAOX8J7wBav5xJxtudKJ-_sQv831_JotEAEg0syBGmCr7LGF4BigAbCCq5MByAEJqQKQfgfb_DGkPqgDAaoE6gFP0HNUF5RfIii_S1GdGgHr1DSe94VJPkHhyunO4OvhsOYe0XlAnfsNmwUMhfkQmf4VDMzBFDe-X8LiO0_mKF6aYeZ1DkUIyLLa2gHP89smvwETXYiayl725QSGIVZbrknqLBLbjAWX-Io2bBEHYoLp3-s0zT8ARrtyvPPHfybQBAHAWifI5ilkUOkaUR_8ZIT2YUjsLBwb24w2cUzqSzHDPIKEoT6nBrY43OapGnmcT4GC-jEqtn6f8PbLZLQcz_Rlhz_-1T6Qviu6K-7Yw-xT5RmX2PyjSYYHcC4eFV0gS3o8EKhRqF9CySPABJe779efBOAEA5AGAaAGTYAHuP3U7AKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIBhEAEYXTICigI6AoBAgAoDmAsByAsBgAwBsBPVpIoRyBOh37rhA9ATANgTCtgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N97c_roqBMwG2uih2V2UicfdL_XAmRC9vdfbaTGdnmWxSum1MHSAJ5TBIQTK5UTW7CmKZunEf_GAEgEw%26sig%3DAOD64_2MzTgyV2IddUgHG7gWC38OscP8zg%26client%3Dca-pub-4485239425924787%26dbm_c%3DAKAmf-Dl7F-bz45VzLVE8vvyMRRw78JKhbSLYP9NHz8UEzTQpzHuBRpU0RntXCyu2gkobfkiyuzGpOdIgDu-k9Kl3WIIk6PTFB8SrQA5zY14rr60S5ypXDmnXXxyccEHJM8SJOvMECA_MnDqiwiwZZ71sDvRUibL2e1qhQW07AyVoBH36BBhKjw%26cry%3D1%26dbm_d%3DAKAmf-AUC2Ai7hgt_XzNBDJO9s94f-ZYfTvEAroksCHF2NIBVYwE7BjneGOp-KQ0tdHigEyLhQq3-pGz0FGO86cEDRRjFkSjkBg6QrNMtsT_qUkqZ3LPXc5GZOqHfs0Ptwj5PgGFWlzPeYPWmROJFqS7Kos6wuU_FY83_sY5pThqhP5usu0EK4tRctlU6JY_Ta6KNtqx_xYU6DfbWfS2PupJIqVQtwfHTWx9we2PrkgF62Lyk5sB7AoNFzad9u_74NYw6A5O96-n3n90hKjl1790qBEHSyTQ5I_MmISioJ3nGn0UNXaJtmjHu69vMtWkWzxhKktVH-q9f48YUfEEBGvzYzMCG6i0V_wFbAiRFW3UMfuuKkPI0F7FRNNZbGlp_-yWSWYO-OrCdeABIx6nNm2_c_k0nLRc31uhEU2ydp1ImBZ2cR3F_XaYzX5XGi32JaPwiiVgz4xd_xeLEbZbWaD1ymDud8mW142WtTlJt6e6KopJ4Uw1RDo1z0F4te1yKTqTNVlDA89I4YSi-BaoaaLgNNJTb5AI0EYvKw-fRxbwy0hUGPLHxyfEB9sUI9gPas26VxQVzco6LfxmBm4Dv9yj-m7ikdpItdtDbrbZRHx0Y_htbg6-u8k%26adurl%3Dhttps%3a%2f%2fwww.adtrek.co%2fadserver%2fclick%3fcc%3dfcb3f972-9db4-4f65-b7c1-38e0868ff0c1&ord=1668141998794237
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2844491747&adf=53498480&pi=t.ma~as.3006%2F14006&w=336&lmt=1668141998&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1668141997921&bpp=13&bdt=580&idt=721&shv=r20221109&mjsv=m202211030101&ptt=5&saldr=sa&cookie=ID%3D7424e70c42b0e229%3AT%3D1668141990%3AS%3DALNI_Ma_zn52qfbC-C-Sn8uIzpzkw6TYWg&gpic=UID%3D00000b795b7e4242%3AT%3D1668141990%3ART%3D1668141990%3AS%3DALNI_MbHNmAN3NzQn7wiMpFb07Wpx4hRoQ&correlator=2851980570204&frm=23&ife=1&pv=2&ga_vid=1042930634.1668141991&ga_sid=1668141999&ga_hid=106843725&ga_fc=1&nhd=3&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=1050797798&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531705%2C44777508%2C31070617%2C31070762%2C31070785%2C44775017&oid=2&pvsid=74479620173393&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.927lrfg0iy36&fsb=1&dtd=740
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.239.108.8 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-239-108-8.ap-southeast-2.compute.amazonaws.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 3420d23dea91a85dbebbbc77a144f7dc4620a0f2ffd8ec05406b5320d0ca718f

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: keep-alive
Content-Length: 19001
Content-Type: text/html; charset=utf-8
Date: Fri, 11 Nov 2022 04:46:36 GMT
Expires: -1
Pragma: no-cache
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 5.2
X-Powered-By: ASP.NET

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame EBBB 1 KB
644 B 276ms
275ms Document
text/html 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2844491747&adf=53498480&pi=t.ma~as.3006%2F14006&w=336&lmt=1668141998&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1668141997921&bpp=13&bdt=580&idt=721&shv=r20221109&mjsv=m202211030101&ptt=5&saldr=sa&cookie=ID%3D7424e70c42b0e229%3AT%3D1668141990%3AS%3DALNI_Ma_zn52qfbC-C-Sn8uIzpzkw6TYWg&gpic=UID%3D00000b795b7e4242%3AT%3D1668141990%3ART%3D1668141990%3AS%3DALNI_MbHNmAN3NzQn7wiMpFb07Wpx4hRoQ&correlator=2851980570204&frm=23&ife=1&pv=2&ga_vid=1042930634.1668141991&ga_sid=1668141999&ga_hid=106843725&ga_fc=1&nhd=3&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=1050797798&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531705%2C44777508%2C31070617%2C31070762%2C31070785%2C44775017&oid=2&pvsid=74479620173393&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.927lrfg0iy36&fsb=1&dtd=740

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

age: 82012
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 10 Nov 2022 05:59:48 GMT
etag: 48472445140208031
expires: Fri, 11 Nov 2022 05:59:48 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame B819 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3bf72674cab932a0802141e4122535c2bf053a0e1f380c6adc14201c1c569428

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 Enabler.js Show response
s0.2mdn.net/ads/studio/ Frame A288 136 KB
46 KB 580ms
277ms Script
text/javascript 172.217.194.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/Enabler.js

Requested by

Host: www.adtrek.co
URL: https://www.adtrek.co/adserver/frm?cc=fcb3f972-9db4-4f65-b7c1-38e0868ff0c1&clk=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DClq7HrtNtY_28MM-1yAOX8J7wBav5xJxtudKJ-_sQv831_JotEAEg0syBGmCr7LGF4BigAbCCq5MByAEJqQKQfgfb_DGkPqgDAaoE6gFP0HNUF5RfIii_S1GdGgHr1DSe94VJPkHhyunO4OvhsOYe0XlAnfsNmwUMhfkQmf4VDMzBFDe-X8LiO0_mKF6aYeZ1DkUIyLLa2gHP89smvwETXYiayl725QSGIVZbrknqLBLbjAWX-Io2bBEHYoLp3-s0zT8ARrtyvPPHfybQBAHAWifI5ilkUOkaUR_8ZIT2YUjsLBwb24w2cUzqSzHDPIKEoT6nBrY43OapGnmcT4GC-jEqtn6f8PbLZLQcz_Rlhz_-1T6Qviu6K-7Yw-xT5RmX2PyjSYYHcC4eFV0gS3o8EKhRqF9CySPABJe779efBOAEA5AGAaAGTYAHuP3U7AKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIBhEAEYXTICigI6AoBAgAoDmAsByAsBgAwBsBPVpIoRyBOh37rhA9ATANgTCtgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N97c_roqBMwG2uih2V2UicfdL_XAmRC9vdfbaTGdnmWxSum1MHSAJ5TBIQTK5UTW7CmKZunEf_GAEgEw%26sig%3DAOD64_2MzTgyV2IddUgHG7gWC38OscP8zg%26client%3Dca-pub-4485239425924787%26dbm_c%3DAKAmf-Dl7F-bz45VzLVE8vvyMRRw78JKhbSLYP9NHz8UEzTQpzHuBRpU0RntXCyu2gkobfkiyuzGpOdIgDu-k9Kl3WIIk6PTFB8SrQA5zY14rr60S5ypXDmnXXxyccEHJM8SJOvMECA_MnDqiwiwZZ71sDvRUibL2e1qhQW07AyVoBH36BBhKjw%26cry%3D1%26dbm_d%3DAKAmf-AUC2Ai7hgt_XzNBDJO9s94f-ZYfTvEAroksCHF2NIBVYwE7BjneGOp-KQ0tdHigEyLhQq3-pGz0FGO86cEDRRjFkSjkBg6QrNMtsT_qUkqZ3LPXc5GZOqHfs0Ptwj5PgGFWlzPeYPWmROJFqS7Kos6wuU_FY83_sY5pThqhP5usu0EK4tRctlU6JY_Ta6KNtqx_xYU6DfbWfS2PupJIqVQtwfHTWx9we2PrkgF62Lyk5sB7AoNFzad9u_74NYw6A5O96-n3n90hKjl1790qBEHSyTQ5I_MmISioJ3nGn0UNXaJtmjHu69vMtWkWzxhKktVH-q9f48YUfEEBGvzYzMCG6i0V_wFbAiRFW3UMfuuKkPI0F7FRNNZbGlp_-yWSWYO-OrCdeABIx6nNm2_c_k0nLRc31uhEU2ydp1ImBZ2cR3F_XaYzX5XGi32JaPwiiVgz4xd_xeLEbZbWaD1ymDud8mW142WtTlJt6e6KopJ4Uw1RDo1z0F4te1yKTqTNVlDA89I4YSi-BaoaaLgNNJTb5AI0EYvKw-fRxbwy0hUGPLHxyfEB9sUI9gPas26VxQVzco6LfxmBm4Dv9yj-m7ikdpItdtDbrbZRHx0Y_htbg6-u8k%26adurl%3Dhttps%3a%2f%2fwww.adtrek.co%2fadserver%2fclick%3fcc%3dfcb3f972-9db4-4f65-b7c1-38e0868ff0c1&ord=1668141998794237

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f149.1e100.net

Software

sffe /

Resource Hash

bf6ec42c97f86957a324a484a37dd528b568a9ff2570965be53e6ec4b0dfdae2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:43:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 195
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46978
x-xss-protection: 0
last-modified: Mon, 06 Jun 2022 19:45:39 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 11 Nov 2022 04:58:25 GMT

GET
H/1.1 200
OK dyn-hype-multiitem.js Show response
www.adtrek.co/Scripts/Inserts/ Frame A288 11 KB
3 KB 143ms
143ms Script
application/javascript 13.239.108.8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.adtrek.co/Scripts/Inserts/dyn-hype-multiitem.js?v=1-4
Requested by: Host: www.adtrek.co
URL: https://www.adtrek.co/adserver/frm?cc=fcb3f972-9db4-4f65-b7c1-38e0868ff0c1&clk=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DClq7HrtNtY_28MM-1yAOX8J7wBav5xJxtudKJ-_sQv831_JotEAEg0syBGmCr7LGF4BigAbCCq5MByAEJqQKQfgfb_DGkPqgDAaoE6gFP0HNUF5RfIii_S1GdGgHr1DSe94VJPkHhyunO4OvhsOYe0XlAnfsNmwUMhfkQmf4VDMzBFDe-X8LiO0_mKF6aYeZ1DkUIyLLa2gHP89smvwETXYiayl725QSGIVZbrknqLBLbjAWX-Io2bBEHYoLp3-s0zT8ARrtyvPPHfybQBAHAWifI5ilkUOkaUR_8ZIT2YUjsLBwb24w2cUzqSzHDPIKEoT6nBrY43OapGnmcT4GC-jEqtn6f8PbLZLQcz_Rlhz_-1T6Qviu6K-7Yw-xT5RmX2PyjSYYHcC4eFV0gS3o8EKhRqF9CySPABJe779efBOAEA5AGAaAGTYAHuP3U7AKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIBhEAEYXTICigI6AoBAgAoDmAsByAsBgAwBsBPVpIoRyBOh37rhA9ATANgTCtgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N97c_roqBMwG2uih2V2UicfdL_XAmRC9vdfbaTGdnmWxSum1MHSAJ5TBIQTK5UTW7CmKZunEf_GAEgEw%26sig%3DAOD64_2MzTgyV2IddUgHG7gWC38OscP8zg%26client%3Dca-pub-4485239425924787%26dbm_c%3DAKAmf-Dl7F-bz45VzLVE8vvyMRRw78JKhbSLYP9NHz8UEzTQpzHuBRpU0RntXCyu2gkobfkiyuzGpOdIgDu-k9Kl3WIIk6PTFB8SrQA5zY14rr60S5ypXDmnXXxyccEHJM8SJOvMECA_MnDqiwiwZZ71sDvRUibL2e1qhQW07AyVoBH36BBhKjw%26cry%3D1%26dbm_d%3DAKAmf-AUC2Ai7hgt_XzNBDJO9s94f-ZYfTvEAroksCHF2NIBVYwE7BjneGOp-KQ0tdHigEyLhQq3-pGz0FGO86cEDRRjFkSjkBg6QrNMtsT_qUkqZ3LPXc5GZOqHfs0Ptwj5PgGFWlzPeYPWmROJFqS7Kos6wuU_FY83_sY5pThqhP5usu0EK4tRctlU6JY_Ta6KNtqx_xYU6DfbWfS2PupJIqVQtwfHTWx9we2PrkgF62Lyk5sB7AoNFzad9u_74NYw6A5O96-n3n90hKjl1790qBEHSyTQ5I_MmISioJ3nGn0UNXaJtmjHu69vMtWkWzxhKktVH-q9f48YUfEEBGvzYzMCG6i0V_wFbAiRFW3UMfuuKkPI0F7FRNNZbGlp_-yWSWYO-OrCdeABIx6nNm2_c_k0nLRc31uhEU2ydp1ImBZ2cR3F_XaYzX5XGi32JaPwiiVgz4xd_xeLEbZbWaD1ymDud8mW142WtTlJt6e6KopJ4Uw1RDo1z0F4te1yKTqTNVlDA89I4YSi-BaoaaLgNNJTb5AI0EYvKw-fRxbwy0hUGPLHxyfEB9sUI9gPas26VxQVzco6LfxmBm4Dv9yj-m7ikdpItdtDbrbZRHx0Y_htbg6-u8k%26adurl%3Dhttps%3a%2f%2fwww.adtrek.co%2fadserver%2fclick%3fcc%3dfcb3f972-9db4-4f65-b7c1-38e0868ff0c1&ord=1668141998794237
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.239.108.8 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-239-108-8.ap-southeast-2.compute.amazonaws.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: f824af6240aaa57ba4104f1969365afa9b6904544545284db4a7469e6a94768a

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/adserver/frm?cc=fcb3f972-9db4-4f65-b7c1-38e0868ff0c1&clk=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DClq7HrtNtY_28MM-1yAOX8J7wBav5xJxtudKJ-_sQv831_JotEAEg0syBGmCr7LGF4BigAbCCq5MByAEJqQKQfgfb_DGkPqgDAaoE6gFP0HNUF5RfIii_S1GdGgHr1DSe94VJPkHhyunO4OvhsOYe0XlAnfsNmwUMhfkQmf4VDMzBFDe-X8LiO0_mKF6aYeZ1DkUIyLLa2gHP89smvwETXYiayl725QSGIVZbrknqLBLbjAWX-Io2bBEHYoLp3-s0zT8ARrtyvPPHfybQBAHAWifI5ilkUOkaUR_8ZIT2YUjsLBwb24w2cUzqSzHDPIKEoT6nBrY43OapGnmcT4GC-jEqtn6f8PbLZLQcz_Rlhz_-1T6Qviu6K-7Yw-xT5RmX2PyjSYYHcC4eFV0gS3o8EKhRqF9CySPABJe779efBOAEA5AGAaAGTYAHuP3U7AKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIBhEAEYXTICigI6AoBAgAoDmAsByAsBgAwBsBPVpIoRyBOh37rhA9ATANgTCtgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N97c_roqBMwG2uih2V2UicfdL_XAmRC9vdfbaTGdnmWxSum1MHSAJ5TBIQTK5UTW7CmKZunEf_GAEgEw%26sig%3DAOD64_2MzTgyV2IddUgHG7gWC38OscP8zg%26client%3Dca-pub-4485239425924787%26dbm_c%3DAKAmf-Dl7F-bz45VzLVE8vvyMRRw78JKhbSLYP9NHz8UEzTQpzHuBRpU0RntXCyu2gkobfkiyuzGpOdIgDu-k9Kl3WIIk6PTFB8SrQA5zY14rr60S5ypXDmnXXxyccEHJM8SJOvMECA_MnDqiwiwZZ71sDvRUibL2e1qhQW07AyVoBH36BBhKjw%26cry%3D1%26dbm_d%3DAKAmf-AUC2Ai7hgt_XzNBDJO9s94f-ZYfTvEAroksCHF2NIBVYwE7BjneGOp-KQ0tdHigEyLhQq3-pGz0FGO86cEDRRjFkSjkBg6QrNMtsT_qUkqZ3LPXc5GZOqHfs0Ptwj5PgGFWlzPeYPWmROJFqS7Kos6wuU_FY83_sY5pThqhP5usu0EK4tRctlU6JY_Ta6KNtqx_xYU6DfbWfS2PupJIqVQtwfHTWx9we2PrkgF62Lyk5sB7AoNFzad9u_74NYw6A5O96-n3n90hKjl1790qBEHSyTQ5I_MmISioJ3nGn0UNXaJtmjHu69vMtWkWzxhKktVH-q9f48YUfEEBGvzYzMCG6i0V_wFbAiRFW3UMfuuKkPI0F7FRNNZbGlp_-yWSWYO-OrCdeABIx6nNm2_c_k0nLRc31uhEU2ydp1ImBZ2cR3F_XaYzX5XGi32JaPwiiVgz4xd_xeLEbZbWaD1ymDud8mW142WtTlJt6e6KopJ4Uw1RDo1z0F4te1yKTqTNVlDA89I4YSi-BaoaaLgNNJTb5AI0EYvKw-fRxbwy0hUGPLHxyfEB9sUI9gPas26VxQVzco6LfxmBm4Dv9yj-m7ikdpItdtDbrbZRHx0Y_htbg6-u8k%26adurl%3Dhttps%3a%2f%2fwww.adtrek.co%2fadserver%2fclick%3fcc%3dfcb3f972-9db4-4f65-b7c1-38e0868ff0c1&ord=1668141998794237
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:37 GMT
Content-Encoding: gzip
Last-Modified: Wed, 27 Apr 2022 14:29:24 GMT
Server: Microsoft-IIS/8.5
ETag: "0fa1131435ad81:0"
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2968

GET
H/1.1 200
OK pol.jpg
s3-ap-southeast-2.amazonaws.com/adtrek/07ac50ae-890c-49c9-9738-0f86fce19e76/ Frame A288 23 KB
23 KB 154ms
150ms Image
image/jpeg 52.95.129.116
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/07ac50ae-890c-49c9-9738-0f86fce19e76/pol.jpg
Requested by: Host: www.adtrek.co
URL: https://www.adtrek.co/adserver/frm?cc=fcb3f972-9db4-4f65-b7c1-38e0868ff0c1&clk=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DClq7HrtNtY_28MM-1yAOX8J7wBav5xJxtudKJ-_sQv831_JotEAEg0syBGmCr7LGF4BigAbCCq5MByAEJqQKQfgfb_DGkPqgDAaoE6gFP0HNUF5RfIii_S1GdGgHr1DSe94VJPkHhyunO4OvhsOYe0XlAnfsNmwUMhfkQmf4VDMzBFDe-X8LiO0_mKF6aYeZ1DkUIyLLa2gHP89smvwETXYiayl725QSGIVZbrknqLBLbjAWX-Io2bBEHYoLp3-s0zT8ARrtyvPPHfybQBAHAWifI5ilkUOkaUR_8ZIT2YUjsLBwb24w2cUzqSzHDPIKEoT6nBrY43OapGnmcT4GC-jEqtn6f8PbLZLQcz_Rlhz_-1T6Qviu6K-7Yw-xT5RmX2PyjSYYHcC4eFV0gS3o8EKhRqF9CySPABJe779efBOAEA5AGAaAGTYAHuP3U7AKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIBhEAEYXTICigI6AoBAgAoDmAsByAsBgAwBsBPVpIoRyBOh37rhA9ATANgTCtgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N97c_roqBMwG2uih2V2UicfdL_XAmRC9vdfbaTGdnmWxSum1MHSAJ5TBIQTK5UTW7CmKZunEf_GAEgEw%26sig%3DAOD64_2MzTgyV2IddUgHG7gWC38OscP8zg%26client%3Dca-pub-4485239425924787%26dbm_c%3DAKAmf-Dl7F-bz45VzLVE8vvyMRRw78JKhbSLYP9NHz8UEzTQpzHuBRpU0RntXCyu2gkobfkiyuzGpOdIgDu-k9Kl3WIIk6PTFB8SrQA5zY14rr60S5ypXDmnXXxyccEHJM8SJOvMECA_MnDqiwiwZZ71sDvRUibL2e1qhQW07AyVoBH36BBhKjw%26cry%3D1%26dbm_d%3DAKAmf-AUC2Ai7hgt_XzNBDJO9s94f-ZYfTvEAroksCHF2NIBVYwE7BjneGOp-KQ0tdHigEyLhQq3-pGz0FGO86cEDRRjFkSjkBg6QrNMtsT_qUkqZ3LPXc5GZOqHfs0Ptwj5PgGFWlzPeYPWmROJFqS7Kos6wuU_FY83_sY5pThqhP5usu0EK4tRctlU6JY_Ta6KNtqx_xYU6DfbWfS2PupJIqVQtwfHTWx9we2PrkgF62Lyk5sB7AoNFzad9u_74NYw6A5O96-n3n90hKjl1790qBEHSyTQ5I_MmISioJ3nGn0UNXaJtmjHu69vMtWkWzxhKktVH-q9f48YUfEEBGvzYzMCG6i0V_wFbAiRFW3UMfuuKkPI0F7FRNNZbGlp_-yWSWYO-OrCdeABIx6nNm2_c_k0nLRc31uhEU2ydp1ImBZ2cR3F_XaYzX5XGi32JaPwiiVgz4xd_xeLEbZbWaD1ymDud8mW142WtTlJt6e6KopJ4Uw1RDo1z0F4te1yKTqTNVlDA89I4YSi-BaoaaLgNNJTb5AI0EYvKw-fRxbwy0hUGPLHxyfEB9sUI9gPas26VxQVzco6LfxmBm4Dv9yj-m7ikdpItdtDbrbZRHx0Y_htbg6-u8k%26adurl%3Dhttps%3a%2f%2fwww.adtrek.co%2fadserver%2fclick%3fcc%3dfcb3f972-9db4-4f65-b7c1-38e0868ff0c1&ord=1668141998794237
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.129.116 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 27d75be1a23c71b6f0192f0f85cc0d5cb3f2a5b29ae2b4c33e3eb580a2836661

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Nov 2022 04:46:41 GMT
Content-Encoding: gzip
Last-Modified: Mon, 05 Sep 2022 22:24:02 GMT
Server: AmazonS3
x-amz-request-id: 08GVVFWQH5490S4D
ETag: "d9529524ffd7b6a2fc5f142cf5f0cea7"
x-amz-meta-info: polite loading image
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 22838
x-amz-id-2: 4+lco8aN9TIgxgLIyjm4+BDwkPq1JkM2Fkv++Gge4Ps1fV4LyROxU2CqN/4ccub5HgZWBJTfhIE=

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 9EB6 2 KB
1 KB 235ms
234ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.as.criteo.com
URL: https://ads.as.criteo.com/delivery/r/afr.php?z=Y23TrgANZUMDgwF1AAnJ-6I6Sctolp5oadosmw&u=%7CT8X2drWCLzn8TjB31gTPsHsEbiBUjwL5KhQkK6owNTA%3D%7C&c1=wLMhjbQtwRerfuYQvtYvucUfx71c_57oZ7-4NEldJVPEcquQgoC5ayq1XBwsz6hbCNpksUhOYIG9jsbcdhUPUASS9TekPJg-As5Ce6q-DLN0-Sne60wEQ-VoTshP9T-Z8t9SqI7hzTiSTQqPbCdc1muRZLgODpDKCVOACJ2kBsR0GVJjl289ip7NZ_sc6q_s-bGSZwYLVEVoq8aCyZ7WpS6yNazhairwURQ4MRst_Urposek7FKbX_44VyOCNIfiqPnCy2hgeva43WHhFS0XspbYZUj8zzuB-dutXivhMEJfhrbg0xHMPju0-_xExIvIYSh5Wh7WMPOhPOCWCbqYh49BvfV5WAnehksriFL5ZKHoBDDz5NW56WNMQ4vrjrLb8Ddpqz5bwzPJfkWs1lLTQsJKb5c-kEiSmtVl1vhnzy1RS_rVQ3HayP9bPejPTooCOsHHY1zlPSy3TG2fczgNp7MENFv2aUgSB6ii59jIb3IVkGgR3GKq1ApwdxbVmXMe8tFceiLN8RE1Z4fvylwnFXzPsA32h_Zz7m-t3SqmdnRfVKBJAjBuNqo5Oz_cyh-VdD7Hzjx4NhOD19KUeIRaZAcgQRsAF23zoxRK6u34hvOjYYhpzLWg985wMSsLrKHrtQnguQw9bb8&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCY8HwrtNtY8PKNfWCjMwP-5OnYJj80bFcqoTM5IUBwI23ARABIABgq-yxheAYggEXY2EtcHViLTQ0ODUyMzk0MjU5MjQ3ODfIAQmpAtHg8CULLaY-qAMBqgT3AU_QNIXX-pC86yN1fTGlb2-KJlNApgW2r-wBdw6EO4U0BuQgZZy-sFIid8A6NDbYSvE8_2VoH2TmHUKaUSSS0EsN7GlUgh13eO7Nz03615Lury49aUbngrXVZkWDNN0iXHiiBRcUh-HfI2vSU_1BIWKVb6QR_xK5dFN_Dgl2T5y35gzSQ8aQEDFX--PiQPmA2x3xB7fMwY0C62Qj3XBO_cje6u8CU_sOtCmVrGxrTUhdNsLq09uo3fPAR2vd4imInO5gopR4sO4girHk_H8AuEGuIs9rDSrhId0oPkOzYfDzhD54IHk4B8_ksafjLfIFVryFceuxmAWABvmh7dS30vndYqAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_1nY5ghb_gkh2hlXCxoP7VrpNJrjA%26client%3Dca-pub-4485239425924787%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:40 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 06 Nov 2023 04:46:40 GMT

GET
H2 200 adchoices_en.svg
static.criteo.net/flash/icon/ Frame 9EB6 2 KB
1 KB 236ms
235ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_en.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:40 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-759"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 06 Nov 2023 04:46:40 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 9EB6 308 B
636 B 283ms
281ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:40 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Mon, 06 Nov 2023 04:46:40 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 9EB6 293 B
621 B 360ms
358ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:40 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Mon, 06 Nov 2023 04:46:40 GMT

GET
H2 200 lg.php
cat.sg1.as.criteo.com/delivery/ Frame 9EB6 43 B
348 B 716ms
240ms Image
image/gif 182.161.73.132

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.sg1.as.criteo.com/delivery/lg.php?cppv=3&cpp=zFfLvTmL6mWA-AVkm3KuWvHIGhGaMSqjkHBChcrasIUbHud2fYnNLhC6iopw4yyZgE9V1fAoJ4mWarZxZFzoTVov8ChxAacF18VSOXRp1cFib19YwDtBMsKT3r4KGN5Xz0eXYnhaD-x1_JNyOgMrSAI42VHPpyKfzgC2h5c8JN3QMtHn3sTK8AkdyT_oT7dTqqhbuQyUR07OMX1YxqKdzuQa3u0rdDoyPDgJKjuksep0BnWNATFVMQdKhHNdWX-ODH3SGPOVGuqa72P3YY-wnhspph-fVqAEHWQh4ZuIZ_npERFgXbOnfvAmakUFdO1qJ7IC2wVzqawReMRKuOP3UwhOeoyhN2IH_qw8BcZurEujT84ooK65h3siWuNYQ_eDKPnxlZMxCu_pGmegEPJdBcZjxccNxeoPANOthrvi3f2DlYVc

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.132 -, , ASN (),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:40 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 4451431
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 589fa18543d74401a7e1a7bbcfd58f8e_image_ad_300x250.jpeg
static.criteo.net/design/dt/99951/221025/ Frame 9EB6 249 KB
249 KB 235ms
234ms Image
image/jpeg 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/design/dt/99951/221025/589fa18543d74401a7e1a7bbcfd58f8e_image_ad_300x250.jpeg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

59137467b97878a05285b5b6ccb9a0e0d0b3453b550ddbb712b220a53e26fb5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:40 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 25 Oct 2022 22:30:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "6358637d-3e208"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 254472
expires: Mon, 06 Nov 2023 04:46:40 GMT

POST
H2 200 all
csm.as.criteo.net/ Frame 9EB6 0
128 B 708ms
234ms Ping
text/plain 182.161.73.142

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.as.criteo.net/all?cppv=3&cpp=eoYPJi8zCWPu3AKBEmH7782UYq4L0gWFs9pS0VkdIIhNGaAJWEp6JVOrGjveJuAShI3UHGFxKGrbxWQ9jU9OnPUOUxDMhhIvyaRwfVLc-Aokzkeq_ROCJwwoL-XtHRv8CyF6NpxZjqSkARGFCKYRkw3pevxegdR-up64gkLhjxpyNCEwAtEj7C3KzGz07OBksP_i25NYtHoF2roT55ddoPsQZ5KElQmKwpyi_DAJgInQygocjJ10HtEmJX9jZaxwOH4Tt6rRezoReVMZ&sds=2&rev=83376.1&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.142 -, , ASN (),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.as.criteo.com/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 11 Nov 2022 04:46:41 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 9EB6 2 KB
1 KB 525ms
524ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:40 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 06 Nov 2023 04:46:40 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 9EB6 2 KB
1 KB 449ms
449ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:40 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 06 Nov 2023 04:46:40 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame E905 22 KB
8 KB 276ms
274ms Document
text/html 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 165365
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 09 Nov 2022 06:50:35 GMT
expires: Thu, 09 Nov 2023 06:50:35 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame EBBB
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEB2Y_O1TP4b4wLuyI1HyW2I&google_cver=1&google_push=ASkJ3FZKt1b0E_ObyJFLoqLckX1l_qieMRYrAta9t1rBQ7qabC81AsufHqf6sArOVtKBkFDMzXc13qj1ykn6YVGT35hmEjqi8AwC2...
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=Mjc3NzY2NzQ2MTIwODE5NTU0NA==&gdpr=0&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=0&gdpr_consent=&google_gid=CAESEB2Y_O1TP4b4wLuyI1HyW2I&google_cver=1

43 B
398 B

264ms
264ms

Image
image/gif

50.116.239.135
TURN-US-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=0&gdpr_consent=&google_gid=CAESEB2Y_O1TP4b4wLuyI1HyW2I&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2844491747&adf=53498480&pi=t.ma~as.3006%2F14006&w=336&lmt=1668141998&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1668141997921&bpp=13&bdt=580&idt=721&shv=r20221109&mjsv=m202211030101&ptt=5&saldr=sa&cookie=ID%3D7424e70c42b0e229%3AT%3D1668141990%3AS%3DALNI_Ma_zn52qfbC-C-Sn8uIzpzkw6TYWg&gpic=UID%3D00000b795b7e4242%3AT%3D1668141990%3ART%3D1668141990%3AS%3DALNI_MbHNmAN3NzQn7wiMpFb07Wpx4hRoQ&correlator=2851980570204&frm=23&ife=1&pv=2&ga_vid=1042930634.1668141991&ga_sid=1668141999&ga_hid=106843725&ga_fc=1&nhd=3&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=1050797798&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531705%2C44777508%2C31070617%2C31070762%2C31070785%2C44775017&oid=2&pvsid=74479620173393&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.927lrfg0iy36&fsb=1&dtd=740
Protocol: H2
Server: 50.116.239.135 , United States, ASN6336 (TURN-US-ASN, US),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Fri, 11 Nov 2022 04:46:40 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:40 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=0&gdpr_consent=&google_gid=CAESEB2Y_O1TP4b4wLuyI1HyW2I&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 330
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EBBB
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEHIIbzjgMz_jz4cK-v482_0&google_cver=1&google_push=ASkJ3FYCTKG4TxsY2zSBC_cE5kbHmbGzp2roB53EXXD3ChjmOck3il-d2EDj8GRk2E1yyS1styG8OItRuV-gIVxS...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=Y1pjbdOqQgCzoPEjY_dyMA&google_push=ASkJ3FYCTKG4TxsY2zSBC_cE5kbHmbGzp2roB53EXXD3ChjmOck3il-d2EDj8GRk2E1yyS1styG8OItRuV-gIVxSkGdQmaFm...

170 B
188 B

283ms
283ms

Image
image/png

142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=Y1pjbdOqQgCzoPEjY_dyMA&google_push=ASkJ3FYCTKG4TxsY2zSBC_cE5kbHmbGzp2roB53EXXD3ChjmOck3il-d2EDj8GRk2E1yyS1styG8OItRuV-gIVxSkGdQmaFmjicJYfspTKSX7D8JUiIKt9k66fmHr7Zb0uTySVRywB_GI642

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2844491747&adf=53498480&pi=t.ma~as.3006%2F14006&w=336&lmt=1668141998&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1668141997921&bpp=13&bdt=580&idt=721&shv=r20221109&mjsv=m202211030101&ptt=5&saldr=sa&cookie=ID%3D7424e70c42b0e229%3AT%3D1668141990%3AS%3DALNI_Ma_zn52qfbC-C-Sn8uIzpzkw6TYWg&gpic=UID%3D00000b795b7e4242%3AT%3D1668141990%3ART%3D1668141990%3AS%3DALNI_MbHNmAN3NzQn7wiMpFb07Wpx4hRoQ&correlator=2851980570204&frm=23&ife=1&pv=2&ga_vid=1042930634.1668141991&ga_sid=1668141999&ga_hid=106843725&ga_fc=1&nhd=3&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=1050797798&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531705%2C44777508%2C31070617%2C31070762%2C31070785%2C44775017&oid=2&pvsid=74479620173393&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.927lrfg0iy36&fsb=1&dtd=740

Protocol

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 11 Nov 2022 04:46:40 GMT
Server: MT3 4629 97bee97 master nrt-pixel-x6 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=Y1pjbdOqQgCzoPEjY_dyMA&google_push=ASkJ3FYCTKG4TxsY2zSBC_cE5kbHmbGzp2roB53EXXD3ChjmOck3il-d2EDj8GRk2E1yyS1styG8OItRuV-gIVxSkGdQmaFmjicJYfspTKSX7D8JUiIKt9k66fmHr7Zb0uTySVRywB_GI642
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Fri, 11 Nov 2022 04:46:39 GMT

GET
H3 200 i.match
a.tribalfusion.com/ Frame EBBB 43 B
630 B 276ms
272ms Image
image/gif 104.18.24.173
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.tribalfusion.com/i.match?p=b6&u=CAESEAfLPn04qAy4xikz7uGvVDU&google_cver=1&google_push=ASkJ3FZMh0kx-Zvr2KyXDIfZBvenbrQ3QoNmyzuvstLfOyKF-XruKylQuon1Q9LdBVC95Hz971mVBvHVagTVM-g3MMbz-RA4ULsyJC-_wI7TVWdP9tbRgHVHdQH8Vm5h78j3pCa6CoiuQzA&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DASkJ3FZMh0kx-Zvr2KyXDIfZBvenbrQ3QoNmyzuvstLfOyKF-XruKylQuon1Q9LdBVC95Hz971mVBvHVagTVM-g3MMbz-RA4ULsyJC-_wI7TVWdP9tbRgHVHdQH8Vm5h78j3pCa6CoiuQzA%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2844491747&adf=53498480&pi=t.ma~as.3006%2F14006&w=336&lmt=1668141998&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1668141997921&bpp=13&bdt=580&idt=721&shv=r20221109&mjsv=m202211030101&ptt=5&saldr=sa&cookie=ID%3D7424e70c42b0e229%3AT%3D1668141990%3AS%3DALNI_Ma_zn52qfbC-C-Sn8uIzpzkw6TYWg&gpic=UID%3D00000b795b7e4242%3AT%3D1668141990%3ART%3D1668141990%3AS%3DALNI_MbHNmAN3NzQn7wiMpFb07Wpx4hRoQ&correlator=2851980570204&frm=23&ife=1&pv=2&ga_vid=1042930634.1668141991&ga_sid=1668141999&ga_hid=106843725&ga_fc=1&nhd=3&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=1050797798&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531705%2C44777508%2C31070617%2C31070762%2C31070785%2C44775017&oid=2&pvsid=74479620173393&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.927lrfg0iy36&fsb=1&dtd=740
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.173 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:40 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 768462ae3becfb8c-AKL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EBBB
Redirect Chain

https://match.adsrvr.org/track/cmf/google?google_gid=CAESEA4jo_qfdQeVCR2KoeDt5tw&google_cver=1&google_push=ASkJ3Fb95w9CatW4gGzCF7UQ3rnHgDQ-zZWg-_8HT2t6VJ2XAndang3BCHIrkJjh6IPm6jtsjqLu6peSI3xHg84OTK...
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=MWJjMWNjZjYtZGU4ZC00OGVkLTkwOGMtYzJlMTI5YmNlOGVk&google_push&gdpr=0&gdpr_consent=&ttd_tdid=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed

170 B
188 B

281ms
281ms

Image
image/png

142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=MWJjMWNjZjYtZGU4ZC00OGVkLTkwOGMtYzJlMTI5YmNlOGVk&google_push&gdpr=0&gdpr_consent=&ttd_tdid=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2844491747&adf=53498480&pi=t.ma~as.3006%2F14006&w=336&lmt=1668141998&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1668141997921&bpp=13&bdt=580&idt=721&shv=r20221109&mjsv=m202211030101&ptt=5&saldr=sa&cookie=ID%3D7424e70c42b0e229%3AT%3D1668141990%3AS%3DALNI_Ma_zn52qfbC-C-Sn8uIzpzkw6TYWg&gpic=UID%3D00000b795b7e4242%3AT%3D1668141990%3ART%3D1668141990%3AS%3DALNI_MbHNmAN3NzQn7wiMpFb07Wpx4hRoQ&correlator=2851980570204&frm=23&ife=1&pv=2&ga_vid=1042930634.1668141991&ga_sid=1668141999&ga_hid=106843725&ga_fc=1&nhd=3&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=1050797798&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531705%2C44777508%2C31070617%2C31070762%2C31070785%2C44775017&oid=2&pvsid=74479620173393&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.927lrfg0iy36&fsb=1&dtd=740

Protocol

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:40 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=MWJjMWNjZjYtZGU4ZC00OGVkLTkwOGMtYzJlMTI5YmNlOGVk&google_push&gdpr=0&gdpr_consent=&ttd_tdid=1bc1ccf6-de8d-48ed-908c-c2e129bce8ed
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 423

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EBBB
Redirect Chain

https://a.c.appier.net/gcm?google_gid=CAESEGZ14DgfXTqKAif0ZPLUF0U&google_cver=1&google_push=ASkJ3FZH_s_PNmqKvS3rIY0B-bDe1EGfNtrWMZGEhvvFxmw-NrZmVSF-UAf0pCvKD0hbzX2339g-nLGKCCRhEXgBSnOf62tPA34aXcv1g...
https://cm.g.doubleclick.net/pixel?google_nid=appier&google_hm=RVRnYzZteW1ESE94OWdpS3F0TnRZdw%3D%3D&google_push=ASkJ3FZH_s_PNmqKvS3rIY0B-bDe1EGfNtrWMZGEhvvFxmw-NrZmVSF-UAf0pCvKD0hbzX2339g-nLGKCCRhE...

170 B
188 B

282ms
282ms

Image
image/png

142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appier&google_hm=RVRnYzZteW1ESE94OWdpS3F0TnRZdw%3D%3D&google_push=ASkJ3FZH_s_PNmqKvS3rIY0B-bDe1EGfNtrWMZGEhvvFxmw-NrZmVSF-UAf0pCvKD0hbzX2339g-nLGKCCRhEXgBSnOf62tPA34aXcv1g85TTNP9OwOtxVzpGAFLmQlz9NVQwQUfewGTsXI

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2844491747&adf=53498480&pi=t.ma~as.3006%2F14006&w=336&lmt=1668141998&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1668141997921&bpp=13&bdt=580&idt=721&shv=r20221109&mjsv=m202211030101&ptt=5&saldr=sa&cookie=ID%3D7424e70c42b0e229%3AT%3D1668141990%3AS%3DALNI_Ma_zn52qfbC-C-Sn8uIzpzkw6TYWg&gpic=UID%3D00000b795b7e4242%3AT%3D1668141990%3ART%3D1668141990%3AS%3DALNI_MbHNmAN3NzQn7wiMpFb07Wpx4hRoQ&correlator=2851980570204&frm=23&ife=1&pv=2&ga_vid=1042930634.1668141991&ga_sid=1668141999&ga_hid=106843725&ga_fc=1&nhd=3&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=1050797798&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531705%2C44777508%2C31070617%2C31070762%2C31070785%2C44775017&oid=2&pvsid=74479620173393&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.927lrfg0iy36&fsb=1&dtd=740

Protocol

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=appier&google_hm=RVRnYzZteW1ESE94OWdpS3F0TnRZdw%3D%3D&google_push=ASkJ3FZH_s_PNmqKvS3rIY0B-bDe1EGfNtrWMZGEhvvFxmw-NrZmVSF-UAf0pCvKD0hbzX2339g-nLGKCCRhEXgBSnOf62tPA34aXcv1g85TTNP9OwOtxVzpGAFLmQlz9NVQwQUfewGTsXI
date: Fri, 11 Nov 2022 04:46:40 GMT
cache-control: no-store
content-type: text/html; charset=utf-8
server: nginx
content-length: 286
p3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EBBB
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESECQI_m81qz6L95eiEGJTaQA&google_cver=1&google_push=ASkJ3FZbMB5D2D4MZFRWpwlCBvj29x7LpMPjE-F3dpBRSCzVWsSFGr68RsrGCuE65WeQcb_xSxyuaUGruxBhaMr84YHWV0fXstXFd...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=ASkJ3FZbMB5D2D4MZFRWpwlCBvj29x7LpMPjE-F3dpBRSCzVWsSFGr68RsrGCuE65WeQcb_xSxyuaUGruxBhaMr84YHWV0fXstXFdx203MkYFx4PpCEIFIa5bMLCH63Z0VmCz3...

170 B
188 B

282ms
282ms

Image
image/png

142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=ASkJ3FZbMB5D2D4MZFRWpwlCBvj29x7LpMPjE-F3dpBRSCzVWsSFGr68RsrGCuE65WeQcb_xSxyuaUGruxBhaMr84YHWV0fXstXFdx203MkYFx4PpCEIFIa5bMLCH63Z0VmCz3dZiIMFKlAE&google_hm=Gfyhvrl5xWsaitNLZ72GNw==

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2844491747&adf=53498480&pi=t.ma~as.3006%2F14006&w=336&lmt=1668141998&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1668141997921&bpp=13&bdt=580&idt=721&shv=r20221109&mjsv=m202211030101&ptt=5&saldr=sa&cookie=ID%3D7424e70c42b0e229%3AT%3D1668141990%3AS%3DALNI_Ma_zn52qfbC-C-Sn8uIzpzkw6TYWg&gpic=UID%3D00000b795b7e4242%3AT%3D1668141990%3ART%3D1668141990%3AS%3DALNI_MbHNmAN3NzQn7wiMpFb07Wpx4hRoQ&correlator=2851980570204&frm=23&ife=1&pv=2&ga_vid=1042930634.1668141991&ga_sid=1668141999&ga_hid=106843725&ga_fc=1&nhd=3&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=1050797798&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531705%2C44777508%2C31070617%2C31070762%2C31070785%2C44775017&oid=2&pvsid=74479620173393&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.927lrfg0iy36&fsb=1&dtd=740

Protocol

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:40 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=ASkJ3FZbMB5D2D4MZFRWpwlCBvj29x7LpMPjE-F3dpBRSCzVWsSFGr68RsrGCuE65WeQcb_xSxyuaUGruxBhaMr84YHWV0fXstXFdx203MkYFx4PpCEIFIa5bMLCH63Z0VmCz3dZiIMFKlAE&google_hm=Gfyhvrl5xWsaitNLZ72GNw==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-request-id: d8c7ru7ja3apcfuf68hn0imgo7ra97n1

GET
H2

200

/
onetag-sys.com/match/ Frame EBBB
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEFFVzTGcB5fyoGt5BW7J9pg&google_cver=1&google_push=ASkJ3FYKa3BFiZhHInow1VxOkvDrjfJcVElHIoYxVNk_StPU5wEuHPm8Awk-x7UpeSW5ztl2udKQBke9h5W...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABhGUC6W2y9PunTd7ZHKAwcAynW_Goj0pSIw&google_push=ASkJ3FYKa3BFiZhHInow1VxOkvDrjfJcVElHIoYxVNk_StPU5wEuHPm8Awk-x7UpeSW5ztl2udKQBke9h5...
https://onetag-sys.com/match/?int_id=19&google_error=5

0
340 B

394ms
394ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=19&google_error=5

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2844491747&adf=53498480&pi=t.ma~as.3006%2F14006&w=336&lmt=1668141998&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1668141997921&bpp=13&bdt=580&idt=721&shv=r20221109&mjsv=m202211030101&ptt=5&saldr=sa&cookie=ID%3D7424e70c42b0e229%3AT%3D1668141990%3AS%3DALNI_Ma_zn52qfbC-C-Sn8uIzpzkw6TYWg&gpic=UID%3D00000b795b7e4242%3AT%3D1668141990%3ART%3D1668141990%3AS%3DALNI_MbHNmAN3NzQn7wiMpFb07Wpx4hRoQ&correlator=2851980570204&frm=23&ife=1&pv=2&ga_vid=1042930634.1668141991&ga_sid=1668141999&ga_hid=106843725&ga_fc=1&nhd=3&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=1050797798&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531705%2C44777508%2C31070617%2C31070762%2C31070785%2C44775017&oid=2&pvsid=74479620173393&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.927lrfg0iy36&fsb=1&dtd=740

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:40 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=19&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 255
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame EBBB 0
12 B 282ms
280ms Image
text/html 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13If0zIOKBMKw0YNfwMew_juT7wI_AcsqgEuj0IP7wjrJTaEz8kT0rviejq2Bhfq94Eyu887ow

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2844491747&adf=53498480&pi=t.ma~as.3006%2F14006&w=336&lmt=1668141998&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1668141997921&bpp=13&bdt=580&idt=721&shv=r20221109&mjsv=m202211030101&ptt=5&saldr=sa&cookie=ID%3D7424e70c42b0e229%3AT%3D1668141990%3AS%3DALNI_Ma_zn52qfbC-C-Sn8uIzpzkw6TYWg&gpic=UID%3D00000b795b7e4242%3AT%3D1668141990%3ART%3D1668141990%3AS%3DALNI_MbHNmAN3NzQn7wiMpFb07Wpx4hRoQ&correlator=2851980570204&frm=23&ife=1&pv=2&ga_vid=1042930634.1668141991&ga_sid=1668141999&ga_hid=106843725&ga_fc=1&nhd=3&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=1050797798&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531705%2C44777508%2C31070617%2C31070762%2C31070785%2C44775017&oid=2&pvsid=74479620173393&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.927lrfg0iy36&fsb=1&dtd=740

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:40 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame D2D4 0
128 B 236ms
235ms Script
text/plain 67.199.150.85
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=162412&gdpr=0&gdpr_consent=&us_privacy=1YN-
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 67.199.150.85 Los Angeles, United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:40 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 200 api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js Show response
pagead2.googlesyndication.com/bg/ Frame E905 36 KB
16 KB 277ms
277ms Script
text/javascript 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a98bdefd73410963a41036b4bc4d25b080aaec85db7ebd132a12d3aa17e8586

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 10 Nov 2022 00:36:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 101384
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 10 Nov 2023 00:36:56 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E905 0
21 B 280ms
279ms Image
image/gif 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BjacLr9NtY_vZL9fuogOByb7ICwAAAAA4AeAEAg&bg=!mZqlmt7NAAbvMpMzzzI7ACkAdvg8WnMDmyguzPkJI5PwO-uOyQQgBra9DBsMpqlHhX6K3qSfXwQzIQIAAABeUgAAAAJoAQcKAClAqxJqNqY88I5xgAu4jr5nc9lYXy9qP3gfg-nT1LQ3x-aCJl7pMqEAhJkDMb4u-Ig6oaINa_mwckj29gu17EDWuNFeSTW9Tju7_yfDzVyE4xlSmynlORvGsvhulovrEoZ4LiWkss2AT-yPaNTzEX4HL9_PA9X6Jv9KeVGcknIMeoUiocTfuEGVEOCUM_97NmYAkELrzQCpIkV8zxUj7fCVOyK0QGAN1NFI3SZf6gEqfuzpOJVn3Q_RlzVhQ5cxJpygXiimtthfLnpGJxBuN0CuZHOasQyPtllMO6e15aEQoVehZE5OzveOHGamY2snQLr3r_g1lr9SA4jtKfUttWv_FJY5jQOw3YSr66-vpr3rqmKQdjm0DbloOg_dkan8ughtTNEi0XLObAWkdkgjuq-yXCrJFT_XeaYQVqRajttpU-nF4PZJywZWh7xWO_SExDtG7yQJ_PR_0dNH_UZKarCWjScURhHBDQfX-vhptt1TK5DBlNES-Yi_upbPJEkaL3uoZC8Ujq_eiINnNfz53ZBhJZ7UoXzvLsJW09IM6uiss6AAY94Lq0zebGthCrtgOM3Igo2Gaa-VKPV8nNi0LqdGWpbgG9v2gsDuauk9wAUyPHaaZ0jYBS4UHUzeyku4uSoX5D5CuT6MQxigOrIQ-L8Rz-poheKZwCwgWYNPFM7RuisI75Hx-XtuOi583oH7jTz_wsecmh34xCeqcWm3bxJlnzWl0a1n56ubHXtTW6MgAv5Har6wcwkkJ3c41374fbn6qvbHef3rxOF8c6J6FtjMc1XxlWTKRvyhNmpNRpst0RLHpRTrr_FpVqmODr-7tUpAzdaXl4B9ZowY-tB95YdRI707i-JcojJnl08vpsMI0Othu_BaZ9Ob8LHayR0v_F5gl958DYVRD7Zoij8EknOVQeGjqX9av2q7lrJr_BNxLxtlPBFmKl58h7V0mJyCzEAA7kDE8H9xl2F3BkaHfQVsadF26IbwRk73lsx5P1pIA_ieDfqY7SzXKM7okLVv86w3Nl4JnFNzyrxc-R1Qm_3s7ctD5WzATJYuubqRdbdRJp3nm4R1rTSYAPs9561GarCMd-5a1nkfMhHEN7AWsOA_rW9rN_IvgHIxHS3NXJD-EOGgcnqJpmDnL5Yb4lE

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2844491747&adf=53498480&pi=t.ma~as.3006%2F14006&w=336&lmt=1668141998&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fdi-qiu-shou-wei-yi-zhi-xing-ji-fang-ke-huo-que-ren.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1668141997921&bpp=13&bdt=580&idt=721&shv=r20221109&mjsv=m202211030101&ptt=5&saldr=sa&cookie=ID%3D7424e70c42b0e229%3AT%3D1668141990%3AS%3DALNI_Ma_zn52qfbC-C-Sn8uIzpzkw6TYWg&gpic=UID%3D00000b795b7e4242%3AT%3D1668141990%3ART%3D1668141990%3AS%3DALNI_MbHNmAN3NzQn7wiMpFb07Wpx4hRoQ&correlator=2851980570204&frm=23&ife=1&pv=2&ga_vid=1042930634.1668141991&ga_sid=1668141999&ga_hid=106843725&ga_fc=1&nhd=3&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=1050797798&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531705%2C44777508%2C31070617%2C31070762%2C31070785%2C44775017&oid=2&pvsid=74479620173393&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.927lrfg0iy36&fsb=1&dtd=740

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Nov 2022 04:46:41 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 928B 16 KB
12 KB 287ms
287ms XHR
application/json 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20221109&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211090101/show_ads_impl_fy2021.js?bust=31070831

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4dcbbe2e675eaaeb3b7fb65f240a23acc59065f08192e24b48a418eade0c646e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:41 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12445
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 928B 17 KB
6 KB 276ms
276ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211090101/show_ads_impl_fy2021.js?bust=31070831

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 11 Nov 2022 04:46:41 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame BF1F 13 KB
5 KB 276ms
274ms Document
text/html 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 103285
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 10 Nov 2022 00:05:16 GMT
expires: Fri, 10 Nov 2023 00:05:16 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 1806 783 B
535 B 283ms
282ms Document
text/html 142.251.12.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.147 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f147.1e100.net

Software

GSE /

Resource Hash

813128d52678aed48c082fb366bcd41dff900a3569ced4700c8511fdc57ce700

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-8l6wbImIhAdPEaC7XgjWPA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-8l6wbImIhAdPEaC7XgjWPA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 11 Nov 2022 04:46:41 GMT
expires: Fri, 11 Nov 2022 04:46:41 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame B155 16 KB
12 KB 288ms
287ms XHR
application/json 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20221109&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211030101/show_ads_impl_fy2021.js?bust=31070785

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7d86f43acd9f327021fd07d3ba6876a92310b85eecf42efd26b8b3ecf05623ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 04:46:41 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12339
x-xss-protection: 0

GET sodar
pagead2.googlesyndication.com/pagead/ Frame 1806 0
0

GET
H3 200 api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js
pagead2.googlesyndication.com/bg/ Frame BF1F 0
0 276ms
275ms Script
text/javascript 74.125.200.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS