work.ink Open in urlscan Pro
2606:4700:20::681a:a77 Public Scan

ec2-52-15-219-226.us-east-2.compute.amazonaws.com

Software

sffe /

Resource Hash

072df0f81df2a830d0c3c13e3bd980c83ebeb408e4fcf921f78f146e480ea2b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28476
x-xss-protection: 0
server: sffe
etag: "1309 / 16 of 1000 / last-modified: 1660946721"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 20 Aug 2022 21:53:15 GMT

GET
H/1.1 200
OK config.js Show response
confiant-integrations.global.ssl.fastly.net/bbdvOAJnqH-Idffgn_02C2Cyx_E/gpt_and_prebid/ 164 KB
35 KB 41ms
11ms Script
text/javascript 151.101.65.194
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://confiant-integrations.global.ssl.fastly.net/bbdvOAJnqH-Idffgn_02C2Cyx_E/gpt_and_prebid/config.js
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.194 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 63a3cbff4d9aa9d1bea83bfc49a3f60ef0b821adf127f15e743a552bd0396d55

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Sat, 20 Aug 2022 21:53:15 GMT
Content-Encoding: gzip
Age: 779
X-Cache: HIT
Connection: keep-alive
Content-Length: 34948
x-amz-id-2: zOUG8KF0EUKQmtYovNhoH65QAO0rL4+OXYOilg5C2ppYU6igSsy+HwmSZhsMtOTBrK/x6BY3jM8=
X-Served-By: cache-yul12834-YUL
Last-Modified: Sat, 20 Aug 2022 20:31:25 GMT
Server: AmazonS3
X-Timer: S1661032395.128346,VS0,VE0
ETag: "c8b8af344f4cc5bdeecf1daa939cc4ca"
x-amz-request-id: 31Z9SK205QWPG7J3
Via: 1.1 varnish
Cache-Control: public, max-age=900, stale-while-revalidate=3600
Accept-Ranges: bytes
Content-Type: text/javascript
X-Cache-Hits: 6

POST
H/1.1 200
OK track-impression Show response
thisiswaldo.com/js/ 1 B
376 B 373ms
290ms XHR
application/json 52.15.219.226
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://thisiswaldo.com/js/track-impression

Requested by

Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

52.15.219.226 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache/2.4.29 (Ubuntu) /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

Date: Sat, 20 Aug 2022 21:53:15 GMT
X-Content-Type-Options: nosniff, nosniff
Server: Apache/2.4.29 (Ubuntu)
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 1
Expires: Sun, 19 Nov 1978 05:00:00 GMT

GET
H2 200 me Show response
ipfind.co/ 355 B
458 B 278ms
97ms XHR
application/json 204.236.176.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ipfind.co/me?auth=3757a9b9-5759-4813-bc1a-7fa0b8ba94c1
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 204.236.176.34 San Jose, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-204-236-176-34.us-west-1.compute.amazonaws.com
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: 9e23a046a0c2cb134a8435496c88b27b33ccdf66bc06022e9d6b2e4b054f8a3e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:15 GMT
content-encoding: gzip
server: Apache/2.4.18 (Ubuntu)
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://work.ink
cache-control: no-cache, private
access-control-allow-credentials: true
content-length: 241

POST
H/1.1 200
OK track-impression Show response
thisiswaldo.com/js/ 1 B
376 B 380ms
307ms XHR
application/json 52.15.219.226
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://thisiswaldo.com/js/track-impression

Requested by

Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

52.15.219.226 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-15-219-226.us-east-2.compute.amazonaws.com

Software

Apache/2.4.29 (Ubuntu) /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

Date: Sat, 20 Aug 2022 21:53:15 GMT
X-Content-Type-Options: nosniff, nosniff
Server: Apache/2.4.29 (Ubuntu)
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 1
Expires: Sun, 19 Nov 1978 05:00:00 GMT

GET
H2 200 me Show response
ipfind.co/ 355 B
457 B 301ms
130ms XHR
application/json 204.236.176.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ipfind.co/me?auth=3757a9b9-5759-4813-bc1a-7fa0b8ba94c1
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 204.236.176.34 San Jose, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-204-236-176-34.us-west-1.compute.amazonaws.com
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: 9e23a046a0c2cb134a8435496c88b27b33ccdf66bc06022e9d6b2e4b054f8a3e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:15 GMT
content-encoding: gzip
server: Apache/2.4.18 (Ubuntu)
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://work.ink
cache-control: no-cache, private
access-control-allow-credentials: true
content-length: 241

POST
H3 200 73de5c515e4d713c Show response
work.ink/cdn-cgi/challenge-platform/h/g/cv/result/ Frame 3C5A 2 B
706 B 33ms
32ms XHR
text/plain 2606:4700:20::681a:a77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://work.ink/cdn-cgi/challenge-platform/h/g/cv/result/73de5c515e4d713c
Requested by: Host: work.ink
URL: https://work.ink/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1661025600
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:a77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: application/json

Response headers

date: Sat, 20 Aug 2022 21:53:15 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oyYlZYp4r951tUSefIiyFN70%2F8IYdsU%2BOsb5MVNnFOj4X03OG746McnPLn%2FsnJhFrWfEWcOs8VDogmvYHeodir2mkKUt2R2bdGRZc9ctgwxALCziwPpbSlrJhecgbwFIj1Xt2STw"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 73de5c56af5b4bbe-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 anchor Show response
www.google.com/recaptcha/api2/ Frame CD61 42 KB
22 KB 91ms
47ms Document
text/html 2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeSckcgAAAAADa4NiqiPWZBnTw9LyNml9nB9NrF&co=aHR0cHM6Ly93b3JrLmluazo0NDM.&hl=en&v=PRMRaAwB3KlylGQR57Dyk-pF&size=invisible&cb=jupu94vszh8o

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/PRMRaAwB3KlylGQR57Dyk-pF/recaptcha__en.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2004 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

fcc957b46bc8cb13daba927fc7b6a3e1eaeff4b04de6e6df5afa5be46f5c4fd1

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-_4n7FsLCn7w7gP1WCKEH-Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://work.ink/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-length: 22080
content-security-policy: script-src 'report-sample' 'nonce-_4n7FsLCn7w7gP1WCKEH-Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 20 Aug 2022 21:53:15 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 quant.js Show response
secure.quantserve.com/ 24 KB
10 KB 145ms
26ms Script
application/javascript 2620:116:800b:21:c1e8:5385:5098:6bf0
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/choice/fTfJtcPmQDwZG/work.ink/choice.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800b:21:c1e8:5385:5098:6bf0 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: c5068652d2e91ff8a12bd334ea7ce87b7225f6da4a6a2841c8b51c24029a392b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:15 GMT
content-encoding: gzip
etag: "gV5iHc/sd8Rde4C/i53H5w=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Sat, 27 Aug 2022 21:53:15 GMT

GET
H2 200 cmp2.js Show response
quantcast.mgr.consensu.org/tcfv2/ 177 KB
47 KB 21ms
21ms Script
text/javascript 2600:9000:2209:c200:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://quantcast.mgr.consensu.org/tcfv2/cmp2.js?referer=work.ink
Requested by: Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/choice/fTfJtcPmQDwZG/work.ink/choice.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2209:c200:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 47a2d133064504ee53496e9739d8fdb388031dbce3acb88ba82606b416ad5f05

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:52:34 GMT
content-encoding: gzip
age: 49
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
access-control-max-age: 86400
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
last-modified: Tue, 02 Aug 2022 14:10:54 GMT
server: AmazonS3
etag: W/"69d6d33303a3f8be5301b9ad1aad06bf"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/javascript;charset=UTF-8
via: 1.1 19e58616339f974c22a3a07f8f637718.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-cf-pop: EWR53-P1
x-amz-cf-id: MFONY8nm_ooLC1YE_jkiD7vdTewFl8nq2y3cwfqJ3RaZuF5Ft9UZMg==

GET
H/1.1 200
OK wrap.js Show response
confiant-integrations.global.ssl.fastly.net/gptprebidnative/202208101343/ 203 KB
65 KB 11ms
10ms Script
application/javascript 151.101.65.194
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202208101343/wrap.js
Requested by: Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/bbdvOAJnqH-Idffgn_02C2Cyx_E/gpt_and_prebid/config.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.194 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f83dccda0f23005e073046554fcb6f70e6cc5c6d5a31482d8cbf00c3cae72a69

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Sat, 20 Aug 2022 21:53:15 GMT
Content-Encoding: gzip
Age: 772071
X-Cache: HIT
Connection: keep-alive
Content-Length: 66315
x-amz-id-2: 9dypyNFHXW4mDD/Xt9Z8XPPD3WAoW8EF0QbdR2fkAnvAnk6hJ1ap7hDvjHe92QHeboZwib7DGnE=
X-Served-By: cache-yul12834-YUL
Last-Modified: Thu, 11 Aug 2022 17:11:38 GMT
Server: AmazonS3
X-Timer: S1661032395.334644,VS0,VE0
ETag: "6dc02234ec68d77d35e4d6a9fe8b646f"
x-amz-request-id: HJQ74DC4TJ4D2BVP
Via: 1.1 varnish
Cache-Control: public, max-age=900, stale-while-revalidate=3600
Accept-Ranges: bytes
Content-Type: application/javascript; charset=utf-8
X-Cache-Hits: 6686902

GET
H3 200 pubads_impl_2022081501.js Show response
securepubads.g.doubleclick.net/gpt/ 384 KB
131 KB 63ms
22ms Script
text/javascript 142.250.65.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081501.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6fb2352555371675225ce7b1e1832ac4b1ad8e83dc396d10b70a42dac24addc7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 10:41:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 40320
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 133600
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 08:36:18 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sun, 20 Aug 2023 10:41:15 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 129 B
121 B 76ms
35ms XHR
application/json 142.250.65.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=work.ink

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-34-198-31-47.compute-1.amazonaws.com

Software

cafe /

Resource Hash

13e856ef710d3612e2730ef03e2114d2dd6d7c11835190b892417b9edbcd6dc0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 20 Aug 2022 21:53:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 96
x-xss-protection: 0
expires: Sat, 20 Aug 2022 21:53:15 GMT

GET
H2 200 localstore.js Show response
script.4dex.io/ 483 B
942 B 57ms
18ms Script
application/javascript 2606:4700:20::681a:8a9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/localstore.js
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:8a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:15 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1068802
x-amz-request-id: tx86f8e995592547ee95ab9-00629f4bc7
x-amz-id-2: tx86f8e995592547ee95ab9-00629f4bc7
last-modified: Tue, 10 May 2022 09:57:32 GMT
server: cloudflare
etag: W/"922cffdd75f7192f75231d92684885aa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DcDdR3s8c9mDoDc1AAZ1EQCkOvuCxek0%2BsyunOypnzuGaQ9gdq%2FPsJW92l%2Bw94rYxev2QfyyCYMy%2By4TbpdeYEn0WC7OZxEcpTwKuEFMBlUZsnuTEV2RrvPzoY2q8tcB3sQjuau75MN9vHYO"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=1800
x-amz-version-id: 1652176652152482
cf-ray: 73de5c579d6d4bca-YUL

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 87 B
337 B 88ms
30ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=dVQ06ADzGr6yooaKlId8sQ
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: f45bf904cc3619abc9153bd0d37a416ca87a982f091f38af02aa32b4869a9f16

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 20 Aug 2022 21:53:15 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://work.ink
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 87 B
179 B 89ms
31ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=dVQ06ADzGr6yooaKlId8sQ
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: f45bf904cc3619abc9153bd0d37a416ca87a982f091f38af02aa32b4869a9f16

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 20 Aug 2022 21:53:15 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://work.ink
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 139 B
209 B 153ms
95ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=dVQ06ADzGr6yooaKlId8sQ
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 2da9795d9a6df1978ae79a3b9076343e5c4c1ca89dc3fb2fcb36591cb5ad8e4e

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 20 Aug 2022 21:53:15 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://work.ink
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 139 B
218 B 148ms
91ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=dVQ06ADzGr6yooaKlId8sQ
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 2da9795d9a6df1978ae79a3b9076343e5c4c1ca89dc3fb2fcb36591cb5ad8e4e

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 20 Aug 2022 21:53:15 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://work.ink
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 139 B
209 B 161ms
104ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=dVQ06ADzGr6yooaKlId8sQ
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 2da9795d9a6df1978ae79a3b9076343e5c4c1ca89dc3fb2fcb36591cb5ad8e4e

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 20 Aug 2022 21:53:15 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://work.ink
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 139 B
209 B 139ms
83ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=dVQ06ADzGr6yooaKlId8sQ
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 2da9795d9a6df1978ae79a3b9076343e5c4c1ca89dc3fb2fcb36591cb5ad8e4e

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 20 Aug 2022 21:53:15 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://work.ink
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via: 1.1 google

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 94 B
734 B 153ms
92ms XHR
application/json 63.251.114.137
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_6.17.0
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 63.251.114.137 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: 7f5d106b555506ad5dddb9f5161b05c3fb99ac6115448d9f9b9832af6d5f01da

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

Date: Sat, 20 Aug 2022 21:53:15 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://work.ink
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap6ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 97

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
502 B 215ms
96ms XHR
application/json 34.198.31.47
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=6.17.0&referrer=https%3A%2F%2Fwork.ink%2Fen%2Fl%2F1VA%2FToxicModzZ&tmax=3000&gdpr=false&us_privacy=1---

Requested by

Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.198.31.47 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:15 GMT
accept-ch: sec-ch-viewport-height,sec-ch-ua-platform,sec-ch-viewport-width,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-dpr,sec-ch-device-memory,sec-ch-save-data,sec-ch-ua-mobile,sec-ch-downlink,user-agent,sec-ch-ect,sec-ch-width,sec-ch-prefers-color-scheme,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-arch,sec-ch-rtt
content-type: application/json; charset=utf-8
access-control-allow-origin: https://work.ink
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H2 204 hb Show response
brightcombid.marphezis.com/ 0
109 B 99ms
26ms XHR
text/plain 52.1.145.15
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://brightcombid.marphezis.com/hb
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.1.145.15 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-1-145-15.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://work.ink
date: Sat, 20 Aug 2022 21:53:15 GMT
access-control-allow-credentials: true
server: nginx

POST
H2 200 c Show response
prebid.a-mo.net/a/ 459 B
835 B 108ms
36ms XHR
application/json 145.40.88.5
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 145.40.88.5 Secaucus, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: c3710ec35cf5623590fdd6acc8ac84494645aa21bf808598548e6d85927e90bf

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 20 Aug 2022 21:53:15 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://work.ink
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 18
content-length: 275

POST
H2 200 adreq Show response
ads.servenobid.com/ 87 B
414 B 104ms
25ms XHR
application/json 52.207.67.12
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=4450
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.207.67.12 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-67-12.compute-1.amazonaws.com
Software: /
Resource Hash: 2a405b45437014203bba4189c24a6a49840c5011f8eed5ff174fa6c199cef2e2

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 20 Aug 2022 21:53:15 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://work.ink
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true

POST
H2 204 mvo Show response
tag.1rx.io/rmp/227031/0/ 0
155 B 86ms
25ms XHR
text/plain 199.127.204.162
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.1rx.io/rmp/227031/0/mvo?z=1r&hbv=6.17,2.1
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.127.204.162 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://work.ink
pragma: no-cache
date: Sat, 20 Aug 2022 21:53:15 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

POST
H2 204 apacdex Show response
useast.quantumdex.io/auction/ 0
332 B 83ms
38ms XHR
text/plain 2606:4700:10::6816:2460
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://useast.quantumdex.io/auction/apacdex
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:2460 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 20 Aug 2022 21:53:15 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-methods: POST, GET
access-control-allow-origin: https://work.ink
access-control-allow-credentials: true
cf-ray: 73de5c57ce6eecea-YUL

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 74 KB
14 KB 190ms
153ms XHR
application/json 34.107.148.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUT8W5DX
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 38a3c12bcd91f62e19d47c0793924b85257dbe535b7d89d508937aeeb302ae8e

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:15 GMT
content-encoding: gzip
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://work.ink
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 730 B
1 KB 77ms
28ms XHR
application/json 68.67.160.24
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.24 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

98e8440084a09e291723a8d20049959f2f981010aa20537397a3033bccdf4d42

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

Date: Sat, 20 Aug 2022 21:53:15 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.189; 149.56.153.189; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: b692a768-8bc4-44b2-bef2-003c211c81a7
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://work.ink
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK hbjson Show response
grid.bidswitch.net/ 24 B
359 B 217ms
112ms XHR
application/json 35.211.165.199
GOOGLE-2

General

Check archive.org

Show headers Download Go to

Full URL: https://grid.bidswitch.net/hbjson
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.211.165.199 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 199.165.211.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 9b73310d6808f488633b76394187b164ca86928228d8578bba85b6d7371eaee2

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

Date: Sat, 20 Aug 2022 21:53:15 GMT
Content-Encoding: gzip
Server: nginx
Content-Type: application/json
access-control-allow-origin: https://work.ink
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
Connection: keep-alive
Content-Length: 49

POST
H2 200 bid-request Show response
rtb.adpone.com/ 775 B
720 B 161ms
117ms XHR
application/json 2606:4700:20::681a:b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adpone.com/bid-request?pid=1211024125851450&gdpr_applies=false&consentString=undefined
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:b19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 006fa536fd220fc1bb54b0eeacf67826504841bae4fb1644c8649cf86286749d

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 20 Aug 2022 21:53:15 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M0KA5fgxX1sPpX5DFByUcYh60w0dY8OcEE%2BJvDvl959FM6Dyt%2BfZFtN2PoGmiGeAdhxLWVuj4bCwH6CihbG0Du6uBMYlDq3yiNcvJfMWIk8IXi8DLdsarDE%2BwCFxtelHThtQPakjCM%2FTgOFG"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://work.ink
access-control-allow-credentials: true
cf-ray: 73de5c57cf374bb9-YUL

POST
H2 200 bid-request Show response
rtb.adpone.com/ 777 B
718 B 157ms
114ms XHR
application/json 2606:4700:20::681a:b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adpone.com/bid-request?pid=1211024125851450&gdpr_applies=false&consentString=undefined
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:b19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ad85d5e62f9ee5e576fd2b4461e179b13756a22f3edbcf1637b91884b751c914

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 20 Aug 2022 21:53:15 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1tbuAYyDSJLDJjJNB%2F1LorvUfh9JmRsL%2BVJ7XsX6ufMFzTf5v2W4NSWrFZBLHLCKndOgASCAZKmTH60xW2nO940odwMuTBnihseU6VMotzd0IXV2mmaifU5FyCYneNHNXdM9ih1EQyv%2F%2BQhX"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://work.ink
access-control-allow-credentials: true
cf-ray: 73de5c57cf394bb9-YUL

POST
H2 200 bid-request Show response
rtb.adpone.com/ 777 B
978 B 153ms
110ms XHR
application/json 2606:4700:20::681a:b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adpone.com/bid-request?pid=1211024125851450&gdpr_applies=false&consentString=undefined
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:b19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 35af3e0ec5fa13599ce82756e597010be371090e7563545c53c21e5e387b8788

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 20 Aug 2022 21:53:15 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6tpFXs7q%2FekyKrWc7jsLd8lKEvyG4Z7pdKjzr6Nwmgos18oPnKIFMBOjc3dFQ1Az4d1M69v%2FYOdjFJpjfaQfTGZ3VPJ4vIJymxflUxYogXHWWdvoidLVbpF29fbxSNQ97bCfE9i1bkCoWZi0"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://work.ink
access-control-allow-credentials: true
cf-ray: 73de5c57cf3a4bb9-YUL

POST
H2 200 bid-request Show response
rtb.adpone.com/ 777 B
745 B 1190ms
1147ms XHR
application/json 2606:4700:20::681a:b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adpone.com/bid-request?pid=1211024125851450&gdpr_applies=false&consentString=undefined
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:b19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1be072a4c22274ef4faef43740a0b7a48d3a7a4124203e6de59ac85f9772c2a6

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 20 Aug 2022 21:53:16 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1CEuAX7u9%2BFDA2ubafzmbsGPZXYkUq0A2FrBP0%2BYPpvbAacIVrPWL7iTxJUVw%2FunmmoVEvA40e5TPeOc9lQyN7yPo%2FUR79OT53VR6SRQcOIqgEEd%2Fm09bA5ntawIHuJY2HZPvgnUJNKZ89Cf"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://work.ink
access-control-allow-credentials: true
cf-ray: 73de5c57cf3b4bb9-YUL

POST
H2 200 bid-request Show response
rtb.adpone.com/ 777 B
721 B 155ms
113ms XHR
application/json 2606:4700:20::681a:b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adpone.com/bid-request?pid=1211024125851450&gdpr_applies=false&consentString=undefined
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:b19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eb7bc232758e38eec57e9655201eb055bb5edc563a78cbe2c8d5051742bc8b7c

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 20 Aug 2022 21:53:15 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hzpmqJxhs7D%2FweCIWeWq22juXXfjFCquwZ%2BAbNRppVw2xylV9wn7MiGED%2Fhn6WPUgm2tF%2FnJxGyA6gqEj03uU1ogg8BaIR%2Beq%2FQ3O0Cz5PMpBxyHQHg8JTd0W5YOtwiIVgVlbW8Gf9tSFiF6"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://work.ink
access-control-allow-credentials: true
cf-ray: 73de5c57cf3d4bb9-YUL

POST
H2 200 bid-request Show response
rtb.adpone.com/ 777 B
717 B 157ms
115ms XHR
application/json 2606:4700:20::681a:b19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adpone.com/bid-request?pid=1211024125851450&gdpr_applies=false&consentString=undefined
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:b19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 120ab8820b48a99c6ccb158ed8fe1282fde33a451319814eeb78b1b3e61039c6

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 20 Aug 2022 21:53:15 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yx3Pg85%2BSBeNQvo4fK0hcSQTotQnXzI%2Fx6qzaztkRrIDDnIZRUewMK3Kpu6bunsbcIL1tBsnNRhNMzeax8Qd6nLZjyGbWACuWtuuDYJs9o6%2BGEXL8GQS8aIDBgNoZl7NLCsQlnHQBvvHxxCB"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://work.ink
access-control-allow-credentials: true
cf-ray: 73de5c57cf3f4bb9-YUL

POST
H2 204 prebid Show response
mp.4dex.io/ 0
312 B 172ms
130ms XHR
text/plain 2606:4700::6812:272
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mp.4dex.io/prebid
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:272 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:15 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
access-control-allow-origin: https://work.ink
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 73de5c57d97aca5f-YUL
x-err: Parsing the Prebid Request. site disabled
expires: 0

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
356 B 41ms
10ms XHR
application/json 51.222.239.232
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.239.232 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
access-control-allow-origin: https://work.ink
cache-control: no-transform, no-cache
access-control-allow-credentials: true
content-type: application/json
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/PRMRaAwB3KlylGQR57Dyk-pF/ Frame CD61 52 KB
24 KB 67ms
22ms Stylesheet
text/css 2607:f8b0:4006:81f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/PRMRaAwB3KlylGQR57Dyk-pF/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeSckcgAAAAADa4NiqiPWZBnTw9LyNml9nB9NrF&co=aHR0cHM6Ly93b3JrLmluazo0NDM.&hl=en&v=PRMRaAwB3KlylGQR57Dyk-pF&size=invisible&cb=jupu94vszh8o

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2003 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

caf2650aa985d277b2dd131a6261888bc64e6c9bc15e5564bfb9b380bcf82a10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:52:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 33
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24251
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 20:03:29 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 20 Aug 2023 21:52:42 GMT

GET
H3 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/PRMRaAwB3KlylGQR57Dyk-pF/ Frame CD61 387 KB
154 KB 64ms
20ms Script
text/javascript 2607:f8b0:4006:81f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/PRMRaAwB3KlylGQR57Dyk-pF/recaptcha__en.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2003 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d519d7c7ed0ef60bdff019860cb18b309245d9dd8450acb3ce173f5fe4ff3bc7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:51:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 157275
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 20:03:29 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 20 Aug 2023 21:51:59 GMT

GET
H2 200 adagio.js Show response
script.4dex.io/ 72 KB
22 KB 48ms
25ms Fetch
application/javascript 2606:4700:20::681a:8a9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:8a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b55131eaef425cb84b957a28df5881c3c83eb11ca9c01e3abccb00baf0e377b6

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:15 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1063042
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-request-id: txcdc80f655fa741d9a987b-00629f4c08
x-amz-id-2: txcdc80f655fa741d9a987b-00629f4c08
last-modified: Tue, 10 May 2022 09:57:31 GMT
server: cloudflare
etag: W/"2430496689c00115831347992a974246"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9FlwCzQ46h7JAHJHlrBMciIJ0pSmEHXQ8Hoq3wPUbvZM4t6cuRp7YBwfoPEOjFYquFu40Gy5SFw0kHrkC5DTwbk2DtKGxM9ofWX4RA04nREsTMZK90muJ1UOYfOqXptCAERI5iC0XcocdUfp"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=1800
access-control-allow-credentials: true
x-amz-version-id: 1652176651393042
cf-ray: 73de5c581f87713c-YUL
access-control-allow-headers: Authorization

GET
H2 200 adagio.js Show response
script.4dex.io/ 72 KB
23 KB 46ms
23ms Fetch
application/javascript 2606:4700:20::681a:8a9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:8a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b55131eaef425cb84b957a28df5881c3c83eb11ca9c01e3abccb00baf0e377b6

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:15 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1063042
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-request-id: txcdc80f655fa741d9a987b-00629f4c08
x-amz-id-2: txcdc80f655fa741d9a987b-00629f4c08
last-modified: Tue, 10 May 2022 09:57:31 GMT
server: cloudflare
etag: W/"2430496689c00115831347992a974246"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GhcZccHcYxQce28JCWpk%2FC94wSVYpFmGNMe1pGdokNbtdmeivg76HARCDXf9B4tYePt7S1VPa7t%2FGY%2B1XfpcwGrnFS3l6O%2BeBZZtb%2Fbay0VPldQLCgpkNJ4D0hsx23mMGJalkEJanrM3RYl1"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=1800
access-control-allow-credentials: true
x-amz-version-id: 1652176651393042
cf-ray: 73de5c581f89713c-YUL
access-control-allow-headers: Authorization

GET
H2 200 rules-p-fTfJtcPmQDwZG.js Show response
rules.quantcount.com/ 160 B
631 B 73ms
19ms Script
application/javascript 2600:9000:21ec:d000:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-fTfJtcPmQDwZG.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21ec:d000:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 922b0d2d4adb5ed473a915258165047db5642276b6edad0dc15a0d47ed4ea19c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:04:13 GMT
via: 1.1 d2d900512286e3d26077b241153e569c.cloudfront.net (CloudFront)
age: 2943
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 160
last-modified: Wed, 27 Jul 2022 10:36:20 GMT
server: AmazonS3
etag: "65712c30333d33050e268b43b70b60ea"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
x-amz-cf-pop: JFK51-C1
accept-ranges: bytes
x-amz-cf-id: ZAyrG1ndk3cIcAaDEEWkis2nAW-g8wLUwVUbdPxN0-roPLpjtoOr-A==

GET
H2 200 pixel;r=1842248799;source=choice;rf=0;a=p-fTfJtcPmQDwZG;url=https%3A%2F%2Fwork.ink%2Fen%2Fl%2F1VA%2FToxicModzZ;uht=2;fpan=1;fpa=P0-1438312980-1661032395605;pbc=673a2f93-5186-475d-9ef0-b90f8ba301a2;...
pixel.quantserve.com/ 35 B
371 B 46ms
28ms Image
image/gif 2620:116:800b:21:c1e8:5385:5098:6bf0
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=1842248799;source=choice;rf=0;a=p-fTfJtcPmQDwZG;url=https%3A%2F%2Fwork.ink%2Fen%2Fl%2F1VA%2FToxicModzZ;uht=2;fpan=1;fpa=P0-1438312980-1661032395605;pbc=673a2f93-5186-475d-9ef0-b90f8ba301a2;ns=0;ce=1;qjs=1;qv=26d71701-20220818164642;cm=;gdpr=0;us_privacy=1---;ref=;d=work.ink;dst=0;et=1661032395605;tzo=0;ogl=

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800b:21:c1e8:5385:5098:6bf0 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:15 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame CD61 2 KB
2 KB 21ms
20ms Image
image/png 2607:f8b0:4006:81f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/PRMRaAwB3KlylGQR57Dyk-pF/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2003 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/PRMRaAwB3KlylGQR57Dyk-pF/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 13:59:43 GMT
x-content-type-options: nosniff
age: 28412
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2228
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin-allow-popups; report-to="recaptcha"
expires: Sat, 27 Aug 2022 13:59:43 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame CD61 15 KB
16 KB 73ms
20ms Font
font/woff2 2607:f8b0:4006:816::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2003 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 16 Aug 2022 11:41:34 GMT
x-content-type-options: nosniff
age: 382301
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 16 Aug 2023 11:41:34 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame CD61 15 KB
15 KB 78ms
25ms Font
font/woff2 2607:f8b0:4006:816::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2003 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Fri, 19 Aug 2022 10:24:38 GMT
x-content-type-options: nosniff
age: 127717
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15552
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 19 Aug 2023 10:24:38 GMT

GET
H3 200 webworker.js
www.google.com/recaptcha/api2/ Frame CD61 102 B
134 B 40ms
40ms Other
text/javascript 2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=PRMRaAwB3KlylGQR57Dyk-pF

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2004 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

99584f816df6714b39895e4032ede0c137cd7fd764abbb64845f25848ccc0565

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeSckcgAAAAADa4NiqiPWZBnTw9LyNml9nB9NrF&co=aHR0cHM6Ly93b3JrLmluazo0NDM.&hl=en&v=PRMRaAwB3KlylGQR57Dyk-pF&size=invisible&cb=jupu94vszh8o
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 112
x-xss-protection: 1; mode=block
expires: Sat, 20 Aug 2022 21:53:15 GMT

GET
H2 404 default.jpg
img.youtube.com/vi/a-JFUoSQF9E/ 1 KB
1 KB 123ms
44ms Image
image/jpeg 2607:f8b0:4006:80d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.youtube.com/vi/a-JFUoSQF9E/default.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::200e Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

20e9aab22032d85684d7d916a1013f7c577a132a5b10ea3fd3578e8d0b28a711

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:16 GMT
x-content-type-options: nosniff
server: sffe
vary: Origin
content-type: image/jpeg
cache-control: public, max-age=30
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1097
x-xss-protection: 0
expires: Sat, 20 Aug 2022 21:53:46 GMT

GET
H2 200 default.jpg
img.youtube.com/vi/AlRuSjp7cec/ 4 KB
4 KB 99ms
21ms Image
image/jpeg 2607:f8b0:4006:80d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.youtube.com/vi/AlRuSjp7cec/default.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::200e Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

313b0b9da4a2eea5f7a4032d3f8767841f014163e78e991acf208184539a8770

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 20:42:59 GMT
x-content-type-options: nosniff
age: 4217
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4001
x-xss-protection: 0
server: sffe
etag: "1658724269"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Sat, 20 Aug 2022 22:42:59 GMT

POST
H3 200 reload Show response
www.google.com/recaptcha/api2/ Frame CD61 32 KB
18 KB 85ms
85ms XHR
application/json 2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/reload?k=6LeSckcgAAAAADa4NiqiPWZBnTw9LyNml9nB9NrF

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/PRMRaAwB3KlylGQR57Dyk-pF/recaptcha__en.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2004 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

c6ad5480805cb6f5dbe9e8b309158945c063c7d284aebda13cf0565bacf0a396

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeSckcgAAAAADa4NiqiPWZBnTw9LyNml9nB9NrF&co=aHR0cHM6Ly93b3JrLmluazo0NDM.&hl=en&v=PRMRaAwB3KlylGQR57Dyk-pF&size=invisible&cb=jupu94vszh8o
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: application/x-protobuffer

Response headers

date: Sat, 20 Aug 2022 21:53:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cache-control: private, max-age=0
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18495
x-xss-protection: 1; mode=block
expires: Sat, 20 Aug 2022 21:53:16 GMT

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 87ms
38ms Script
application/javascript 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=work.ink

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 20 Aug 2022 21:53:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 70 KB
21 KB 762ms
761ms XHR
text/plain 142.250.65.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1074343624175283&correlator=1628265964234421&eid=31068458%2C31068928%2C31068985%2C31069041&output=ldjh&gdfp_req=1&vrg=2022081501&ptt=17&impl=fifs&gdpr=0&us_privacy=1---&iu_parts=124067137%3A21827075952%2Cwork300x250FX_1%2Cwork300x250FX_2%2Cwork300x250FX_3&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3&prev_iu_szs=300x250%2C300x250%2C300x250&ifi=1&adks=3262639012%2C2483253877%2C3400557721&sfv=1-0-38&fsapi=false&eri=1&cust_params=adx_account%3Dnewor_media_adx%26ob_medianet%3D1%26universal_passback%3Dyes&sc=1&cookie_enabled=1&abxe=1&dt=1661032396652&lmt=1660962928&dlt=1661032394802&idt=708&adxs=638%2C1105%2C170&adys=595%2C536%2C245&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0&ucis=1%7C2%7C3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwork.ink%2Fen%2Fl%2F1VA%2FToxicModzZ&frm=20&vis=1&psz=525x377%7C360x300%7C360x300&msz=475x250%7C310x250%7C310x250&fws=4%2C4%2C4&ohw=1600%2C1600%2C1600&ga_vid=1244403988.1661032397&ga_sid=1661032397&ga_hid=633984928&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d697730cae6273492d96a1905d01028d25707d3e451affefca561f496255ccb5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:17 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21299
x-xss-protection: 0
google-lineitem-id: -1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://work.ink
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 101ms
44ms XHR
application/json 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022081501&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

60b2f2c483d278603c26ff590ccd461b24f7c8085d7e3ff62d0d1971457d87d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 20 Aug 2022 21:53:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11106
x-xss-protection: 0

GET
H2 200 container.html Show response
968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame A0AD 6 KB
4 KB 124ms
38ms Document
text/html 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://work.ink/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 20 Aug 2022 21:53:16 GMT
expires: Sun, 20 Aug 2023 21:53:16 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 160ms
106ms Script
text/javascript 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 20 Aug 2022 21:53:16 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 4098 13 KB
5 KB 66ms
20ms Document
text/html 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://work.ink/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 3697
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 20 Aug 2022 20:51:39 GMT
expires: Sun, 20 Aug 2023 20:51:39 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 0E2E 783 B
536 B 40ms
39ms Document
text/html 2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2004 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

92d82cc0fa540d8a95b5f91c3e57709d25e125724e899039b818aad6d65fe880

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-blk3LiE2dzzqyPaP9JD4LQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://work.ink/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 514
content-security-policy: script-src 'report-sample' 'nonce-blk3LiE2dzzqyPaP9JD4LQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 20 Aug 2022 21:53:16 GMT
expires: Sat, 20 Aug 2022 21:53:16 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 0E2E 0
0 79ms
38ms Image
text/html 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022081501&jk=1074343624175283&rc=05AMjm62V_A5jWzpDYS4A6cT6WplkWvaUZpsPur7X-S5uo79wla4wHOi7iuBbvN21L6Koac_zjMqV2RpdxxTVHvQ0YdcjXxtmVdXWhtJ3krR8TzbWwohjqnEiKGcZbUsuwFaUwSPW_fCrKzhBV2QbQJZ2OpMaXFHiMMvWWr3oxQUiTSwYgm34yjWzzH_z5VhsD-cu9rXi8Jg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H3 200 hd9qiIGAqjescZkeItwy2wgAtCffeqilIyGkY3Q_MTc.js Show response
pagead2.googlesyndication.com/bg/ Frame 4098 36 KB
14 KB 35ms
20ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/hd9qiIGAqjescZkeItwy2wgAtCffeqilIyGkY3Q_MTc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

85df6a888180aa37ac71991e22dc32db0800b427df7aa8a52321a463743f3137

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 16 Aug 2022 14:56:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 370604
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14041
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 08:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 16 Aug 2023 14:56:33 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 4098 0
10 B 20ms
20ms Image
text/plain 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?-gbPmg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:17 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 164ms
24ms Preflight
application/json 2620:100:a001::c
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwork.ink%2F&domain=work.ink&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://work.ink
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://work.ink
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Sat, 20 Aug 2022 21:53:17 GMT
expires: 0
pragma: no-cache
server-processing-duration-in-ticks: 1179
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwork.ink%2F&domain=work.ink&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=w4g0bnxINkluNTQyYm9RNzFvWGN5OFBXYmt3RHAvbXhaTk9ocEtxKzlRRWpCbWNEYm5DRmYwaGdKTXJIaEtxM2FGYkwvSldUdUM4b2RjdVdTcFdqZitzU3lKYld1VGxiZHFVaXZUblpZVFk0ekxUWUx6UU0vckMxQVZEVW...

350 B
616 B

74ms
25ms

XHR
application/json

74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=w4g0bnxINkluNTQyYm9RNzFvWGN5OFBXYmt3RHAvbXhaTk9ocEtxKzlRRWpCbWNEYm5DRmYwaGdKTXJIaEtxM2FGYkwvSldUdUM4b2RjdVdTcFdqZitzU3lKYld1VGxiZHFVaXZUblpZVFk0ekxUWUx6UU0vckMxQVZEVWxZNHB6ZW5TVzdheXJkcUNBeHBNTEZvZEdIZ0FtQkt6ZGJDMjk4OVdLR29lMXVJc1NuQWZyaFg1V0NjNU5ud1FzSkFSNGpIMGZ3Z3hnQ0hrekE3YUNXR05GTUhiTTFsRFFNVkY3MEV0cklwZmwzbnkyeUhvPXw&cppv=2

Protocol

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Resource Hash

789098dfeb6fa9105738624c480ee6c35592c8e8ca471646f2b24cff5b95ac2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:17 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 3017
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:17 GMT
location: https://mug.criteo.com/sid?cpp=w4g0bnxINkluNTQyYm9RNzFvWGN5OFBXYmt3RHAvbXhaTk9ocEtxKzlRRWpCbWNEYm5DRmYwaGdKTXJIaEtxM2FGYkwvSldUdUM4b2RjdVdTcFdqZitzU3lKYld1VGxiZHFVaXZUblpZVFk0ekxUWUx6UU0vckMxQVZEVWxZNHB6ZW5TVzdheXJkcUNBeHBNTEZvZEdIZ0FtQkt6ZGJDMjk4OVdLR29lMXVJc1NuQWZyaFg1V0NjNU5ud1FzSkFSNGpIMGZ3Z3hnQ0hrekE3YUNXR05GTUhiTTFsRFFNVkY3MEV0cklwZmwzbnkyeUhvPXw&cppv=2
strict-transport-security: max-age=31536000; preload;
access-control-allow-methods: GET
content-type: text/html; charset=utf-8
access-control-allow-origin: https://work.ink
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1756
content-length: 482
expires: 0

GET envelope
api.rlcdn.com/api/identity/ 0
0

GET
H2 200 id Show response
id.crwdcntrl.net/ 154 B
901 B 111ms
51ms XHR
application/json 54.172.35.162
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://id.crwdcntrl.net/id
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/160082/7676/pwt.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.172.35.162 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-172-35-162.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 8ba6a75a5fa816987dde4275bc6ef6f684b7a1779594796246037bd2543554e5

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:17 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://work.ink
cache-control: no-cache
x-server: 10.40.0.212
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 154
expires: 0

GET
H2 200 rid Show response
match.adsrvr.org/track/ 109 B
539 B 80ms
25ms XHR
application/json 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=pubmatic&fmt=json
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/160082/7676/pwt.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 6799541be533a90252fc9f924353f586420dabe938659e4f9350c35a74fb56f3

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 20 Aug 2022 21:53:17 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://work.ink
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 109
expires: Mon, 19 Sep 2022 21:53:17 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 159ms
24ms Preflight
application/json 2620:100:a001::c
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwork.ink%2F&domain=work.ink&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://work.ink
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://work.ink
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Sat, 20 Aug 2022 21:53:16 GMT
expires: 0
pragma: no-cache
server-processing-duration-in-ticks: 1102
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwork.ink%2F&domain=work.ink&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=IRf1u3x4b21QQ2ZTSVVES3RnUldmeEVWYVhwd3d2WFhaRkJiNDNlL2xOVGNHVjRSUXl4YkVhMHRlSGU3ZWFzbXBRcjQ0bEd1Qm5oRWxVZi9IU0xNT2xsQnQ1cENhUUVINVE1SWNxOURjZVRYL2ptSWlsRjlFY2pnODJJa2...

355 B
618 B

75ms
25ms

XHR
application/json

74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=IRf1u3x4b21QQ2ZTSVVES3RnUldmeEVWYVhwd3d2WFhaRkJiNDNlL2xOVGNHVjRSUXl4YkVhMHRlSGU3ZWFzbXBRcjQ0bEd1Qm5oRWxVZi9IU0xNT2xsQnQ1cENhUUVINVE1SWNxOURjZVRYL2ptSWlsRjlFY2pnODJJa2tvQnJheEExcHJ0OVAwbU9vaUN1Y3BPZUs5V2xMK3RlZDJBaGx1SEpzbXVnUFBheFFPUjAzQVI1dzRONjJ6VG83V0liT1c5MGluTUhkNWxBY2ZRMWxRVzlSdDJublFxT09CU1c1c1ZKSW9MeW1OVXJ5endvPXw&cppv=2

Protocol

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Resource Hash

49b57d3dabb3d6bd6df3e6f630a10d4312326acb7f3a23e1fd71aa8f21246a94

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:17 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 2900
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:17 GMT
location: https://mug.criteo.com/sid?cpp=IRf1u3x4b21QQ2ZTSVVES3RnUldmeEVWYVhwd3d2WFhaRkJiNDNlL2xOVGNHVjRSUXl4YkVhMHRlSGU3ZWFzbXBRcjQ0bEd1Qm5oRWxVZi9IU0xNT2xsQnQ1cENhUUVINVE1SWNxOURjZVRYL2ptSWlsRjlFY2pnODJJa2tvQnJheEExcHJ0OVAwbU9vaUN1Y3BPZUs5V2xMK3RlZDJBaGx1SEpzbXVnUFBheFFPUjAzQVI1dzRONjJ6VG83V0liT1c5MGluTUhkNWxBY2ZRMWxRVzlSdDJublFxT09CU1c1c1ZKSW9MeW1OVXJ5endvPXw&cppv=2
strict-transport-security: max-age=31536000; preload;
access-control-allow-methods: GET
content-type: text/html; charset=utf-8
access-control-allow-origin: https://work.ink
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1806
content-length: 482
expires: 0

GET
H2 200 id Show response
id.crwdcntrl.net/ 154 B
899 B 131ms
75ms XHR
application/json 54.172.35.162
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://id.crwdcntrl.net/id
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/160082/7676/pwt.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.172.35.162 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-172-35-162.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 608569056dbaa44e5e7aad18d0c55b37179791b486cd4e7076c311a66f69d9c1

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:17 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://work.ink
cache-control: no-cache
x-server: 10.40.2.1
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 154
expires: 0

GET
H2 200 rid Show response
match.adsrvr.org/track/ 109 B
538 B 78ms
26ms XHR
application/json 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=pubmatic&fmt=json
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/160082/7676/pwt.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 7f8cbd89d0ba591ee28a135caba0a31218bd02cdd5080e5e2f50b2730858068d

Request headers

Referer: https://work.ink/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 20 Aug 2022 21:53:17 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://work.ink
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 109
expires: Mon, 19 Sep 2022 21:53:17 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012208081650000/ Frame 123B 220 KB
60 KB 111ms
42ms Script
text/javascript 2607:f8b0:4006:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012208081650000/amp4ads-v0.mjs

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202208101343/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d2e5722cf0b8d8df31200550801d755733c56d9ca2758b7041fbed009e0c9d08

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 220883
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61502
x-xss-protection: 0
server: sffe
date: Thu, 18 Aug 2022 08:31:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "df13b0b17adb5918"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 18 Aug 2023 08:31:54 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012208081650000/v0/ Frame 123B 14 KB
6 KB 89ms
20ms Script
text/javascript 2607:f8b0:4006:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012208081650000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202208101343/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e14ddde632bad66a3f79d6dc2c6a212d3b1b5cd8100cb6b73984b8797c5ed86

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 220883
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5197
x-xss-protection: 0
server: sffe
date: Thu, 18 Aug 2022 08:31:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "aca8368210f82021"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 18 Aug 2023 08:31:54 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012208081650000/v0/ Frame 123B 94 KB
28 KB 91ms
22ms Script
text/javascript 2607:f8b0:4006:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012208081650000/v0/amp-analytics-0.1.mjs

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202208101343/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

70fa25d0cd4744b6b91054ad55e3e931dad31cc85915b13e33e4e674426c7cc1

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 220883
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28794
x-xss-protection: 0
server: sffe
date: Thu, 18 Aug 2022 08:31:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "cc093c4134ec5f1e"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 18 Aug 2023 08:31:54 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012208081650000/v0/ Frame 123B 5 KB
2 KB 135ms
67ms Script
text/javascript 2607:f8b0:4006:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012208081650000/v0/amp-fit-text-0.1.mjs

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202208101343/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ec61d9fd1b3609a3a53f377ed07059c3dc7d2cb1502022e0623b4ebc1ea0f35e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 220883
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1913
x-xss-protection: 0
server: sffe
date: Thu, 18 Aug 2022 08:31:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "ef17e6cba96d5668"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 18 Aug 2023 08:31:54 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012208081650000/v0/ Frame 123B 40 KB
13 KB 131ms
62ms Script
text/javascript 2607:f8b0:4006:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012208081650000/v0/amp-form-0.1.mjs

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202208101343/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8d200dc372fb333c0ca488fba2a569a686cbf5f1ba0cc0544a4a8c96a4f91de3

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 220883
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12948
x-xss-protection: 0
server: sffe
date: Thu, 18 Aug 2022 08:31:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "08e07a681963ea9f"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 18 Aug 2023 08:31:54 GMT

GET
DATA 200
OK truncated
/ Frame 123B 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1e471bf66e0305451ea72c52b8e7278dd9fff5cc2b8032e3203582be20543cbd

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 9804956454964452150
tpc.googlesyndication.com/simgad/ Frame 123B 5 KB
5 KB 22ms
21ms Image
image/png 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/9804956454964452150?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qly6u7uNmje00GxP9JlMspc7L6Aow

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

37d6dfa1753c4cfe89b9edd0e3e6e86da619ff0bbb1126fe2a7100e1953e624f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Fri, 19 Aug 2022 16:31:24 GMT
x-content-type-options: nosniff
age: 105713
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5373
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 15:14:24 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 19 Aug 2023 16:31:24 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 123B 2 KB
2 KB 20ms
19ms Image
image/png 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 08:15:20 GMT
x-content-type-options: nosniff
server: cafe
age: 49077
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 14819457070020093239
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Sun, 21 Aug 2022 08:15:20 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 123B 295 B
319 B 21ms
20ms Image
image/png 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 08:15:20 GMT
x-content-type-options: nosniff
server: cafe
age: 49077
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 426692510519060060
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Sun, 21 Aug 2022 08:15:20 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 123B 0
0 45ms
44ms Image
text/html 142.250.65.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CtmolzFcBY4fXK6_InwTP6rygDN7n1fZr6bHllrkQ1ZH8wgMQASDVtJl7YMmG_4fwo-wSoAHxhuW8KMgBAuACAKgDAcgDCKoE-wFP0JVOJsIGhdgzUa6Cu7qTl5WJlLLYnznjN1qkAWQ8idPJzRKwhAIHKdMJiUHXQxKUJLri-rt5HrmrNMczkp44QqzRfVvpa9vu0onkQtofsIqB59K32aIaTHv8uDC3ZdVEw1HSFaH0OFAyr_EUkwjXVLVniFu7hzwKKl4uwohhZlnhiEUTULVnZf5ilRP64HP-wx9kxlF19ivUrkhksei-DTbKaIThsZ1d-xXJlYkRjwwYhK17ETaGbL9leEsYSerYzqWkMe_lxN_Tlm4k2PKDH4-J5m0qUR1dAerpYVCG0-MU7g0YYg3sL1XfdQCqfnZhWJaiA1tKOoizbcAEjv342f4D4AQBkgUECAQYAZIFBAgFGASgBgKAB_G-tZwDqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHyBwQQr9Q50ggQCIhhEAEYHTIDioIBOgKAQIAKA8gLAdgTDNAVAZgWAYAXAbIXHgocCAASFHB1Yi00NjQxNjA4NzExOTc5MDkxGKHYGQ&sigh=HeYSAKj5LOc&uach_m=[UACH]
Requested by: Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s72-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H3 200 container.html Show response
968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame A9EA 6 KB
3 KB 81ms
39ms Document
text/html 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202208101343/wrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://work.ink/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 20 Aug 2022 21:53:17 GMT
expires: Sun, 20 Aug 2023 21:53:17 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 80B9 6 KB
3 KB 70ms
38ms Document
text/html 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202208101343/wrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://work.ink/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 20 Aug 2022 21:53:17 GMT
expires: Sun, 20 Aug 2023 21:53:17 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 6CE6 645 B
742 B 87ms
37ms Document
text/html 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLO4XRDz7F4Y6_PVXDAB&v=APEucNXlGGudR_--kcw4V6BnpnwbJGucJvcYwWt4R_g0LVxWyDiO43XbWxN8EcisGJKBkVbLy1MxJv11jXVNxJsFRuAuNml3ShS9NwMnvehJ_faer-myNyE

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 285
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 20 Aug 2022 21:53:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 80B9 62 KB
31 KB 131ms
84ms Script
text/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CZecFYpM4jS0khq9RLfRnZTmufPVy-wWskRRUAkGY9vBkA4IUK3BxMxVfsCJm3SbJgV7B2bsvH5iB_VxPl-94oymouK69bU2EP3lGVcbkysuNlHIqPI_B9O240j8lqx_SWjxtKeUCj3pCGnid_v56v3dAlTQ&dbm_d=AKAmf-CcKmtaMoj6KeZob0p9-W4dAEQZ-awwWkyMI0WcJiItsh6Cuy_wjFvmmRILPO3anYnSW1vZ7kqKBSOLmdQvri573z-selwCqhdtt8B-VuwO0d4iTwf8-ed2s25moYiT8fBRHZYbtkr-_A-4ri7sV7sQcVP6hqKRRjvVt3-lm5psKm1mCEIyQuAroOusiZn7kzNNeKqoOqjFJsOq90daNxwvGzQVPt6uzYSvpye-VpQzZYNerDqXfRWIHPa5oSbZCEpQ-m2V357Zow6-WDkq1SqefU9OZm6LFYa6OQipEN5MYX722QuSWI0U8PDL9CKkgl43h1xhGs8w-FqiaCAfq4Kduaw00FtWomJu17_LEwtQvwRvd_IxZXHDcAMvQ75JDNh6itNQwiZg2_WZaFCVnMUTMbuMJchG8CofO9_DN-YH0N3Glk2s6usBv7PLdhP60ITB_-mnYBtAktgwDo6XEeNpdw9vbQCbN-U50CiUP1Mt-jULGU5sh64hQxZzJG0QzQuq3IPhJdo6112IWUtcHKprCC7mNaLkUHFAN1J5r5AexUTvzmoSRdwawpuQ0lh2LZp7W4AvTwCWnP2CvL_hjCU3Peswos-wK5-EFgzetpX6S7ncgNoB2X8y6l5b94QdZMMeACafa-H0zLlAUP0-EdVWAaHxyn0rJNxoLxLFZUMD9Vp7VknZrsPArcX3bu5hc8aWlFmKgwEbqKG7IN5IT-tq1FgL4_L2g49n72CKDXlrcnOQ6-JmKEQ9N3qDiSXyuWXeXkrmlr1Acrt03o5cX5uCmHDJw-z9Ekt2A7HXSTGjvnl9F9jAwZOUThSxGlKC5Bx8Ch6L6s2Lb59WHBRG5yhfrquUcnK-Uu7DX6o75d6y4u7IXcKwoC6MpH6M48hG7grRWGu9XpIyKJrn1bj3hfuI5QDNYY76ORaxzIjPKBjDeT006XKCUj3clBlFO37h4F19X3wz1cBrrUc4CiNFXiBt5GmvqdBoNdJblKA8Q-DboFM8ZLm9MderRUagJE4VF7iqz4ZG36vMdh1Ke5JW83cVgXCWP_fk6Wx5IIOOKiUlVRcQprQk0RYqOxinHxq5hj9H543DNN6H5D9UtqAyYRCAGWUMUoK53vpKQj0D0rNEIjP_Kcegm6nG_lp5SuW4rE_RCYDTdM0vYbINnaEo7lR4b0V0689CGJwXzwffymYjSfR4wqdfXByuZbm29nLIyXqfmjRzDwJIVpLwJ569UW33hHCq-6GNd2MdYqnSm_l9DFXMhFp0Y4oIW-SOoDMRIpM6hUZwmxsE5NuhTB0wQa9LlQx4GyguzsefS7r9mMjEiEmri3DxlGLoShUWSWDXMYWJXhOJGmePiFMUEOEZtkFlE1vIDqNgb_2K5rjt_gNtxTJI6qwldyIRyyKp4GHq5TMJo2IyN4UwVAOwkgUstP4DSHKy-j7dzLTH9XKn0VQ2JDLpVnem8cQMcSAnme-Cdhw4SypR4I9-G9nMoQgVqcIjw11_EApVP-QBBThrHVajputGQR42lJf6ANec6z3034XRyZypMGS5f66KjgHWo8BU7vx1HH5Aoq6j0xYeCORuMPa9VNx2Cf2mRW7ml1wQ_IjD1oZ3Bd-5SkcELc6NGQdMjoBlplXhtgJSHBdW7kFqjTuv3clhmRfkB_MjXf5cenV7gsaH71CPZ4TfIf4ZM-ZalOZ5ard1gRcujOWIB1rLXsI3YyckANvYrGeaalkZAnreegrPRlqkwFyee2cqaVfVkyNYh_NwM3WqyHFydWUX_o4IkZ2Or1nmBEyBAOwyhR4_itr96dIcJoBYnZwUO611QYjRbFEQCvr_ii_DIzl8pacXEL2UYTeCuEuWs-yyBCe3bego1DFkrjyPCiRjcRvvQn5fdT3qW3fcllHLhTa_z2l6C-R4YZz3YXhgNj3Y9-lAOYjGlr5hbAVfn-zN5P48dfPpnSvcohDuWt9AVKLEyEhwalaJDb4Yikv-fy5JbyenwZ5MUNhTs2a_vTzEAgZsZFWD6K95uY_GWOTKCb6ey2Om0IX6HXFXBkjg9ZEDNJoRH2VIXs8CQTBt1TyK3twvzC3gHSq8GI8ZQorn3lXZUV-mkhOEtUi_BZdilZ4_C6cSFcImuOXIxkhDGJZntZBj3NsaDGCsxJkGR7xn91WXF_8enrpvHnelEtZ5s4zLEhec65eVSTCB5Ohrp6EhSvqVd68_9gFEvj61QqOZpea4_wRPhS4hoh_1vKqGoqRAy25pLsF57gzJHQragjCuY1Wij-48D435iLndNWoKK1nayoITI8xgv2Ni0kD6oKgEaeNamEXqlO96JK3Y6XzYyB-hcdfIXXB7aa20wo_9zL_q8lPGF2WLNakUzUqfsn5_-kp75e_uDH7NasByCGg6czdCSYUtkoczeeA3AMXSF0pIW8hbcbZajgxSYvOjLLEMYJUHNlr0VCZKH-9ySnRmweuQzWz9uFRxpJv7Y9XFye07dlE7_VZnDTRN1jGzjKHKkQZin1Ixs0pYRPQ7MizdfvAnoQLwBEtud__-8z7Yqwe_AWeUyO6Rqp7RnnocGtw7DSZBrWnsZVHVFU8rY4Yg739gnpEOuaMQh4xOugQ6y4pH0txq9wW5-B0tSbRsVkU0NT-D1IcgGKH0rTnGetbGvBsNCMJyreT0mmQvc2ABfSdoex2Y2Q5mcsp7XlxoKE23loV-B7fMUbZki95r1_JQVtHUz09RUm87AUYTg4I82XasaHLWZ07Vp9rDEN31keaDF76ox0QEJw6lVRIB5BMh1j0fmGzsyalfAm32hH2HvPHB1g4KHCRIs17YqG4_ZTwMzr0yZAK2IYeDSP537XcG3g1ENCffL0myxt7FETGQ8OlrcyrzpV5EwoIkX_PSJstvZyLjPIR-R3mrM8hrXHIPqRQjPXlt2HM8ejeZsFa4I5Zb7nlhoYNjV4It2kKCUSbnkRzEte2m4i1BAPURlGzPws--Ur0lPDxyHFTv6Gmy3jpDP4qczli-8e2gql37xTfHcwU-DqCX1aLGbPnj9msRFChyZhIwGg&cid=CAASKORo4GVWH6y1eXUr1clCZBbbYC49JH4Y8pPsPOQqP6HNEYP8iDhMVaA&rfl=1%2Chttps%253A%252F%252Fwork.ink%252F%240

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a9b6f7500c0e8ca27fa8308fea3dfac9157d63e4978d76cc8687835f1554268c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:17 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31248
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 80B9 42 B
63 B 47ms
47ms Image
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BpWvLLsxnly_gDmROVMOJMC_ASQUvkmZ9fXTXlEpKRAQ_dw00QETG60XYYlu2-nGBsAocwneio2QKN3gb1mgbulhxpedLP3vxq1JGdmH-_ah8eioo

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220817/r20110914/client/ Frame 80B9 3 KB
1 KB 22ms
20ms Script
text/javascript 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220817/r20110914/client/window_focus_fy2021.js

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:41:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 688
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 03 Sep 2022 21:41:49 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 80B9 140 KB
44 KB 113ms
62ms Script
text/javascript 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba7478138664dfbadff2af30a268f4200a752a73d07dafb55937af20d1061357

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44050
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1660737283953252"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 20 Aug 2022 21:53:17 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220817/r20110914/client/ Frame 80B9 17 KB
7 KB 22ms
21ms Script
text/javascript 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220817/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57000ea03bfb53734d0858b8fe992e6742226f23f311eb0f9d2177e2a84a5621

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:47:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 369
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7599
x-xss-protection: 0
server: cafe
etag: 9215437806027971270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 03 Sep 2022 21:47:08 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 80B9 0
0 39ms
38ms Image
text/html 2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTSLIywRc59nLs9Jjeh2xJhxX7tHVAaEd1cxLOKIBREBw8uNyIYJPr9ZvbNuD2YfryFscaIocknet7Lo-sXTI-KjJxoAQ
Requested by: Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:81e::2004 Perth Amboy, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H/1.1 200
OK pixel
protected-by.clarium.io/ Frame 80B9 68 B
345 B 124ms
27ms Image
image/png 52.70.74.170
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://protected-by.clarium.io/pixel?tag=wt_YmJkdk9BSm5xSC1JZGZmZ25fMDJDMkN5eF9FLzIzMjQwMTE5MDk6MzAweDI1MA==&v=5&s=v31gaujtupk&id=eyJkZnAiOnsiYWQiOjQ1Nzc0MzI4NzEsImMiOm51bGwsImwiOjAsIm8iOjIzMjQwMTE5MDksIkEiOiIvMTI0MDY3MTM3LDIxODI3MDc1OTUyL3dvcmszMDB4MjUwRlhfMyIsInkiOjQwNTUyMywiY28iOjAsInMiOiJ3YWxkby10YWctMTIwOTYifX0%3D&sb=undefined&cb=316359&h=work.ink&d=eyJ3aCI6IlltSmtkazlCU201eFNDMUpaR1ptWjI1Zk1ESkRNa041ZUY5Rkx6SXpNalF3TVRFNU1EazZNekF3ZURJMU1BPT0iLCJ3ZCI6eyJvIjoyMzI0MDExOTA5LCJ3IjoiMzAwIiwiaCI6IjI1MCJ9LCJ3ciI6Mn0=
Requested by: Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.70.74.170 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-70-74-170.compute-1.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 20 Aug 2022 21:53:17 GMT
Server: nginx/1.14.0 (Ubuntu)
Content-Type: image/png
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 68
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 3084 645 B
349 B 51ms
38ms Document
text/html 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLO4XRCv-LquAhj4w9zOATAB&v=APEucNUpwDg50lic2dUo691wNA4AsEZtNKI3W3P8IKMGbTezZ8QB7QJJFily3q-xVwpV8-37zp0C1zo5pbDYyhTj9oEOCluix8qOY3DzKR5j3Lgttrsvkxs

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 285
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 20 Aug 2022 21:53:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame A9EA 79 KB
33 KB 75ms
64ms Script
text/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DgUejt-Q2pBVSHatbV3zYIN3x-uvIC3INVlKVcNi0l84mWnmavxFpnodaZAPvlsFQOHp30ur09Ccx80ps5z-Iu882ARQ&cry=1&dbm_d=AKAmf-AybHhWHQ7q7S4bnCbfIblu8FANlfqWLdDItm71Fa6NTuXAJ-zceUoaJprTVDqRoY5ngRfb4h-O1Q--tgPRSK1YaPguN9uWK4KEsscz88zSuJbwTYcHA6DHNcwOwbmJUgVvy9NCGy011YK0bJNmuS8G4XEC_nzlMe-krD3auXWpZM6ZTQNfZZzheedAAXN7uE6SL0fe1vPCrzigDuycY0IGSm2k1CTX4IEOull0XDEEX4TAlmKqMtHLXHXtsJ63AYv7bLVXMByh8kCGA9f0mj4cX0Fu9Ue-nvXAT-Ok_O90CY7pux0S78efeCpX0KFpfuFn_lrmjotT5aMk8KEg2Qs5y1PcH1dCp101YYi6pfiaHCIBkyCTN0of08EORTwc0e2RFag46TJMwMU_d1a6E2h_zcyv_wkMcAUBdhEkTIJT_XMvZMFbWgTwxdv7EaUdzuBEobrcJPeWZw4VzMyMfSB-h2EFRBGZNd5ZFgBEYp6QSGYxiiCEp7rGpj17_Fo-4t_TTU6qVJuB1vTAtTVoMuVmx85uHawnKMm4B0Hb3ghkEw7VqC-hTTIuGGQ3boTq06_WCPGNjNiVmMjTzjyZ4HhtOCBlu8D9ehSmENLIGb9OJA6sDq8XmUNDzEbYM4dElz8_wNqMao0b6m6YofwrbhZhgn1xxpSbzs-_BrIEGjbPmfUywXyuDgSmsofQTssLiQPfC71644frsOYZlOGdP-tkjHLFkqWJcI-Vy96gI5rE2GhX42xJtREyLY0g4qZW9NsDwQSh8YhDIWiKYyiUpSlq0YdAxBOSnWcpstifNVd8_rwyFFcEYaAU7KvACxXbVk2vFVOkYaSVhtLQQLKZyhdS89y34nrBxtFpQDgHrrOp4Ov6RbeoA_ZYQVU2GIqjwm8hyDkBp_8fJXIxK0CogwiH5P88lTiLJrNBUKhYpji9_2XUvbaJGxkNrWvlGrmn1dc1r5YPLYDHSU43ydpOQL-PRVXLX8mbPu7jj8ZT71Ypc4kBlxfJh0HLvIPSH6MC6UNlUQbA5j2zERwDDBAGBC_lwLSLrKh9t48ZdsbEPksEmWgE3DoupNbGS0Rwp73Og0yhDubM7-nmMI-XY6_z2uAEjZy6VJAvMnWjBKRkNJWn2Suf-cis8SBmZx0t07sO_phsvF1rbZHMMHq3mVWreygLCoyaH5jFzstVxXewRl762wGcSQba51WnF4mm3zXPZjxHsudRUWD7kUaBPiAD3Qp7oM3vNqNTNMIMl3LGTZ_JBx40CPBF_IE3Nm2LNHjZz6CHipSRgcFRFoh_f_DV-dtCxlvNBE8RWp05kTPvSEbWg7V-MuZxotZmqPX3P4T_Xvte2Ntt8UVimRlPYBPyBQR6O6QMIKNTkrhsBobhx1M96ZAH7HLqlT3gf23iyckQR37NUePnDvAspyiFxBuwE9IGxxFlj2grvn3_FawMyPSi-cjdvdkvdSsQWSfeJ5C0I2AUJoQYOQeHO4ccizG6uR8tbeUEn7hKj33G6zRIcUOSjDLklIxqVO3qQ0Jv3nCCv5rqJ5VDK8YXK1G24GRsy9LO_JkOT6S28DtxW80wWe1kXK_CKoBQxd_9tZQ52ZFzqRexVtDjDIea5NHeoSfEOq0z0qwo4tbtUrfL9obtaNvbzg-n9MPn1PI6BYQHdMQFd2JLYBDP-oX-RTUFMfjVug-DEzd_y3xm4j8PekKltogd5u4A4zc-LzJ2gwmRY8k9v-yOLT0w1hdZ9i53zkPFVZ_njgK_wLaLjVpwbIvxPZCMP2WqTze2E_lE4OPDDOlxCO2Ito1BsYHRRBVkOC-QKGvPVt9tdBRbD-gJr9bmSk1w3_h5rnlncgGEqq0UvaPAZROnkxAaUZW8_E0wx5OVF4yHMvIy_Toxpk1F5WV6sjVOlqpEl00_BgZLZQ-9LDgFBGcQswNmro0IYNnc8XDDMRWDUzR0c7Q6N49yYF7bSS2KTE4ZKXkQixMNIOaiACfyC7MiOZ2CeWx_DwWLB9-0pMPVacvzc5PSYWSCw2JBoLZ2uk7y4sHAKirsceLiy2SK_oxbkBb-fOk9dtu2PCdxV3EZLP4rkRpsbAr26WKNYI3E9AlhXKfZvdxkUw8xphA9JVIxGfEDQwuft6P_yItQPqUJPQJNjoU45vmHaQvgAjbxkE2HoVcefCb0BrZMCj2P_GtC7-T9lGki5uC5ueUOO3KxxZ630D1KFxpPyJGt4mIk971wLryPwhd39ZWw4bqJ2SBvZ-IRodjOqVt2kYZjIVKO2aRkUDnkFGGOkhw5puaYSmltfTwKjrI9n9YXZT8X5naghpQJI46meqvcE_w4lafGmGD4TSLNBU2PWpih5GPAR_3xs8Da-aZ5_PGoYpjaK3q4zqd3YxUx-VghpUxnBp0PTMHf9c-jdsU57hkOLjhK5jsC21DWGdDHm9BkSK71Hz1NFlB4-Obvm5BHVSdiDbe1BP1rSXkUCXgUQ54G6UFZYNLT8LKcC5v0pWNooEBHzZSpsNN1lcEOD0Wxdl-_8K_U9tRz7JP1KEK6HxHm3aQas1zCtkkmVgWB2mWLF4ee1U6_y46EHuSaVDswEcW1XEhamyb7xPiXwycgJqvnIjKCmakM0gtmx2o1DgAU1I3NHDVwcjooYps9DMCACaPLsF9j6iqBBa10ZuqK56vmUsMpfXrP7s60mxh6TCbLMcjZfU0O87RO-7JVJlVSmsqLcaFp-DY8jXBziGmHx3aBLjRMSXZowGiEob_6qcB8_7E_kzcxO1aWvpBhgdBFMbEOTU8B9KdXn4yNhynas55oZLWE0ulDAT2OZjmJf-k8s33Nk3GyMgBcLtLM7NM6_Po6_yfu01SaFAopw1RjYwDZok8wx_NtZBtmfdkkFijYML2DdnRMXpOVqC6pCiDkc0CuErhVzQYjQt6AL2syJW6VO6u0Xi2u_gCJvXEsD9poN92H1hlWAFgwWbFeDYGzjwKzfqDFxvak1CfJTVU2Wb4sglbm191h-FgsVVsOMGIQ6ypwltqbT3p0A7VkeK9g3dkb9fkNKBsiQJ9vZNMz-CysBfov2WxHkNMlLmG3Pqsp_M6A04g4zsKoDONMhXnDaUupikGl-Hy7TRzs4pqRSzk6SRz-b_jqPQRjcuB6cc_6YEZh9_5sD0tzL1tNkb2vulLQCy_bU_lWCRVTpd-GzHzrIVC4ZCeIBKpG14ScQxwjMPyV8eIFnPfxeCf90y97rWKZ7kL1spVbz7cPFr1vHQxfVgSQRqQ2517QURgtlhVguz80fNm7R7JO&cid=CAASKORoWvoHFD5Mh2QGOmBA8-r0kXK7cyPjmEg9K5XaG2f4vUPSVmb6SJQ&rfl=1%2Chttps%253A%252F%252Fwork.ink%252F%240

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5a70e330262d85b9a95b3864122a241b500d54bf95785b6ce154b36d81c99cc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:17 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33930
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame A9EA 42 B
63 B 48ms
47ms Image
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AdwqO1vAl9UensbQh3iHS9oXtUIfYqgeYxg-xQbNKZWKpLTbGaPQfTLDQossWSNspvxBUx0DnjTp9uYv-Ck3aGV9-DnlnlxgoAXlddXOPHME_o158

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220817/r20110914/client/ Frame A9EA 3 KB
1 KB 23ms
20ms Script
text/javascript 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220817/r20110914/client/window_focus_fy2021.js

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:41:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 688
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 03 Sep 2022 21:41:49 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A9EA 140 KB
43 KB 105ms
89ms Script
text/javascript 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba7478138664dfbadff2af30a268f4200a752a73d07dafb55937af20d1061357

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44050
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1660737283953252"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 20 Aug 2022 21:53:17 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220817/r20110914/client/ Frame A9EA 17 KB
7 KB 23ms
21ms Script
text/javascript 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220817/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57000ea03bfb53734d0858b8fe992e6742226f23f311eb0f9d2177e2a84a5621

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:47:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 369
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7599
x-xss-protection: 0
server: cafe
etag: 9215437806027971270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 03 Sep 2022 21:47:08 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame A9EA 0
0 39ms
38ms Image
text/html 2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSu6SWwdjisAvVRHr5OJdU-199ZCN3phP-D6YoLDIGyp_itdGb7AT3wswuw8FYgNfCItuXQx4ZQNbz2Bqh86Z4F0izWIA
Requested by: Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:81e::2004 Perth Amboy, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H/1.1 200
OK pixel
protected-by.clarium.io/ Frame A9EA 68 B
345 B 98ms
26ms Image
image/png 52.70.74.170
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://protected-by.clarium.io/pixel?tag=wt_YmJkdk9BSm5xSC1JZGZmZ25fMDJDMkN5eF9FLzIzMjQwMTE5MDk6MzAweDI1MA==&v=5&s=v31gaujtuqq&id=eyJkZnAiOnsiYWQiOjQ1Nzc0MzI4NzEsImMiOm51bGwsImwiOjAsIm8iOjIzMjQwMTE5MDksIkEiOiIvMTI0MDY3MTM3LDIxODI3MDc1OTUyL3dvcmszMDB4MjUwRlhfMiIsInkiOjQwNTUyMywiY28iOjAsInMiOiJ3YWxkby10YWctMTIwODUifX0%3D&sb=undefined&cb=5149756&h=work.ink&d=eyJ3aCI6IlltSmtkazlCU201eFNDMUpaR1ptWjI1Zk1ESkRNa041ZUY5Rkx6SXpNalF3TVRFNU1EazZNekF3ZURJMU1BPT0iLCJ3ZCI6eyJvIjoyMzI0MDExOTA5LCJ3IjoiMzAwIiwiaCI6IjI1MCJ9LCJ3ciI6Mn0=
Requested by: Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.70.74.170 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-70-74-170.compute-1.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 20 Aug 2022 21:53:17 GMT
Server: nginx/1.14.0 (Ubuntu)
Content-Type: image/png
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 68
Expires: Sat, 26 Jul 1997 05:00:00 GMT

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 234ms
26ms Preflight
application/json 74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Sat, 20 Aug 2022 21:53:17 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 839041
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 232ms
24ms Preflight
application/json 74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Sat, 20 Aug 2022 21:53:17 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 432102
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 123B
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

93ms
50ms

Image
text/html

2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Protocol: H3
Server: 2607:f8b0:4006:816::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Redirect headers

date: Sat, 20 Aug 2022 21:53:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 41ms
39ms Image
text/html 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022081501&jk=1074343624175283&bg=!xsWlxYHNAAYUOm8VNDo7ACkAdvg8WiNaPIwfbBu71_ZCHD92WTdXg-d593_X0LPdqHrld2fZJd1zzAIAAABVUgAAAAJoAQcKAEcmBS4teNs-mQwrXoFrnIPvExhIAYzAvd34d-tJmTTPgNudNNc4xMaA-NjTXGTU9S3bN-HQVvjt_utGRtLWJpdsq5adOQqwT5kC8KtST_a2tFgmg1XT8Ztd7RlbNZ_XmGTZHrTkX-pfIEKd8k9awkqTLtdtL-EHTMGDxYbjw2XF3xQOwyXwtX8PJ0nEC_G-0DGKMZK0w_XKwNKBTfIboj4VkrwEw2MUKUSpvIB5Ydhuf0gAqihYJizzqFcLhJNK0xCcFpg6cdgeXjIg47_Bokn4zyQckCf_KujaQSW1WOkFdZfhHRoTeGrcrAGghn4JhO_PePi1BjYa2TNoRn1qbxbsO2QXo20VhwyEXGzPKeIzVTE6KvbHdRNZeQRMzdRVrZxIF1TTPOEV8GGeo5Ux2AKnIyfWIS_FYr-eTh1__L4kuQAI76L7zCkzzcmaP_W5tVJYjSpuCKtRtNGxyjAh9_L4k1eFGM8dNuWxaouyyKE0KUHYNwqF5g4vauIlyW858zS_EbJwyTCYh2lU9roJpMy6mWW-txCfR_bKhbSVT823iO9_VPZOAsesnxWBY6Vj0EGJiM4aHtTdll9kADKvwlCpu_Q1rzhKzzErrer746bZR5-dBeCMQ-Gfclt4cGwZEXdpPlTBhqKn6CacDtBo8iWTed7bJAzEfyeemdUsKYZk8VpSyBr8s7HAKfUYywcDA4eU9r_IhUGL3A9pCJLRKQ7FLHCvPS1WPHzKQqjrLJSudQXjmJG_O4PSc3U-LNL1ZW0cupVHZql9zND44MdMdL3de1Usy5QNE_jJVEpW4uP85cpN5EYutCUd5XEpB-HgaC4MWhNO7WmNKKeiXm5za2_n4xLxGyH8YQTuAww__YTkMGsefYYlM2KWiMTpX4XIFURpdNS9HP_K8B5Mr8Y8yayfsdhgIvX4YBPjtdi5kyCbjSEzq-4ssmASzBqXqJp3JUmuBDxTmYvQFhQhdKCPrfAEeWjTOaoyBk1db7W4vAO-ziqsVLoEcRL-Ym_0m-maBFVH7kwnfNF6MFSaO9cKPzCM3ZClxznVChm5OBEBQLQXqz2vNjOzx7nH63iNnlvKEv1yqCX0iwN2qquO
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H3 200 9804956454964452150
tpc.googlesyndication.com/simgad/ Frame 123B 5 KB
5 KB 24ms
23ms Image
image/png 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/9804956454964452150?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qly6u7uNmje00GxP9JlMspc7L6Aow

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012208081650000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

37d6dfa1753c4cfe89b9edd0e3e6e86da619ff0bbb1126fe2a7100e1953e624f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Fri, 19 Aug 2022 16:31:24 GMT
x-content-type-options: nosniff
age: 105713
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5373
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 15:14:24 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 19 Aug 2023 16:31:24 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 123B 2 KB
2 KB 23ms
23ms Image
image/png 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012208081650000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 08:15:20 GMT
x-content-type-options: nosniff
server: cafe
age: 49077
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 14819457070020093239
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Sun, 21 Aug 2022 08:15:20 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 123B 295 B
319 B 23ms
23ms Image
image/png 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012208081650000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 08:15:20 GMT
x-content-type-options: nosniff
server: cafe
age: 49077
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 426692510519060060
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Sun, 21 Aug 2022 08:15:20 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 6CE6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEH4DzyUzuzgbWiFXLt317l4&google_cver=1&gdpr=0

43 B
950 B

77ms
54ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEH4DzyUzuzgbWiFXLt317l4&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLO4XRDz7F4Y6_PVXDAB&v=APEucNXlGGudR_--kcw4V6BnpnwbJGucJvcYwWt4R_g0LVxWyDiO43XbWxN8EcisGJKBkVbLy1MxJv11jXVNxJsFRuAuNml3ShS9NwMnvehJ_faer-myNyE
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

cf-ray: 73de5c66ed42a1fe-YYZ
pragma: no-cache
date: Sat, 20 Aug 2022 21:53:17 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1EoL6bY0Jak46bP9An%2FrfkrXy3Lrq%2Fk88Z9tmV0%2FHDNUIOD4FZc9iclwaJy5YqvamkkM1hWTr7%2BuFxLweu3sGXfOrggUw0lBLA8Ua%2FbcsW%2BLSEUmuTUnA%2BTRii6dLjFgFnF3PKHhDEuIUg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:17 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEH4DzyUzuzgbWiFXLt317l4&google_cver=1&gdpr=0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 324
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 6CE6
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YwFXzUBaZFLLLerwapdPjAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEH4DzyUzuzgbWiFXLt317l4&google_cver=1

43 B
910 B

60ms
59ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEH4DzyUzuzgbWiFXLt317l4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLO4XRDz7F4Y6_PVXDAB&v=APEucNXlGGudR_--kcw4V6BnpnwbJGucJvcYwWt4R_g0LVxWyDiO43XbWxN8EcisGJKBkVbLy1MxJv11jXVNxJsFRuAuNml3ShS9NwMnvehJ_faer-myNyE
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

cf-ray: 73de5c67eeada1fe-YYZ
pragma: no-cache
date: Sat, 20 Aug 2022 21:53:18 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pvybxjioKvrB9IPQ7V5z%2F%2F3smkR4cufRYKkEiVET3rG7hz9pMpKfKvlxsDiOdrk%2BFweLsayRl7QvuaIES5eJefBFmJcvSR9GJQPyPtQCzwZ7Au2lHnZxScEXCXILzHLdX6GD02jdjnMlIA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:18 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEH4DzyUzuzgbWiFXLt317l4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 6CE6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESENPgNqVpgTVLn9wG6oh5yOQ&google_cver=1

43 B
1018 B

27ms
25ms

Image
image/gif

68.67.160.24
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESENPgNqVpgTVLn9wG6oh5yOQ&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLO4XRDz7F4Y6_PVXDAB&v=APEucNXlGGudR_--kcw4V6BnpnwbJGucJvcYwWt4R_g0LVxWyDiO43XbWxN8EcisGJKBkVbLy1MxJv11jXVNxJsFRuAuNml3ShS9NwMnvehJ_faer-myNyE

Protocol

HTTP/1.1

Server

68.67.160.24 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 20 Aug 2022 21:53:17 GMT
X-Proxy-Origin: 149.56.153.189; 149.56.153.189; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 347c76c8-d9ea-4c4b-9168-6138e0ad6c6a
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:17 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESENPgNqVpgTVLn9wG6oh5yOQ&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 6CE6
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODM0NTU1Mjc0MjQ3ODQ4NDE5Mg%3D%3D

170 B
243 B

36ms
35ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODM0NTU1Mjc0MjQ3ODQ4NDE5Mg%3D%3D

Requested by

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 20 Aug 2022 21:53:17 GMT
X-Proxy-Origin: 149.56.153.189; 149.56.153.189; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 4d575150-7cd4-49a6-9ed9-f18cc01b4ca7
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODM0NTU1Mjc0MjQ3ODQ4NDE5Mg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 3084
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEH4DzyUzuzgbWiFXLt317l4&google_cver=1&gdpr=0

43 B
911 B

86ms
64ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEH4DzyUzuzgbWiFXLt317l4&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLO4XRCv-LquAhj4w9zOATAB&v=APEucNUpwDg50lic2dUo691wNA4AsEZtNKI3W3P8IKMGbTezZ8QB7QJJFily3q-xVwpV8-37zp0C1zo5pbDYyhTj9oEOCluix8qOY3DzKR5j3Lgttrsvkxs
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

cf-ray: 73de5c66ed3fa1fe-YYZ
pragma: no-cache
date: Sat, 20 Aug 2022 21:53:17 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OKbgM%2Fcv7khWlHUJgoN9YplVr2sj2tX%2FEXyGyxQzzDKKUHl6EgE3nox42qf9BJ9Kin8EvRGjqWAGH8xQekMI%2BGhug48bTSqCQvpWG7irY%2FEyClyx1oaM6BDM3y4WWV8bP9CGGIPC0hKl2g%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:17 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEH4DzyUzuzgbWiFXLt317l4&google_cver=1&gdpr=0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 324
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 3084
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YwFXzUBaZFLLLerwapdPjAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEH4DzyUzuzgbWiFXLt317l4&google_cver=1

43 B
911 B

57ms
57ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEH4DzyUzuzgbWiFXLt317l4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLO4XRCv-LquAhj4w9zOATAB&v=APEucNUpwDg50lic2dUo691wNA4AsEZtNKI3W3P8IKMGbTezZ8QB7QJJFily3q-xVwpV8-37zp0C1zo5pbDYyhTj9oEOCluix8qOY3DzKR5j3Lgttrsvkxs
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

cf-ray: 73de5c67ce89a1fe-YYZ
pragma: no-cache
date: Sat, 20 Aug 2022 21:53:18 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4PR3GfrPDVzn4mej%2FLIz%2Fbv7AHs8vDmO4CG8HptZ8AX%2FH3R6VTZ%2FUThM5zN8yW2tb8Ofy0uy0mcpWzZJzVObd7mYZTka4sijOsqNvYNMVqn7wjSWsNBa4lhvGng7EgauXB0BK6M3NYKW9w%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:17 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEH4DzyUzuzgbWiFXLt317l4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 3084
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESENPgNqVpgTVLn9wG6oh5yOQ&google_cver=1

43 B
1018 B

40ms
39ms

Image
image/gif

68.67.160.24
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESENPgNqVpgTVLn9wG6oh5yOQ&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLO4XRCv-LquAhj4w9zOATAB&v=APEucNUpwDg50lic2dUo691wNA4AsEZtNKI3W3P8IKMGbTezZ8QB7QJJFily3q-xVwpV8-37zp0C1zo5pbDYyhTj9oEOCluix8qOY3DzKR5j3Lgttrsvkxs

Protocol

HTTP/1.1

Server

68.67.160.24 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 20 Aug 2022 21:53:17 GMT
X-Proxy-Origin: 149.56.153.189; 149.56.153.189; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: bdb20296-6a63-4e65-8d91-80e8b0079e0b
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:17 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESENPgNqVpgTVLn9wG6oh5yOQ&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3084
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODM0NTU1Mjc0MjQ3ODQ4NDE5Mg%3D%3D

170 B
188 B

78ms
37ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODM0NTU1Mjc0MjQ3ODQ4NDE5Mg%3D%3D

Requested by

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 20 Aug 2022 21:53:17 GMT
X-Proxy-Origin: 149.56.153.189; 149.56.153.189; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 9ec88076-6611-4e73-ba39-d44e351dfe45
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODM0NTU1Mjc0MjQ3ODQ4NDE5Mg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame A9EA 106 KB
38 KB 91ms
19ms Script
text/javascript 2607:f8b0:4006:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2006 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
Origin: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 08:01:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 49920
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 21 Aug 2022 08:01:17 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220817/r20110914/elements/html/ Frame A9EA 8 KB
3 KB 20ms
20ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220817/r20110914/elements/html/omrhp.js

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c9499ea51a2956fd2c1600591ae117fe9ad81065d625b1b2c593c7720e5b228f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:49:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 246
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 18418590997839133011
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 03 Sep 2022 21:49:11 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220817/r20110914/ Frame A9EA 30 KB
12 KB 23ms
20ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220817/r20110914/abg_lite.js

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c0d0b5ecf5aa2cd5475929aefcb44d67c5d5cc8cbcdb3991e45f0944f0344619

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:49:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 230
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11819
x-xss-protection: 0
server: cafe
etag: 10563440404697844360
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 03 Sep 2022 21:49:27 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220817/r20110914/ Frame 80B9 30 KB
12 KB 20ms
20ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220817/r20110914/abg_lite.js

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c0d0b5ecf5aa2cd5475929aefcb44d67c5d5cc8cbcdb3991e45f0944f0344619

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:49:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 230
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11819
x-xss-protection: 0
server: cafe
etag: 10563440404697844360
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 03 Sep 2022 21:49:27 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220817/r20110914/elements/html/ Frame 80B9 8 KB
3 KB 20ms
20ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220817/r20110914/elements/html/omrhp.js

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c9499ea51a2956fd2c1600591ae117fe9ad81065d625b1b2c593c7720e5b228f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:49:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 246
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 18418590997839133011
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 03 Sep 2022 21:49:11 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 80B9 0
306 B 57ms
42ms Ping
image/gif 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsu7fifrTtVVrV45ZUM7rsoPndt1Vv7KLRmSO9Iq5nLCrqwrzZOA9pjWUEw6Ze1LKqVCigLNM6uR1iNZMTcUcccd1_oHK4D9dde1jXZoLAlHZW7R9CeOazzgzXTD-8NZeZ1CgkbLQCY6QXTv566nF2GNKQeI1lZozZSbjiBwhLSI37X56t1O7p565Xq4sHSwwwhSu88ACnszJNUF9fE5lzHOazqSJdIytyTaBk6gPvlkDklVAYU9hChpJPnc_S8RhahbLcq5xtTKLxlhAZ6h-rAyyvV_Cf1IY0azjiLwAQnVq0I1R_4Ity5iG-66WdKrPiRhOC9Z-IuTOdCJXVDq0kmHQT_eqUgTp3RWlVBdI8et_HgwfoOI7TeFSyvtOuBrURsUch_F8weVVOADF28XXjYb17FT6OQBso9b7hHpfI2Ef_NIoFP4PSlmbQA3lH-EBf6DZztv7p9SjG-Wl7q41-tczfMMoQNcjATRQBRLtFxSeYbLuSOwMRuU6eGpCiZ-1pMd3scwWPaDsD4RYj4-LAzBkbRaQ7QEiH2OU3vgJbFA7nf-c2ZRVFdXG1BxySLTvEA-cLvmCctNJbb3LFL4yZiNjq-GwslAyJb-KfYj1BT7S-EmHvZ3n2L-V3WHMRpDThUVzSg7z0de9MTOPkUZcPOGjJdTSCvds0q1ZzYPZ4Pcsmgn_tqaShzXOfOLJd9ckfqFfwCU4cUFyucNlEOxequjfUlLLZ2OhrWc1lOlpHL6vQV9TRTKTiHtsz0cRSlAZ-b8PKjXUo3z13MhLftpa3Uk1GjwneSTME0hBzqpB-PXciOkJNkxTzdHqZPdMyE1gBDXnYp3KOtGRxkTN5IBCXfW1IucOkQor5M_OvHdhjpkWlBschVztZMvkZqp2H3Fp-V9-ZTJZjj5r6dJnK6B3FOWJP_-pnG2YrAWwHwDf8ObGoQw2-6dnVxZ8yfNwCJxrtEWysEtImKxaxleJUM_mOqMuvqHpmW9Tt_loJgu08i1lHJ9Xpcr9FBoSgxi93j6omcb02U1c6dowXDJPRmIFIPM2kAEkUaOHtBAytEGy7S53tkQc2ewFuBobwPTJ4c9MVc0uMH9HMJlseqDdbAOle6UgiCnSNnxDtmGkwkSPosOoSM-61NE-8OKuErKAQO798WQpvNJY7w8GaEM3Q&sai=AMfl-YS4gDTRQF0-VvMjvY6whYnaP_kWxcjDOr3KjFQ6imxxMi3--0taQ5fUrSU6IpvWV19zRNSwGN8rZTsNUg7iy1b6QvQasjE-DkADgO9mhg7fHEtBKTTvx7BNrTqKIn0Fxt_e_1ztkc8AKLv6sjekZf5SZ-AQSKXI2iUJxdfvV0E9LVKZpbsqfISMtotbENmCXWYVXtM_aL-eOcFrqUvm1lpJkqw4ehUpPQ&sig=Cg0ArKJSzA1mGyPRYjhREAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20220817.36943&adurl=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CZecFYpM4jS0khq9RLfRnZTmufPVy-wWskRRUAkGY9vBkA4IUK3BxMxVfsCJm3SbJgV7B2bsvH5iB_VxPl-94oymouK69bU2EP3lGVcbkysuNlHIqPI_B9O240j8lqx_SWjxtKeUCj3pCGnid_v56v3dAlTQ&dbm_d=AKAmf-CcKmtaMoj6KeZob0p9-W4dAEQZ-awwWkyMI0WcJiItsh6Cuy_wjFvmmRILPO3anYnSW1vZ7kqKBSOLmdQvri573z-selwCqhdtt8B-VuwO0d4iTwf8-ed2s25moYiT8fBRHZYbtkr-_A-4ri7sV7sQcVP6hqKRRjvVt3-lm5psKm1mCEIyQuAroOusiZn7kzNNeKqoOqjFJsOq90daNxwvGzQVPt6uzYSvpye-VpQzZYNerDqXfRWIHPa5oSbZCEpQ-m2V357Zow6-WDkq1SqefU9OZm6LFYa6OQipEN5MYX722QuSWI0U8PDL9CKkgl43h1xhGs8w-FqiaCAfq4Kduaw00FtWomJu17_LEwtQvwRvd_IxZXHDcAMvQ75JDNh6itNQwiZg2_WZaFCVnMUTMbuMJchG8CofO9_DN-YH0N3Glk2s6usBv7PLdhP60ITB_-mnYBtAktgwDo6XEeNpdw9vbQCbN-U50CiUP1Mt-jULGU5sh64hQxZzJG0QzQuq3IPhJdo6112IWUtcHKprCC7mNaLkUHFAN1J5r5AexUTvzmoSRdwawpuQ0lh2LZp7W4AvTwCWnP2CvL_hjCU3Peswos-wK5-EFgzetpX6S7ncgNoB2X8y6l5b94QdZMMeACafa-H0zLlAUP0-EdVWAaHxyn0rJNxoLxLFZUMD9Vp7VknZrsPArcX3bu5hc8aWlFmKgwEbqKG7IN5IT-tq1FgL4_L2g49n72CKDXlrcnOQ6-JmKEQ9N3qDiSXyuWXeXkrmlr1Acrt03o5cX5uCmHDJw-z9Ekt2A7HXSTGjvnl9F9jAwZOUThSxGlKC5Bx8Ch6L6s2Lb59WHBRG5yhfrquUcnK-Uu7DX6o75d6y4u7IXcKwoC6MpH6M48hG7grRWGu9XpIyKJrn1bj3hfuI5QDNYY76ORaxzIjPKBjDeT006XKCUj3clBlFO37h4F19X3wz1cBrrUc4CiNFXiBt5GmvqdBoNdJblKA8Q-DboFM8ZLm9MderRUagJE4VF7iqz4ZG36vMdh1Ke5JW83cVgXCWP_fk6Wx5IIOOKiUlVRcQprQk0RYqOxinHxq5hj9H543DNN6H5D9UtqAyYRCAGWUMUoK53vpKQj0D0rNEIjP_Kcegm6nG_lp5SuW4rE_RCYDTdM0vYbINnaEo7lR4b0V0689CGJwXzwffymYjSfR4wqdfXByuZbm29nLIyXqfmjRzDwJIVpLwJ569UW33hHCq-6GNd2MdYqnSm_l9DFXMhFp0Y4oIW-SOoDMRIpM6hUZwmxsE5NuhTB0wQa9LlQx4GyguzsefS7r9mMjEiEmri3DxlGLoShUWSWDXMYWJXhOJGmePiFMUEOEZtkFlE1vIDqNgb_2K5rjt_gNtxTJI6qwldyIRyyKp4GHq5TMJo2IyN4UwVAOwkgUstP4DSHKy-j7dzLTH9XKn0VQ2JDLpVnem8cQMcSAnme-Cdhw4SypR4I9-G9nMoQgVqcIjw11_EApVP-QBBThrHVajputGQR42lJf6ANec6z3034XRyZypMGS5f66KjgHWo8BU7vx1HH5Aoq6j0xYeCORuMPa9VNx2Cf2mRW7ml1wQ_IjD1oZ3Bd-5SkcELc6NGQdMjoBlplXhtgJSHBdW7kFqjTuv3clhmRfkB_MjXf5cenV7gsaH71CPZ4TfIf4ZM-ZalOZ5ard1gRcujOWIB1rLXsI3YyckANvYrGeaalkZAnreegrPRlqkwFyee2cqaVfVkyNYh_NwM3WqyHFydWUX_o4IkZ2Or1nmBEyBAOwyhR4_itr96dIcJoBYnZwUO611QYjRbFEQCvr_ii_DIzl8pacXEL2UYTeCuEuWs-yyBCe3bego1DFkrjyPCiRjcRvvQn5fdT3qW3fcllHLhTa_z2l6C-R4YZz3YXhgNj3Y9-lAOYjGlr5hbAVfn-zN5P48dfPpnSvcohDuWt9AVKLEyEhwalaJDb4Yikv-fy5JbyenwZ5MUNhTs2a_vTzEAgZsZFWD6K95uY_GWOTKCb6ey2Om0IX6HXFXBkjg9ZEDNJoRH2VIXs8CQTBt1TyK3twvzC3gHSq8GI8ZQorn3lXZUV-mkhOEtUi_BZdilZ4_C6cSFcImuOXIxkhDGJZntZBj3NsaDGCsxJkGR7xn91WXF_8enrpvHnelEtZ5s4zLEhec65eVSTCB5Ohrp6EhSvqVd68_9gFEvj61QqOZpea4_wRPhS4hoh_1vKqGoqRAy25pLsF57gzJHQragjCuY1Wij-48D435iLndNWoKK1nayoITI8xgv2Ni0kD6oKgEaeNamEXqlO96JK3Y6XzYyB-hcdfIXXB7aa20wo_9zL_q8lPGF2WLNakUzUqfsn5_-kp75e_uDH7NasByCGg6czdCSYUtkoczeeA3AMXSF0pIW8hbcbZajgxSYvOjLLEMYJUHNlr0VCZKH-9ySnRmweuQzWz9uFRxpJv7Y9XFye07dlE7_VZnDTRN1jGzjKHKkQZin1Ixs0pYRPQ7MizdfvAnoQLwBEtud__-8z7Yqwe_AWeUyO6Rqp7RnnocGtw7DSZBrWnsZVHVFU8rY4Yg739gnpEOuaMQh4xOugQ6y4pH0txq9wW5-B0tSbRsVkU0NT-D1IcgGKH0rTnGetbGvBsNCMJyreT0mmQvc2ABfSdoex2Y2Q5mcsp7XlxoKE23loV-B7fMUbZki95r1_JQVtHUz09RUm87AUYTg4I82XasaHLWZ07Vp9rDEN31keaDF76ox0QEJw6lVRIB5BMh1j0fmGzsyalfAm32hH2HvPHB1g4KHCRIs17YqG4_ZTwMzr0yZAK2IYeDSP537XcG3g1ENCffL0myxt7FETGQ8OlrcyrzpV5EwoIkX_PSJstvZyLjPIR-R3mrM8hrXHIPqRQjPXlt2HM8ejeZsFa4I5Zb7nlhoYNjV4It2kKCUSbnkRzEte2m4i1BAPURlGzPws--Ur0lPDxyHFTv6Gmy3jpDP4qczli-8e2gql37xTfHcwU-DqCX1aLGbPnj9msRFChyZhIwGg&cid=CAASKORo4GVWH6y1eXUr1clCZBbbYC49JH4Y8pPsPOQqP6HNEYP8iDhMVaA&rfl=1%2Chttps%253A%252F%252Fwork.ink%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Sat, 20 Aug 2022 21:53:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 80B9 41 KB
15 KB 22ms
20ms Script
text/javascript 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Fri, 19 Aug 2022 08:01:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 136320
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 19 Aug 2023 08:01:17 GMT

GET
H2 200 7125352322725780622
s0.2mdn.net/simgad/ Frame 80B9 36 KB
36 KB 69ms
20ms Image
image/jpeg 2607:f8b0:4006:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/7125352322725780622

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2006 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

06389f6d7305bda763da4702d5b05eff4c70e3a5813596df3a95b2649a31a20c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 14 Aug 2022 21:12:42 GMT
x-content-type-options: nosniff
age: 520835
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36699
x-xss-protection: 0
last-modified: Tue, 24 Aug 2021 22:09:52 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 14 Aug 2023 21:12:42 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame A9EA 41 KB
15 KB 21ms
20ms Script
text/javascript 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Fri, 19 Aug 2022 08:01:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 136320
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 19 Aug 2023 08:01:17 GMT

GET
DATA 200
OK truncated
/ Frame A9EA 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b42d1e049054a72b63c3390f2829c323da13d4c1f79bb360592bd46b0ecfedc4

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 8072 22 KB
8 KB 21ms
20ms Document
text/html 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 63242
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 20 Aug 2022 04:19:16 GMT
expires: Sun, 20 Aug 2023 04:19:16 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 80B9 0
26 B 38ms
37ms Ping
image/gif 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 20 Aug 2022 21:53:18 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
DATA 200
OK truncated
/ Frame 80B9 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d4ca30a1450c61fd7e57d25c0832505a3a27691e2c29f12f798a2dea74be329a

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/13040788249418461653/ Frame 0A52 7 KB
2 KB 63ms
20ms Document
text/html 2607:f8b0:4006:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/13040788249418461653/index.html

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2006 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

74d4acda631cb01fed01fe7a549c427784c0573b4562535fd39e48990897bc60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 80687
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2524
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 19 Aug 2022 23:28:31 GMT
expires: Sat, 19 Aug 2023 23:28:31 GMT
last-modified: Wed, 06 Jul 2022 09:00:27 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame A9EA 0
27 B 45ms
45ms Ping
image/gif 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvlIw7a_cmhAyRJlFwqg1lbRQf5TECn2wpG8dCkhTgLdMrMRk--cKoXYXrh9j84Q2rmKfzWT2rognbKHgyaiU6OB_n6xAALFdTzpS9zPJsdxRTSP-poW6RnTuzfGRw8JN9NCmBAH7TnlgyPV71eUIO9YyCACU-YtlxpMVUxh3opKO2Tn9gW7dBEVxRTQ172ZFu_wK8md_D4nDaOXlLWbC_QPz41vVh_CXxIJUp6PzWYyLYDwHsTv6qZIgTq_4uG3qt6B5oOx__DbbQBTkD4A6x4VdGZrGk9MV95cxGN7A0-wYbZpxkb5zVw9zAJgSm5qo7InkMD7vRKdSId0Lh7rt08FuE-x94O2i24M1rHUBveJ51ipxZQE6qc91vIwi6puSNnUDpAVmSH1eWAd9sduUqqPGudsA5IQxQKsLn8o_syj_yhhD44IY7YOmhpn3ua4swwmuu9Y9vkBAR1cor9vWOhVuqM2j1ZoJ7eFgqScGgAytor6EZc5pwQeNk2vVOcl-UBGEWmZ-n2YqCOM4F-DcZhqUV9rREAD_N1P4kvUNvmGA2rgujeAHMvmWx2fKF7r-DTAE3dCf4PfcAzVzZq23omGbah32ExSBhGoePGHAJOD5MGoBZv5hounxEkkd_mTKl_zUxRm5ZAxJ3UR9mubi-VU3ucfSC2-PZQkmwBGMMQsHAN5ikE1NGGhpGa3RyWNW17ztUq4UD2crmPFk9O0jjlrzWveFamB_mp-JNfOJy7SXzOmyX_z6JFAzqGnB5jvx5KHXqqv4Fl6nQV537qKr9lDgsoSMb4P7NukRsAwbI1h-MAXA5AQy_QffJhnS_3J-ungSapAmy2SeNR71GXaz-9g06TCqMXQk0zNZi9tu3Aj_hJchC-DeYddWvBJDgdr1BuXtwQqiPiqhsCuLBZ1sAymVo4aaqngZUZbClrDlkt75i9AmEkBTuRsJvCJnObYcA5y7i2q5Q-p_qRI9qf9dUDoHoewbHjy5nHl3MyzTxyGoI2yoqA0gi8Q8ehQdIr0R0z2WFYNQHaXWaRiAboOG-JguCyH1WuuhC6Q-Ez47yjrkb-4zWOhLmY_1RuLdzEE0jwuxXOj9ManNLoH88e8_lPpeuwTsr0PWeW9e_nPMjygBL7jxypsZssgFe85-FKORqkKzwebgpHmhjbqM3ozJ4JlGaVpotgxdpjoxEn&sai=AMfl-YSSPCIUIwvcGwsxCv6mCY7ooWhq8pvpLSue5IU_yBBrb43Yn4CkggXA--OQnUZRx1Runisqmr4klLbajsmNbSHywuPFT_d7J0N8Ml-9YmgJL8NLtYSibITi1SCR-uepJzpOgYzKt-UX5l-l3COr4GYbeHRcP3BrhgW6HN-RCVd9IXAWkq1x3hXUhEkUs9s9VCh84jL2t-9W4cJAl7M0PTv6vyMMuS-PyQ&sig=Cg0ArKJSzGrWWrpSqJktEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=222&cbvp=1&cstd=219&cisv=r20220817.19026&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Sat, 20 Aug 2022 21:53:18 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame FB0C 22 KB
8 KB 21ms
20ms Document
text/html 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 63242
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 20 Aug 2022 04:19:16 GMT
expires: Sun, 20 Aug 2023 04:19:16 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 hd9qiIGAqjescZkeItwy2wgAtCffeqilIyGkY3Q_MTc.js Show response
pagead2.googlesyndication.com/bg/ Frame 8072 36 KB
14 KB 20ms
19ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/hd9qiIGAqjescZkeItwy2wgAtCffeqilIyGkY3Q_MTc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

85df6a888180aa37ac71991e22dc32db0800b427df7aa8a52321a463743f3137

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 16 Aug 2022 14:56:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 370605
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14041
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 08:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 16 Aug 2023 14:56:33 GMT

GET
H3 200 hd9qiIGAqjescZkeItwy2wgAtCffeqilIyGkY3Q_MTc.js Show response
pagead2.googlesyndication.com/bg/ Frame FB0C 36 KB
14 KB 20ms
20ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/hd9qiIGAqjescZkeItwy2wgAtCffeqilIyGkY3Q_MTc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

85df6a888180aa37ac71991e22dc32db0800b427df7aa8a52321a463743f3137

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 16 Aug 2022 14:56:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 370605
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14041
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 08:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 16 Aug 2023 14:56:33 GMT

GET
H3 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 0A52 236 KB
63 KB 35ms
34ms Script
text/javascript 2607:f8b0:4006:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13040788249418461653/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2006 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13040788249418461653/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 20 Aug 2022 21:53:18 GMT

GET
H3 200 gsap_3.9.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 0A52 63 KB
25 KB 55ms
54ms Script
text/javascript 2607:f8b0:4006:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.9.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13040788249418461653/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2006 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6dbe9c2e13cf06c6633ea3fcf6d7bd30452561202a205c75a035cd1d8b93368f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13040788249418461653/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25329
x-xss-protection: 0
last-modified: Wed, 29 Dec 2021 19:08:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 20 Aug 2022 21:53:18 GMT

GET
H3 200 customease_3.9.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 0A52 7 KB
4 KB 65ms
65ms Script
text/javascript 2607:f8b0:4006:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/customease_3.9.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13040788249418461653/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2006 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03f848430009dfc2116b88af857bb44ef073aca257eb71ff8575e8f0f1fc0f3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13040788249418461653/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3697
x-xss-protection: 0
last-modified: Wed, 29 Dec 2021 19:08:48 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 20 Aug 2022 21:53:18 GMT

GET
H3 200 index.js Show response
s0.2mdn.net/sadbundle/13040788249418461653/ Frame 0A52 21 KB
4 KB 22ms
21ms Script
application/x-javascript 2607:f8b0:4006:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/13040788249418461653/index.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13040788249418461653/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2006 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e4465e70f8d3f63c2ae8f3607a4accb447e06556d24cea848321e14356260aae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13040788249418461653/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Fri, 19 Aug 2022 23:38:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80087
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3701
x-xss-protection: 0
last-modified: Wed, 06 Jul 2022 09:00:27 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 19 Aug 2023 23:38:31 GMT

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 81ms
40ms Script
application/javascript 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=work.ink

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 20 Aug 2022 21:53:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 51 KB
18 KB 890ms
890ms XHR
text/plain 142.250.65.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1074343624175283&correlator=4340356750693425&eid=31068458%2C31068928%2C31068985%2C31069041&output=ldjh&gdfp_req=1&vrg=2022081501&ptt=17&impl=fifs&gdpr=0&us_privacy=1---&iu_parts=124067137%3A21827075952%2Cwork300x250FX_1%2Cwork300x250FX_2%2Cwork300x250FX_3&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3&prev_iu_szs=300x250%2C300x250%2C300x250&ifi=4&adks=3262639012%2C2483253877%2C3400557721&sfv=1-0-38&ris=1~1~1&rcs=1%2C1%2C1&fsapi=false&eri=1&cust_params=adx_account%3Dnewor_media_adx%26ob_medianet%3D1%26universal_passback%3Dyes&sc=1&cookie=ID%3Ddc1e2436388484c3-22c27177a67c007c%3AT%3D1661032396%3AS%3DALNI_MadstgcOKiEHWxMLydFyFZ3aL8U1w&gpic=UID%3D000008c6296cdd71%3AT%3D1661032396%3ART%3D1661032396%3AS%3DALNI_MYbA54mVatpx7BRzG4AfK11gj0WOQ&abxe=1&dt=1661032398139&lmt=1660962928&dlt=1661032394802&idt=708&adxs=638%2C1105%2C170&adys=470%2C411%2C120&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0&ucis=1%7C2%7C3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwork.ink%2Fen%2Fl%2F1VA%2FToxicModzZ&frm=20&vis=1&psz=525x377%7C360x300%7C360x300&msz=475x250%7C310x250%7C310x250&fws=4%2C4%2C4&ohw=1600%2C1600%2C1600&ga_vid=1244403988.1661032397&ga_sid=1661032397&ga_hid=633984928&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f0ba71a7685bdbc90982a35ebe5cb58174ae355ca5c2a253b31f9bd8f5b8b3ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:19 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18748
x-xss-protection: 0
google-lineitem-id: -1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://work.ink
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 copy1.png
s0.2mdn.net/sadbundle/13040788249418461653/images/ Frame 0A52 3 KB
3 KB 22ms
21ms Image
image/png 2607:f8b0:4006:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13040788249418461653/images/copy1.png?1654215156532

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2006 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c9a632ede15c51b593dab2a17e8d3dff1b12f6cfd07b2bbe524cee07424c5f24

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13040788249418461653/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Fri, 19 Aug 2022 11:54:15 GMT
x-content-type-options: nosniff
age: 122343
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2620
x-xss-protection: 0
last-modified: Wed, 06 Jul 2022 09:00:27 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 19 Aug 2023 11:54:15 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame A9EA 0
26 B 37ms
36ms Ping
image/gif 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvlIw7a_cmhAyRJlFwqg1lbRQf5TECn2wpG8dCkhTgLdMrMRk--cKoXYXrh9j84Q2rmKfzWT2rognbKHgyaiU6OB_n6xAALFdTzpS9zPJsdxRTSP-poW6RnTuzfGRw8JN9NCmBAH7TnlgyPV71eUIO9YyCACU-YtlxpMVUxh3opKO2Tn9gW7dBEVxRTQ172ZFu_wK8md_D4nDaOXlLWbC_QPz41vVh_CXxIJUp6PzWYyLYDwHsTv6qZIgTq_4uG3qt6B5oOx__DbbQBTkD4A6x4VdGZrGk9MV95cxGN7A0-wYbZpxkb5zVw9zAJgSm5qo7InkMD7vRKdSId0Lh7rt08FuE-x94O2i24M1rHUBveJ51ipxZQE6qc91vIwi6puSNnUDpAVmSH1eWAd9sduUqqPGudsA5IQxQKsLn8o_syj_yhhD44IY7YOmhpn3ua4swwmuu9Y9vkBAR1cor9vWOhVuqM2j1ZoJ7eFgqScGgAytor6EZc5pwQeNk2vVOcl-UBGEWmZ-n2YqCOM4F-DcZhqUV9rREAD_N1P4kvUNvmGA2rgujeAHMvmWx2fKF7r-DTAE3dCf4PfcAzVzZq23omGbah32ExSBhGoePGHAJOD5MGoBZv5hounxEkkd_mTKl_zUxRm5ZAxJ3UR9mubi-VU3ucfSC2-PZQkmwBGMMQsHAN5ikE1NGGhpGa3RyWNW17ztUq4UD2crmPFk9O0jjlrzWveFamB_mp-JNfOJy7SXzOmyX_z6JFAzqGnB5jvx5KHXqqv4Fl6nQV537qKr9lDgsoSMb4P7NukRsAwbI1h-MAXA5AQy_QffJhnS_3J-ungSapAmy2SeNR71GXaz-9g06TCqMXQk0zNZi9tu3Aj_hJchC-DeYddWvBJDgdr1BuXtwQqiPiqhsCuLBZ1sAymVo4aaqngZUZbClrDlkt75i9AmEkBTuRsJvCJnObYcA5y7i2q5Q-p_qRI9qf9dUDoHoewbHjy5nHl3MyzTxyGoI2yoqA0gi8Q8ehQdIr0R0z2WFYNQHaXWaRiAboOG-JguCyH1WuuhC6Q-Ez47yjrkb-4zWOhLmY_1RuLdzEE0jwuxXOj9ManNLoH88e8_lPpeuwTsr0PWeW9e_nPMjygBL7jxypsZssgFe85-FKORqkKzwebgpHmhjbqM3ozJ4JlGaVpotgxdpjoxEn&sai=AMfl-YSSPCIUIwvcGwsxCv6mCY7ooWhq8pvpLSue5IU_yBBrb43Yn4CkggXA--OQnUZRx1Runisqmr4klLbajsmNbSHywuPFT_d7J0N8Ml-9YmgJL8NLtYSibITi1SCR-uepJzpOgYzKt-UX5l-l3COr4GYbeHRcP3BrhgW6HN-RCVd9IXAWkq1x3hXUhEkUs9s9VCh84jL2t-9W4cJAl7M0PTv6vyMMuS-PyQ&sig=Cg0ArKJSzGrWWrpSqJktEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=398&vt=11&dtpt=176&dett=3&cstd=219&cisv=r20220817.19026&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 20 Aug 2022 21:53:18 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 copy2.png
s0.2mdn.net/sadbundle/13040788249418461653/images/ Frame 0A52 2 KB
2 KB 21ms
21ms Image
image/png 2607:f8b0:4006:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13040788249418461653/images/copy2.png?1654215156532

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2006 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ac9fecd2e24d3cabee14814e711e2b4e1d885cb7e04c9bc8cf58a3706386e52c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13040788249418461653/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Fri, 19 Aug 2022 10:28:08 GMT
x-content-type-options: nosniff
age: 127510
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2042
x-xss-protection: 0
last-modified: Wed, 06 Jul 2022 09:00:27 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 19 Aug 2023 10:28:08 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8072 0
20 B 49ms
48ms Image
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BKsyhzVcBY-P2KsySoPwPyei64A4AAAAAOAHgBAI&bg=!BAelB0PNAAYUOm8VNDo7ACkAdvg8WoE3V7uvzRIFNS70cJXhZ7NKEPAOH5JINqmgxDGzjfjwIMDLXAIAAADLUgAAAANoAQeZAyOCMULMNljoWu6yBXAiM8QjbXkCtLMHdJZ_dGKYYB0EPDfXuEU2QUorTentBkpzdtSGOk_58lAUhnW1qu7z645MaJSWKNY5YL4AQ7QZKbltWxerWhHQgWg16DzdGhs1tY6DIcgIVjS_InXRBqr3ceOqMDbw-hZk9RR0FalZw9tOu0Vx0Ti447wTwGdHyDqk3ikkW8l-tEEMKonlXw7AElRrye8O2OFvW9cMNpVNeHA0BMKbQWKEwbtkHOEWvDdCAckjeYR6OsbcJLMJfRGuTpsR9FcTL_0A4nnons5t_pr013RlE5oDlWxWJPLG_qBYN-rkNEo0M6xkIDtFLs6DX26EO5x5xeef18oGMceJEbYVswOJypLUrLA8ZBRRMRO1gIpCSbwQB0dzEjIW89W_VGHy8TGCDCh305LB4jdxSqRBRctdRdBUMhusmfet18U8fF24_rrYNLXVFRA5Srf3NlfVFIoVsLkZq6xX3Hf5dVoIWlkx8FPPZx130LWLMIF97JQueI8gsl-2RgzCaJ0ofMcV8jqECa9EVpklgMQFjSxi-bH8jHEk0j-XvstrVyJvGvZb34benK4zUSwgfkUfCCx2DNQdg7mwOF84fS_yO8vg-ktJ-VNAyLUBX97ffKZGfq_AvZeK7vMPOOc-bbp-y__LnbqoBCzOPq4kuNwT4ZPBxY31RPAeSX18ZqPTe0HKIrIn0VPzx6jD2X0LmxTzVfrXySWH-QywWTuCFPoh1zGNrQEq5YI0d-P-BCWusaFlpLmCxzQkw2Qs4-d3cbYR9pp0MgTlh1U3uLD2_ZxDtqagmWOS-JhVvEr0xoxhq9scBrhh4CNX4hwYVqsTDItovhxOLhX3xHEju8dle8jctEy_cb49JOoUgaJfBP5ErYG4vA2IQJJNwTtWKZA5lnyPeCD0_uYcRG9qp5XDJsNUL83VI_fx_nOFlgKcVW1mv5ZNwadfI5V2X8x6yeNInlflUCRSSXlZlHGfZcHpLX9BsydkPXpzFnJq8mFL6idpSw4byevp0akrwIG24sR8I7TdhthakAaHmR3flf4ZY5LQbZ8E4FKzww

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:18 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 copy3.png
s0.2mdn.net/sadbundle/13040788249418461653/images/ Frame 0A52 2 KB
2 KB 21ms
20ms Image
image/png 2607:f8b0:4006:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13040788249418461653/images/copy3.png?1654215156532

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2006 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

202740aefcf92c61596785a9a87c7fe94ed2c7c06d075571312d426831f60284

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13040788249418461653/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 14 Aug 2022 06:49:52 GMT
x-content-type-options: nosniff
age: 572606
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1914
x-xss-protection: 0
last-modified: Wed, 06 Jul 2022 09:00:27 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 14 Aug 2023 06:49:52 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FB0C 0
20 B 50ms
49ms Image
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bk_PMzVcBY_TjKrehoPwPhMG44AUAAAAAOAHgBAI&bg=!tbaltvLNAAYUOm8VNDo7ACkAdvg8WpII6T8KPEOeLv2284Vw1-Wjug52iyYDvosyeZcpEnvJWiWJCAIAAADEUgAAAAJoAQcKAB1xa9hPQegEC-MMMeMWh4GbVmH8wPT5pJSB1cgnaZkDFmS1w-Zt6ztx8XyyeMG7tvpAIKAHazFtoFaqgF7k0sh_TfsjhOOE2paW20IEjUeEgVjLoJgTVepZDyIJEWpHZQGuTpX0NUWhe6qonfOanylIvz62027D7qmOlKyioML9wte0a_BHeHhMGtikYzCYRYvatNjjKWbGv3Z-UWmy6E6EAEx_rNDsa6spNJJIa9UK8_FGrCFD1pqrjPSS3mK3D8s-vzzDWazKYWbBJmoUKSCXeGrFacKJPZTHUUyzZSyhcQk3oorRclz6H-aDrn9g6v0SM0cLlK3udzQ4RhqFpmRPVItDr8kQzDc3ScKMrEjGA5TG3nCgR8FBk-dM8iOLgIfyfbasFACzeUbGe7kbNZliB3S_NGX5E5sq7vbgDtYwwv-97morTRMfsd7CwRspvkl3QyVRA-utsVrsLX01fQTBxjOqRzLBlzXCdq5NVt44Gb4EgfxITPkHJ62TRn4HeqRWngaIrQvYJ_qRZV1xIf9-29yHHnO3jUFC_Jjnakv3cWoD1P7C3_LYz1EO5sPtie4qNgxJeOkcZzpVCCWGjTXQmavhc6pmMs83zNyO3E2AWgHJj-vU1Qs1KkyOCpBmRuOm8YLtXIisuVvr0Nr6hECdqjs0Cpe6nV_aLHcXIrjtpXq93jv2OIDJdZJ4wSrpT6eIp6TocgqLfv34Brz6nuEGgE-8KMswsAeDBWpsoUdRMtfbAQhgS-4kRLwnvcV_XPlJ7Tow3OeB78UTUs_5qRxisZ7HA4kGUalyL6mpXSEkmgibFpD_UWijs2luxo-sZzverZEYSQe_ZP_-njy5DenSYZOw7IZ4tY1YGdhP0eDfUZVwdWsPoersCXUImy2qyWNeelby-e4GzxDLg7hroy7_Sm6YA1AqyuxEUpy1xI8087kEgdWmOL1W-JKVmAHNXgqTvty6m88af6WFcnm_Q6iUmQsKY4R4Gtssc259ng3WwoMmAhJGgePFfGGKuVpcApxMiO4CXCPJNecCeJ-AmMzuQUbrrAIy_MPcY1njwzKuj1VYcS2YD_hXGgg8yAyuLAVnt0crA6w

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:18 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 copy4.png
s0.2mdn.net/sadbundle/13040788249418461653/images/ Frame 0A52 4 KB
4 KB 21ms
21ms Image
image/png 2607:f8b0:4006:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13040788249418461653/images/copy4.png?1654215156532

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2006 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c41e60df4788822533de221b631783bfd56704a84ccbe7a874a82ca37c05d9ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13040788249418461653/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 14 Aug 2022 06:32:28 GMT
x-content-type-options: nosniff
age: 573650
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4347
x-xss-protection: 0
last-modified: Wed, 06 Jul 2022 09:00:27 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 14 Aug 2023 06:32:28 GMT

GET
H3 200 cta.png
s0.2mdn.net/sadbundle/13040788249418461653/images/ Frame 0A52 2 KB
2 KB 21ms
20ms Image
image/png 2607:f8b0:4006:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13040788249418461653/images/cta.png?1654215156532

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2006 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

196f78caee5b0fe8239d24fd47638404382222c82c3a292ecbe26fe993ecacfd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13040788249418461653/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 05:33:45 GMT
x-content-type-options: nosniff
age: 231573
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1856
x-xss-protection: 0
last-modified: Wed, 06 Jul 2022 09:00:27 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 18 Aug 2023 05:33:45 GMT

GET
H3 200 img1.jpg
s0.2mdn.net/sadbundle/13040788249418461653/images/ Frame 0A52 39 KB
40 KB 22ms
22ms Image
image/jpeg 2607:f8b0:4006:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13040788249418461653/images/img1.jpg?1654215156532

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2006 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad862f80c198a117fa2df6c4b2c5a19069d219c4e73792ffa53e6ec58f41177a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13040788249418461653/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 17 Aug 2022 18:43:30 GMT
x-content-type-options: nosniff
age: 270588
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40436
x-xss-protection: 0
last-modified: Wed, 06 Jul 2022 09:00:27 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Aug 2023 18:43:30 GMT

GET
H3 200 img2.jpg
s0.2mdn.net/sadbundle/13040788249418461653/images/ Frame 0A52 25 KB
25 KB 21ms
21ms Image
image/jpeg 2607:f8b0:4006:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13040788249418461653/images/img2.jpg?1654215156532

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2006 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5adb336b992af403429679715fc8b16f736b80a341239f83e6b9e78b0ad2f484

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13040788249418461653/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 14 Aug 2022 21:08:18 GMT
x-content-type-options: nosniff
age: 521100
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25161
x-xss-protection: 0
last-modified: Wed, 06 Jul 2022 09:00:27 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 14 Aug 2023 21:08:18 GMT

GET
H3 200 img3.jpg
s0.2mdn.net/sadbundle/13040788249418461653/images/ Frame 0A52 14 KB
14 KB 21ms
21ms Image
image/jpeg 2607:f8b0:4006:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13040788249418461653/images/img3.jpg?1654215156532

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2006 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d676799b984be90d0f1ad53b63ac332d8c28d147407747ab4e5316bceed2abf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13040788249418461653/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Fri, 19 Aug 2022 10:28:08 GMT
x-content-type-options: nosniff
age: 127510
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14530
x-xss-protection: 0
last-modified: Wed, 06 Jul 2022 09:00:27 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 19 Aug 2023 10:28:08 GMT

GET
H3 200 img4.jpg
s0.2mdn.net/sadbundle/13040788249418461653/images/ Frame 0A52 23 KB
23 KB 22ms
21ms Image
image/jpeg 2607:f8b0:4006:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13040788249418461653/images/img4.jpg?1654215156532

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2006 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dc8b842a7be4bb49d88c83fec1963ac776b221709dc682b7faa2712eb833eba3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13040788249418461653/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 15:10:17 GMT
x-content-type-options: nosniff
age: 196981
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23238
x-xss-protection: 0
last-modified: Wed, 06 Jul 2022 09:00:27 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 18 Aug 2023 15:10:17 GMT

GET
H3 200 legal.png
s0.2mdn.net/sadbundle/13040788249418461653/images/ Frame 0A52 1 KB
1 KB 23ms
23ms Image
image/png 2607:f8b0:4006:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13040788249418461653/images/legal.png?1654215156532

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2006 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9fd5b36e3f556dea6e42ccca9d1dd687200abe199ea779a10ac717a989731a99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13040788249418461653/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 05:40:59 GMT
x-content-type-options: nosniff
age: 231139
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1434
x-xss-protection: 0
last-modified: Wed, 06 Jul 2022 09:00:27 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 18 Aug 2023 05:40:59 GMT

GET
H3 200 logo_expedia.png
s0.2mdn.net/sadbundle/13040788249418461653/images/ Frame 0A52 3 KB
3 KB 21ms
20ms Image
image/png 2607:f8b0:4006:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13040788249418461653/images/logo_expedia.png?1654215156532

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2006 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

23fd49089f465824c85ade1b6a475ca812ac287870f5c40a21d11917c65baa27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13040788249418461653/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 17 Aug 2022 18:46:28 GMT
x-content-type-options: nosniff
age: 270410
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2717
x-xss-protection: 0
last-modified: Wed, 06 Jul 2022 09:00:27 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Aug 2023 18:46:28 GMT

GET
H3 200 logo_lockup.png
s0.2mdn.net/sadbundle/13040788249418461653/images/ Frame 0A52 6 KB
6 KB 21ms
21ms Image
image/png 2607:f8b0:4006:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13040788249418461653/images/logo_lockup.png?1654215156532

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2006 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8533274a483d35a94338720a07000268bcd8119dad5db7c739b823a557c50d97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13040788249418461653/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Fri, 19 Aug 2022 10:28:09 GMT
x-content-type-options: nosniff
age: 127509
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6409
x-xss-protection: 0
last-modified: Wed, 06 Jul 2022 09:00:27 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 19 Aug 2023 10:28:09 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 123B 42 B
64 B 41ms
40ms Image
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssodBqWztmj_WKgd0cGw5opDtktOguS8zfrjdkw582YsjTakGWZP89JKGdl1o0buRZb07nIKgjf8VK69AgZVx4raI1Su8yO4vbfWYgBJ03usUA_fWQhjuMIyD5aQUYG6xjHLUIBGxJmE5c&sai=AMfl-YQLtJjO8jhxlhKEdR6ITI1vkJVAKCKWLvgYPScnCMntBwOsoHxmMsvp3s-hAAvH_9T2m5Frt4aRUtgRw99rP-KLmrDwDvYDwO3uhiQRk-dP4yVO-Yh_allA61NCQkBm&sig=Cg0ArKJSzJmLOqcoVmx4EAE&id=ampim&o=638,470&d=300,250&ss=1600,1200&bs=1600,1200&mcvt=1001&mtos=0,0,1001,1001,1001&tos=0,0,1001,0,0&tfs=430&tls=1431&g=100&h=100&tt=1431&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=3262639012

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:18 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET activeview
pagead2.googlesyndication.com/pcs/ Frame A9EA 0
0

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 80B9 0
0

GET activeview
pagead2.googlesyndication.com/pcs/ Frame A9EA 0
0

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 80B9 0
0

GET
H3 200 container.html Show response
968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 003D 6 KB
3 KB 22ms
21ms Document
text/html 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202208101343/wrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://work.ink/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 20 Aug 2022 21:53:17 GMT
expires: Sun, 20 Aug 2023 21:53:17 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 8A81 6 KB
3 KB 21ms
20ms Document
text/html 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202208101343/wrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://work.ink/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 20 Aug 2022 21:53:17 GMT
expires: Sun, 20 Aug 2023 21:53:17 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 536D 6 KB
3 KB 21ms
20ms Document
text/html 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202208101343/wrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://work.ink/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 20 Aug 2022 21:53:17 GMT
expires: Sun, 20 Aug 2023 21:53:17 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame DAEC 668 B
325 B 38ms
36ms Document
text/html 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPHpMxCpgz4Y5o_z0AEwAQ&v=APEucNVlnuzWgso1HOoW1RhHmDOs0BmyqvoDtiP0Ho7Yjayo3i5o4WoqFq3-_cbNMFydTNUeJ9Scp31DRvtYpUt3DMOeV3Iv-DZzMTQiJPTEpvYA4oExk7E

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8015a89c7e50b71a6597cfc7bc2be462212ae1f57c37e40878a79e7550768ccd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 304
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 20 Aug 2022 21:53:19 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 003D 65 KB
32 KB 68ms
67ms Script
text/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B2LMXMYjDv8FdhwWUKpv5eUYbUXptxsP01lMHZ80XGv6cIdujDMzlXBoalB41EeMV6nR3aL3KfyvyU_Qk6_PV5G9y6Sw&cry=1&dbm_d=AKAmf-B7T7BK5hFcRZmqJ8psOvR9r7KNAURXYTKkIhz9lDGUcIq0YYlMeh_nGCnbbaEBSFYi8ooMEKW5abTGMixgijosGKUNpe9e7AQrtPgypmtnkITE8niqkW0TbiIxlNWAFY9Fdsiiz4s-EwLRRpjhc_XfYXDRHfyKQFA2xUhiMufBzvqNtUiya5Cwf9wTNOk2PUo7VijCK6f_9dSBgmH0dtMr2eFg24TW7Ykbwi2Hpom2UsYNiLg4xLF_FouAiLDEkjF9GBefIZBgPbY73Ajm1mBJNwQP-7jPU4Q0HoAoZf3rwVAaWmD1NZS5RWbD9QavNEl9_h-ymKvt1Z2j5m86y4aTkcSZ4nAjKFLDvrO9mF3MmYsOFA35giYYGhKaGlwM2UAGfHIXKJB8Zt0qMu_kmdnS11pWkNsZiDtX-QuxhVCYLJoFzp2jM7lIk9BWusYGzDvjw7mX95nLThsq02Z2aD7pHL7sMC9JLvrI09eSWCYuNFBcL7ah8wAdCBqYQTZ08S6OODL7rYovfxLmItgt2nwVa5GZsAhEF7Gh2A1Ht3O9KdblsCgeVXIASNkJtsfdEvP7VZnkItDrLDuz6iZqNVGc_NWVdz_IFg_bjBp8xj-X1XEpaXptQE294hS_YI2rolJa5YuQ0fmJIbgVq2OdyDhn3KB1pjfj_BMVbt5TcZrgBXHGK9JShsFzOgpbt-xdATqMSD43JDsMn-1_sIV0MMqsMVrS5nltFhh5VR0CwlN7qrzaF8N60XYQUvaArM5c94PF1FZv7yLskS11qWO3I_checD1IhHlL1WJTAuP7gczUeMAduUNy6bZ5izsWHDfOAdOKGpSU0QK7bqXNeu_r9TZe2Vs9nMqhfk63nvmX4v8rG-OpecN4ORCE_Zb2gkyenGWCfe8vjY_oKx7FEs9Hp1JLzd_XrRrGuNusNNRlk6WHfVzpkzc0EZVJZSIeVeKtg84yIEOsDH2S5B7vPKZrH64VWosvo3LThMF5WyvPHvNdb0C-UbrBHY-Y2AOhR0gyqRbB_E1laufgnSMHtFYqidRlxF9buvInZsA2buN41UlPWgOllZ82voxhKS1WHnDOepG8Kpx-EFNxKR4fONr12DMM2SrmzM7ZHwDpKNHfuEOhSbtjGPXTueCbum9P4AgKbQc-HKWvq_gKFjMenqAm8efqimshEfQ8xu1IvANxzGwVmwCS8y2O1fubJsFyRoMyM4Kg5SeEPhlP8oqBwCv4CNyACHuNds5pInx0vg34HnD2i9Elljr8BzrQO1Dm1tWP0hyWJH0cTLOXfEALf0CmygSiykqOvR02OFVnINIt6WxdT0wlEWWs-GVREr9GaZp8LgEZtme4f0UdkZLNH2_XY1_8OysRE7P0f3u5PRM84XK_wmCQbozMtRa_8tKv0S741OpqIBCyIS9PqV-jK4a6x6w7X7S-5GAERjkA_1_JFerIQIM-vCjBvsA-z-gbB-6cnm9EjSBGISDX2S2KgypUQZB4VLEI4J7CJ6NNWknjkvKYjeCqWiIDW23MN9Maxh6C_YxMsye9X4F_IGmSYRlKbbhxHR_P9lG2UP8k2z97UHNtc71loVWDYq3XkU7UrvgwiGBqWqYSiG5BYJcUG-LjeMuQTA5k1z6oxoN-eT_14Yff0RyKXzUsji36lfb1sIzksDGDBB7mqtLJW0k-QG9DpUSdFyPGzz1u47kf01B0tTXcKP69bZoqm1LNH7Y6QpZJk7skiBL1f5vgmumlFmOjgNc9ALSom3d0cEeZbx9GACbCoYyw3CBZ8e9DEdhoTrKu5Xv3oiDwITNJQ5OdcwQph5OTe1ZLSRDll1-tPgOWASE9ZE-m1y4h21FFDFnKI4FlPEpX-qIcBBYWyNOGvVWprGjzUGVnE0bMLTYlOUyFksmmO5jQCch9aEn5Nfvgjm5owS8cPPswGD4I9uvvsafMlmFgB1a4vNaYJR7AIXvVQQBR7t-1fexk7UfWCy44ZhdK74FAe-bQTWoTUzuWjntpeo7qWGjqt_pEqGxpX9S_t7ufkp_Fh3m6sYDrsOJNx5CqIu93D8TZ64h8Kq3GsG8hB9t1RWMoroFovjSAjkaVsdQPqOa_IEN7T6uqiDh9s1uFCK6ik37Di7tAPSv-80_zAVqpP4r7dw6-g1_1L91aPvYcbBwxt8x2Kn11sJNXtLqZySl5gaIpK15JirFA7vP5XRh4YpVH7XS3KSh0mcnx6FEcl9IWmaPY2zY-IEXJZ0gqN3OMqZ6Juupg2RWSVgV_RbC23I70FmlZDst62lW8WAzK-rhMBIFhfRP4RRx6XTnEZwyb4lR6Pqh1LeO-tcUHvzUSpfZSgZJpe5WmSozM0yuDlw_f2NfFQBmJrD5mIyfnI6Oi6Cwn_xoiiN3ybuaP4R-pHQZ5YZkNV9uSHs1IMfxUHLkq1Vl8X5RMkZggeFlaQuAPc8hlm1RvoTb8QMn2DMYK1kOkh-KEaq7SgUTW30PXuJj1QLeenxPRkDMrxoDgAr-VlMz2K5j6X56OLOH1sS07ZtBHNfHukHFXRQPuZXGrBD9RrcXPVrj0aFfxyxD5_Odg8B5Gmt5yq_3dI15_xFCMTTcLgdlh7sDCrCMYMfz7hIlAE7g4hmprXpZpr_c1JXEzx60s-N4I2C_eunuTn_ZIe7MDLfvxzIjwU25va-Ok8RyCTSkZLpyys-OkB-VZfz4D0FGaliqGJsCeML6xd4xrV2dbccDhrPsT0pj28GOIB2kprDE-a-uVJcwnzVLPZOvFr2wUZ0EPkA5VrSF4gWpaT18-10RodlgF6WY3bt8SiVHOOfo4KYMBVOuEuHsM_9nZRtNw-sAgIcFBRejqF4ER-VoPRdBEkqsxGgVKFm7oZ7hqqnPva-yS0mMiCEfSCOlcAe1e3D9Q1lUEwmnfh1PRE-noX6UUjyOgVsmdy4nGHhG_F4LJWDrEFN4DIpFCTIqCmAOnE1_n3fA2F5lg9m-4A-NYRjjNnNq4ZEZRg7C-6Z3-4DPdYi4aySQgpIJ5endVgWLYT2uqXYQeZSM7xz7mhMQv6LKtEVO-mHZrCZVJXTbt93Ue2mo73NflDRCO3s3--76JTeVfYIa16lBfR1E9jPcCVB0MUBifubGdPDd0WsCWAYFIXzI_ymY3NYxFRq4_ljg2QLAzhLCS6ICuapTWQ2eEuZDayjghZFiqpal238BlLaGPm3T9Qgq4vVoQYJwQ-_YMEzT2sCirxQ2zQJ-k7N-Ag&cid=CAASJeRoqhxxva6vRlUoPs9QxKYUdzxZmVbTLppimrFxA1K6bysoqQg&rfl=1%2Chttps%253A%252F%252Fwork.ink%252F%240

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8b2e573aea93ea68b71d0d8f07cdfa8ab7995c3ccb0f444426a1cafb367237e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32565
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 003D 42 B
63 B 50ms
48ms Image
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CQHR8_i9fguDRX8Sssn6oYxk1-Xq59T0D4WEemv7ZYeg1X_Nx3MciBOkY_Xe2_YXEar_8W2VQ2fuCQhcH6KNpZlL9EooEunAV6e-TixRRPaZWtaOU

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220817/r20110914/client/ Frame 003D 3 KB
1 KB 24ms
20ms Script
text/javascript 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220817/r20110914/client/window_focus_fy2021.js

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:41:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 690
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 03 Sep 2022 21:41:49 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 003D 140 KB
43 KB 96ms
46ms Script
text/javascript 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba7478138664dfbadff2af30a268f4200a752a73d07dafb55937af20d1061357

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44050
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1660737283953252"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 20 Aug 2022 21:53:19 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220817/r20110914/client/ Frame 003D 17 KB
7 KB 24ms
21ms Script
text/javascript 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220817/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57000ea03bfb53734d0858b8fe992e6742226f23f311eb0f9d2177e2a84a5621

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:47:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 371
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7599
x-xss-protection: 0
server: cafe
etag: 9215437806027971270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 03 Sep 2022 21:47:08 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 003D 0
0 41ms
38ms Image
text/html 2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQwFgiy3zkXwwvMW5tb_0X4ywp_MGfuhTvd_GihDWGa0y1Qy3fYhDIT83KqrI4IDxHmIQ6lU-2Q23uxW7Mooh4JbAR60Q
Requested by: Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:81e::2004 Perth Amboy, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H/1.1 200
OK pixel
protected-by.clarium.io/ Frame 003D 68 B
329 B 28ms
26ms Image
image/png 52.70.74.170
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://protected-by.clarium.io/pixel?tag=wt_YmJkdk9BSm5xSC1JZGZmZ25fMDJDMkN5eF9FLzIzMjQwMTE5MDk6MzAweDI1MA==&v=5&s=v31gauju094&id=eyJkZnAiOnsiYWQiOjQ1Nzc0MzI4NzEsImMiOm51bGwsImwiOjAsIm8iOjIzMjQwMTE5MDksIkEiOiIvMTI0MDY3MTM3LDIxODI3MDc1OTUyL3dvcmszMDB4MjUwRlhfMSIsInkiOjQwNTUyMywiY28iOjAsInMiOiJ3YWxkby10YWctMTIwODQifX0%3D&sb=undefined&cb=7009036&h=work.ink&d=eyJ3aCI6IlltSmtkazlCU201eFNDMUpaR1ptWjI1Zk1ESkRNa041ZUY5Rkx6SXpNalF3TVRFNU1EazZNekF3ZURJMU1BPT0iLCJ3ZCI6eyJvIjoyMzI0MDExOTA5LCJ3IjoiMzAwIiwiaCI6IjI1MCJ9LCJ3ciI6Mn0=
Requested by: Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.70.74.170 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-70-74-170.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 20 Aug 2022 21:53:19 GMT
Server: nginx
Content-Type: image/png
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 68
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 1E8F 503 B
281 B 37ms
36ms Document
text/html 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPHpMxCpgz4Y5o_z0AEwAQ&v=APEucNV99VXxnfVw2e2VBTHFsUE-EEKvg43Rr6iuqSiK0V4kOaHC1neSSFDAdQUeomgUWN8VQ7LdVA54HTB0CIS0QqPliviBapUqCBjQXMiIfmIqYBi5guM

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

58644b7dfa826a3291e2e5d6c2974b47906616e1aa03a2f757fdd1bde7796621

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 260
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 20 Aug 2022 21:53:19 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 8A81 66 KB
32 KB 77ms
76ms Script
text/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ACSrPH6kQziU_iuoCS3h9IX9HrMsFDA7VN078TldfaLDwVHpFQTvLVPmMwvEmYESRWnNs49g4_1SFCCZO_ep7K-zPvhw&cry=1&dbm_d=AKAmf-Dxmje-4yLWMbOaKbCAk6eL5bgdF_J2R9XXDmZRmEksdQ_HvQRdUb3Ng28zoU8WMxJFygTpynkZ63nZcPR9phn8YQkLnk5WWk5EaTcv_3Xei63DkQEkFsJ_9zL0g5k9prqNcKzQr3LqjVqh4p4Ful7Ps1uQkeuQ3dKJHgKrE4wQBB4thUPRrhm-R0mnoUVYc-lP0AEiv0t9-IevETvUPVb3wGYibnHJSTnVmZCIbbocgWTIujUxBbQ7isrOkcFuWV24IDL3oNKxUubL_MRVs4iP8MhB7gt7nTD5mfvi_23tcTIYGIVTbxYSuNSs_qf919lyAL2EM4n7HiZ6t0n8vrAIbT1lcwX-g8spi2Ff41pt3KZb66n7-xF6XO4R0a9Q8sV5NpJ1Z9QCEEowQwAWLBjvurgaymFodctTQjVgCwDeVYNTTq0L6KqoGshuVNvajSNqxyhIG7CxfgOriiDCuaCZUxHaoQ1t6Kfge1LYFbH1MhmdlhVn8ap-lmpOEPHTVlOmPeUVBLpA1K-IUdOzD8eZD5z4KDMw_UU3odhlMQLbxzNDrNq9awx6yTmS-r5zBZGoWJyMOhQQ_fyEfb0j_agdt0KaqB0_3b5KTWxVlltiTcf7ZmDC6bMhAeQOO3nPpkzrW8SLXfNMoQW_fNfWIneOpxIA3PAfbRMHsdgNMqDs2v-HjHOyjBVFt6m_OS0yTKQNk6V3_kCLKVEgjMZZvoHg0jAZLzh17OkregOghWikTTrtEymh9hgGABnc7aCX2cYESg1nijV39NKzE0_qjEIqPX6WBSQXLwSBR_boB_j8zV04tvhF5fiKwIz8kVJy9r1ki7FEZKQsvgcC0NpmXWhnTfT5g1jakNG3t2d7Utne0DzZXW7eFcSofgPp9hyALOkqm-eoZBrFAMkP43JMglJqbX4oApkn6srKhuprigM_IK30LKQ83UWY0rY1C-qIvZkFt4h1q2-_H3gpOKTd5HcXR3AhFSuaRknmxTg_jXxrGS26SOALWFbdrtdlbGX_a5mG2F-VezorB1VaVwz6eyposYXJnxMC_FqEqcnGS-VuHQy89szKy2WuZi17__XAhBxcU6qu_LkfegQwru_Qavn5u3M1CFt9cmG5Fk9yR0ZFRXPJU12PMUWeHVOnRhXmSsf8fJ9qhaCiUyHiQDw5et5JtjhKJXYkpZqIRpHIoYYBol1sZbnjclvt1Wu2bwWOInNG5rM1Y2U_B3_AZoF8vO2rEbtPHrxcprDRcDYmPKXW0ZlGqTS4bzl6GvXgncArIDhySydeDDzmvBky_MreMdvdRMNuIpT0GonIMub2j-ZJyIA-Ts08ZfFjJtNEfSt18l-lA21DF4YYGqGsL2hKZdhLAtkgMo6s47y5vXsZYdJx8I3hSiQs50Y533ejRvT7c3Ymt_lSWzTksso0y1PtJRJS4vLSK4x10yyIPGmimb5f6RPbNGuLLzhCMfDKTuysIE0sZ8hurGWj6vOygcjhTzGgb9ygqvrvsIBY5FUbVgyqeNa7HU_MiF4Pqts_HYCqrYBGotEZK0mjp7UD19fbnV1euLHXCRva4y8G4rg6nOZou4Yfra8Z6DrYmdOVRAvEjQUUTY_KCQ82JaaYWp2NyW5cIz7BOJ_yJ34xOv3q_Zs0mf_62J745OKi6CiheA6BzL7A73zrXfoBzvL6fx0IjWZ6rd1SVrrIRJmygf6-qRr0EOEesrKXOQ2wQ5PqjxoDDo1Epn442VuakKzQIXehY744nZ_hGMykP6wp1UvKIxQnzbYQC8nqMTtPvjyO_05CWXQ-WapjhTHficI8VVw_YHm9SOVo8EDPqwtaYcSAreYAM984nUtl6HqTSvbKpkKguqKkO7SIUOmqCQRc_ZBGCtN_7WEWkuFD17X7lbpWHMBc1ViBNEVgCIT11sH1IrGTh2BNCj77nV6On0Z8wY1t5kJwCrI-auor8V9zAc-x6_GyOtRRdHcfu4uEY_Xjb_wY52BY9hWOudf69SUADhvoZ1Xq3sfQymtckLFdjYRmwmlWZHC2fGN_EujFGthCz1vAvfodsQUhC7Y7WWY4zJJLPLmJFalmK-1HUnS7ZvjADKLE2mhs4xwWVWUxufmktVxK32swk-S0GxRH-Gw21jwnLXLQOzLscXUVHOcUj9TSMyWKk04uUkPQGXFtES_4NNnArowR7P_H3xVg_9tf29xIbndFPaR5xMeRGPtyxLwYzD2XCmgG_P2NqPl1GHavt6EWoxFdaPSv4KRvVl5pCufgO92_IrOr-jF3ApzJLzXcTmMCAzQiEk85i-C2wtj3dQYvYeUW_vMScJYZ-24dyKUOQ1MO1C9nnSJ36OXRdJAomBfJkSB_xpKBLUyg6b-0zmT9m0vgsDDJ-YZgwqdfaZagJtnEpGyVzigO741mVEnVlijcJCvhoy2CGsy6BjqTBWw9I6l7i57xf-KMXDezQy_2F6wzm7cn2snQwSmq1YOH1-LAmipPanYRVv3Rd3nfft0Kh1NQyzJkiO-JMYBAF_evWDq_fTPJ6p-A2n7CTi2-v9lfzAV-s0ChB1FlgNa96DdMmTCePxKc2oYjnHxP74BAHkRtbt5lUIX-VN2yiMGj5xkc3LGt-QndQZgwHCsVvG9GU5hw_eSJMCVYzNXNovIvTZ_P2UasblkkLNnu-YLUreOaJWPYHlo3NniMsTJmzyRXYZ-p6Upk4wT_ksHbVBePm2ICqJyUaEb2q1dSHDWKHS-N8A4HudHZLf1UnRs5mirAf_0druSPi8zr-SlUNaFVEHFI795ahVnajDezf_7Rs4BYn0u4R21c5NIhDHfwkhc0UVL5ZvtJdfGdt9XUXITcLTCmLJOhyJLGfLgHF62yRfOYglOcyevkA9IZ5OmTAULu7wpgaJUzzMbsAZFqxUwD5CkvxhbbUj4YTBd80iwbm_m4cmbjjDoekWDDgtc2ifyLF9ZRxhf0HNqeB56M9QVkaLuYtwOJ15v0ExzNmaz7XmanUWK_-58j_YpUIpWOpIXSWkXElbVNdV9JcbbwPvniYFEVZcH0GIy4rYJ9xywwERQTV79589sz228_6Wll1qgbwkAippbIG_oDwMc0qprJJeeqvqa7HTlp-W9_F3J0o6pbE8OVg5EVjM1NPj5lzUU_4LlVFfR2T5BjORNqL7vy36bUyuAm_NaE8juC6mEXcXnCmU1-vOdoGeJIrhYHwZumj6bdzwn_Z3kskni0FkyLAKvFBb1PHw&cid=CAASJeRo8Z2ycvP-Szch5PVfjOHC60NVDerT3kWutDRHdkCFNaQwMhA&rfl=1%2Chttps%253A%252F%252Fwork.ink%252F%240

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c980151029e1e3cdcc06ff8a65e3d82e7f4fad31e81f90a39297a1150554963e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32395
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8A81 42 B
63 B 48ms
47ms Image
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-B3wQmrHS0gD3Ob_-p3ivlobhdt4JclGJ187ciFw2UWLKx6bwjYMYjbxee8LoUnthdwyAdm0bbp0UhakA76ICAQmzztBF5XsiqykD7NUR6yGWdxBmE

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220817/r20110914/client/ Frame 8A81 3 KB
1 KB 25ms
20ms Script
text/javascript 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220817/r20110914/client/window_focus_fy2021.js

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:41:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 690
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 03 Sep 2022 21:41:49 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8A81 140 KB
43 KB 80ms
75ms Script
text/javascript 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba7478138664dfbadff2af30a268f4200a752a73d07dafb55937af20d1061357

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44050
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1660737283953252"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 20 Aug 2022 21:53:19 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220817/r20110914/client/ Frame 8A81 17 KB
7 KB 26ms
21ms Script
text/javascript 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220817/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57000ea03bfb53734d0858b8fe992e6742226f23f311eb0f9d2177e2a84a5621

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:47:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 371
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7599
x-xss-protection: 0
server: cafe
etag: 9215437806027971270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 03 Sep 2022 21:47:08 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 8A81 0
0 44ms
40ms Image
text/html 2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSTuT-aovOhcUA32OI8yhFGzZIIRJQh0LD8DuGzV2JY9m7I0ehhARyA5I36i7DWPRFJw8xtCbA5buhJ-c7ErtBujnKhRA
Requested by: Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:81e::2004 Perth Amboy, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H/1.1 200
OK pixel
protected-by.clarium.io/ Frame 8A81 68 B
329 B 31ms
27ms Image
image/png 52.70.74.170
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://protected-by.clarium.io/pixel?tag=wt_YmJkdk9BSm5xSC1JZGZmZ25fMDJDMkN5eF9FLzIzMjQwMTE5MDk6MzAweDI1MA==&v=5&s=v31gauju0al&id=eyJkZnAiOnsiYWQiOjQ1Nzc0MzI4NzEsImMiOm51bGwsImwiOjAsIm8iOjIzMjQwMTE5MDksIkEiOiIvMTI0MDY3MTM3LDIxODI3MDc1OTUyL3dvcmszMDB4MjUwRlhfMiIsInkiOjQwNTUyMywiY28iOjAsInMiOiJ3YWxkby10YWctMTIwODUifX0%3D&sb=undefined&cb=8766535&h=work.ink&d=eyJ3aCI6IlltSmtkazlCU201eFNDMUpaR1ptWjI1Zk1ESkRNa041ZUY5Rkx6SXpNalF3TVRFNU1EazZNekF3ZURJMU1BPT0iLCJ3ZCI6eyJvIjoyMzI0MDExOTA5LCJ3IjoiMzAwIiwiaCI6IjI1MCJ9LCJ3ciI6Mn0=
Requested by: Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.70.74.170 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-70-74-170.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 20 Aug 2022 21:53:19 GMT
Server: nginx
Content-Type: image/png
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 68
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 06BE 356 B
240 B 38ms
37ms Document
text/html 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPHpMxCpgz4Y5o_z0AEwAQ&v=APEucNV3jMvB7bi7839zXdaA3cb9DB2p5CYrncaSr6onIldDGBnZcMH4Dd8vpKex2l17psMDR26GedGd8dU-On2UTn5dtEfztu2FzhzYzra0o4bWERxUgNc

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

55f56026d86468db4135723445d1df3498809ce536fa7a518b2847d7e6a27a96

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 219
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 20 Aug 2022 21:53:19 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 536D 65 KB
32 KB 63ms
62ms Script
text/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AWuSm9p5QFUvoq-KQ6HUNAdg0iBdVnbIcg9ZEfJ4tIgOHAbDSDGFbLLi0fuBk5hjt7-irK0avD-wrVoQBemBVyxZCOSQ&cry=1&dbm_d=AKAmf-CFllxGSG6MroSkKfJbtLuKU1uFN7OkxPW2J_XRpKon8pMeFKRg_kzdp_PWZL3kn2GFBeRHuGk9jSE8KoWm9KS5Gkomyzn17VNjmnIh9zhwW2UMDf33XB3EJiLlUbBFHnFYoa1MQpGhgZ-hsXIjO9b9mjMCemuBKDU-unXDmRg4H0tvPmX3CXhG-Jy9PX2bqKz8E9x7iGxJ35NY9-l-CX5h0nDL5GOdAdyoYbguXz00dSNF1-ao8Bf8ZrlXlcUFxQ9TpbymxuDYNK6ycR6dPJqn9Cs2OHLEADGfyuaV7BG3A22K4VyPK17_uybs0d6-c_pJD41OLWc3Ucwcq6t-1Ze6ikKzkK_gJzrpKpnT3aX_OO5lVMsXc8bQ2oRg0zwUdVPEJDwRWboyqEyRGSgBwp4fFtw8RUetEIbNRLHdoCRJNGEdf7JW5iCTPl4MZeJTMsSGYGHzoDKApogOM6oUnWTB8XLHElwMsTCo2KQtWc5SlEbAbKT1e9bKpg4DXP8hAzCsYtAi8dY8SATmDf_Akbmt9lOPRZg8wlahsMIBA0ief67XpZwYnPqAXhim2bGCc0NBLnB9xTV5sEwhReN1UkvJT6YAifHBvyrkG-zofgUN134u1c7y91Ht_x8LzwtPC9aIOzqy7FVmqe7XCst4CpMhFjvMeneoeOQGDB96u_eFcqgmrLJ1UxnxwWELiqqqEvrMV4qXUkjuVEqzN0s_WxO1s3dyWvM4lYu8CasPBj3p2mV4YlcAK__J3drMRU1L7w2y9JPGe-F0FqgPlud-knAhuzqj1N6Qe_R6aPTj1zIM7SqH8YWw61VKML6J7rNi0c-UfNO5CZyPe_LFI2T27QvrfMuBtWUKmXFrDpgPjRQvxPNu3ZlkW6qOgP3-5Po_uV8VtTG8HOPerVvqOBzaMHoQ1rA4LRUCNCPuq61LsSVnh50wYPqsXdDSDsL81ur5I5G4ecLGtheMlTvvewg_7PSEyIE2cATCa03Tat_Lm0PkR-Reeym4aqSa4pEuDA5F7HVt0VX8JQxTcRCoTZ2IW6l1TGaUqY5APk9sBHGNEuJcw4bzp4mfShl9W0-7Q01qUVSNGp6ajOdkmt6XhJGZtBwBdIe6RoD6O8QMCotvkr1pm-6MkjkWU8kyNBBNnZnCNJZDuVAxnRBg80B5eQHZt25E8QN4biCaGJUtkfD-iKHQlmWhK1mpyV8GjqWoAw5Ew1oT1a7XMD0oWuaGe_K6lwpXVQC6hFsTmjiHJLb0EzGpdokezQww6NQ0p4hYK7_r30z_BY1ph5JJiEZkHI2e6oz_p96Zk3x6-XrFE-cWj85rLmsHiv2VBSCIFtZ7J_47-DPGRgh-4oSSuzhGgln1Knl8Ny95SXlIoiQtjiFeI1Cz2Y4mOU5414itao71PdEkid1mmdXyWghFnUFo7_cVJ7Um9qh-CDXpmMHDEMGOGdOSKXXRkiX-qxrWiSNy0y-fVrNcrsQq1DAPhnp1pyAngoI8K4rQV4ur6LjkZrzi7Emdxi5juOKtpXfsjmE8Dqh9EBpbOrlq3DM90Jo-9RY0Ch0oo4CkPKKOIgGFN3tkJIRpRIgeYHtQu-Q4RA6bdDH__F0oMfStTsQZFLUmlucGtlsCcjIjY9HBGgNizypvOt0vkbRFtIRq07-yQuq94mk_uuED4ReHuolZcmrQ5Gr0Jv5fKfW__LOWDFeSD4-AOHLR2ScICb3VXuaVbCGH371m_9raCsViSghQ_ej3-RkBwdcgBSWEasHII_JTm638pSKq7B1qvndWVKhEF9aG1uTEYKp_PCe3Ta-zGWtz2XVfYhhK7hkL1Pz2Ftjg5MOtvqp7V2IyNu7Uc62jhgScAkSJggWpan9tWu6W4BAjSreoMNdtHBqdPurWjUmPZgVe6_lclgeaxwqc00h105UhUSduB3vmRe-tsqlejvp5dPbykIpia76YYWctIzypQCTrTqGizgLvalLS4wemKXs7kUZ_Ip8RsLjl4_FZCoLQxgRS29GQTTU6JStrNrPc_8ngaLIoE3SZ8_3hF5M0VeQ4ZX6cBZPYDQltOKe6Wl9AdT7AuGnQy2SB8F8BI16cmLUe5Ok0prTP3pnaE2vjSyqTb2Wtzh1QmhESayE5Rcnry8vKr6v0QrUyo4h9Q92BB9HbUwEBkXs-G8t1HRKV0cbdSqYLPLG7LVRGjhY-BAWT-w1uP5gfkC_vjai8Qi7zmPQKzfkElP9GPs3CAP-_SCtcBd26D-e2U6cnnONTDptUESfHS0mhPe98ymh3vrKnTfILiKbfngflD4eRyehUivez6pD6S-ZJ1WNTyhGiTTI4cqkHUiHOLWyRI8j3FXVRuKwaWSSKC4xcDRsgIO6IO1GV00XXcrvKEaFS84IXNC02axuR2vmWA8S0EmfvO4BojTnOg-_Q8vnLpPemrECzvzmCE8-sWM4a3MDFI88ZAXEAMzQRXIoBP2-RoduYDX_YcfYVwDsGRonZCvd9U5_JVCReDpUd_4EDCPF7VOSnqBHKVqiMvzXg_0HWLMipd2yltXUjqzkCLXvoJ6rToWNkVmEQP-w4gCbAS237_FBVpYKnQSLakay_8ZxSQeQWoHTrJznRV9-MkbHPWkMDxmMgKYHFwwUm095ZFxdZQG8YDAtaEZgggrwo3KCLEatKn0Q_X38e2SaHCy5L7WoZCcZaV2gyv1MEFBubnBVC_5AJ2WrGwDl8yCevcKorGAab8KFlqtzNToRFSz9R94xOPqMbMY9kvNeopOku47LeGw0NwTgSIpk5ULuihVSNb2APbqKa0U995VNW_vd3Dw0OrLIf158vsAYnhc-qU8la3VGRWmW5oS2qjMjAA6sMJ6odufdKMztpqqY2jfw0HPJ87PEkcotNN_dxBqNYoFnANkiM_nx3HwRotr_ogIkNVWss5QbSAydDql10mTtOjK09lC-brTnkuyniTm5l1e_nPmAagXl3o-H5-8jBDV9Kru0p_IzwQTZIrdkNBO1jYdg9_YGH_YD7r6A_xY9xvvzC3EP-yjsfHtpaOtNz47XrhnUR3PL7gOaC3paxxFAhnTs5I1gex42t6pr9F-Fr86aJ6lGHEkLhZKJYod-p0XX6Pl7Zi0lDuT5DlrTWrrCaxaPS0amG0d0-VfO0WJdoi7EYpuwCaROA2jjECFo-Dz-xSdMoikCBRg3HZzjBTRAIfokUFcZabiVfrGV6kHqPufFjKaBElBfMbjcCWUXWnYiOPg&cid=CAASJeRoyDe_aVWwzoBucnqKLSrtFhTN1Zu54tNcnb49YzsChqqxdDI&rfl=1%2Chttps%253A%252F%252Fwork.ink%252F%240

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6ff7b455b64124a324253e77d88933ae21d638c191d6e5cce62d8550beadafd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32369
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 536D 42 B
63 B 49ms
46ms Image
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Co0rzjkPnfAoamLrr_fP8ilHjh4N0hvHO_GGpbmCj1ECIXl5wFsDqrfS_FMNKmhdFzsVmtPbuKuN4nD40PaO_ZrQ8yKokua4JNy08jhPjsLz5rRUQ

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220817/r20110914/client/ Frame 536D 3 KB
1 KB 24ms
20ms Script
text/javascript 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220817/r20110914/client/window_focus_fy2021.js

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:41:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 690
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 03 Sep 2022 21:41:49 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 536D 140 KB
43 KB 45ms
41ms Script
text/javascript 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba7478138664dfbadff2af30a268f4200a752a73d07dafb55937af20d1061357

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44050
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1660737283953252"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 20 Aug 2022 21:53:19 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220817/r20110914/client/ Frame 536D 17 KB
7 KB 25ms
20ms Script
text/javascript 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220817/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57000ea03bfb53734d0858b8fe992e6742226f23f311eb0f9d2177e2a84a5621

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:47:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 371
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7599
x-xss-protection: 0
server: cafe
etag: 9215437806027971270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 03 Sep 2022 21:47:08 GMT

GET
H/1.1 200
OK pixel
protected-by.clarium.io/ Frame 536D 68 B
345 B 31ms
26ms Image
image/png 52.70.74.170
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://protected-by.clarium.io/pixel?tag=wt_YmJkdk9BSm5xSC1JZGZmZ25fMDJDMkN5eF9FLzIzMjQwMTE5MDk6MzAweDI1MA==&v=5&s=v31gauju0bv&id=eyJkZnAiOnsiYWQiOjQ1Nzc0MzI4NzEsImMiOm51bGwsImwiOjAsIm8iOjIzMjQwMTE5MDksIkEiOiIvMTI0MDY3MTM3LDIxODI3MDc1OTUyL3dvcmszMDB4MjUwRlhfMyIsInkiOjQwNTUyMywiY28iOjAsInMiOiJ3YWxkby10YWctMTIwOTYifX0%3D&sb=undefined&cb=9429096&h=work.ink&d=eyJ3aCI6IlltSmtkazlCU201eFNDMUpaR1ptWjI1Zk1ESkRNa041ZUY5Rkx6SXpNalF3TVRFNU1EazZNekF3ZURJMU1BPT0iLCJ3ZCI6eyJvIjoyMzI0MDExOTA5LCJ3IjoiMzAwIiwiaCI6IjI1MCJ9LCJ3ciI6Mn0=
Requested by: Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.70.74.170 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-70-74-170.compute-1.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 20 Aug 2022 21:53:19 GMT
Server: nginx/1.14.0 (Ubuntu)
Content-Type: image/png
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 68
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame DAEC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEMv6OMWz1IN25N6u00zFFX4&google_cver=1&gdpr=0
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEMv6OMWz1IN25N6u00zFFX4&google_cver=1&gdpr=0

43 B
61 B

55ms
39ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEMv6OMWz1IN25N6u00zFFX4&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPHpMxCpgz4Y5o_z0AEwAQ&v=APEucNVlnuzWgso1HOoW1RhHmDOs0BmyqvoDtiP0Ho7Yjayo3i5o4WoqFq3-_cbNMFydTNUeJ9Scp31DRvtYpUt3DMOeV3Iv-DZzMTQiJPTEpvYA4oExk7E
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEMv6OMWz1IN25N6u00zFFX4&google_cver=1&gdpr=0
date: Sat, 20 Aug 2022 21:53:19 GMT
via: 1.1 google
server: OXGW/0.0.0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DAEC
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&gdpr=0&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&gdpr=0&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NDFjMDRlMDctODVkMy0yZWMyLWMyOGQtOTZhY2E4ZmI0Y2E1

170 B
188 B

37ms
37ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NDFjMDRlMDctODVkMy0yZWMyLWMyOGQtOTZhY2E4ZmI0Y2E1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPHpMxCpgz4Y5o_z0AEwAQ&v=APEucNVlnuzWgso1HOoW1RhHmDOs0BmyqvoDtiP0Ho7Yjayo3i5o4WoqFq3-_cbNMFydTNUeJ9Scp31DRvtYpUt3DMOeV3Iv-DZzMTQiJPTEpvYA4oExk7E

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 20 Aug 2022 21:53:19 GMT
content-encoding: gzip
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NDFjMDRlMDctODVkMy0yZWMyLWMyOGQtOTZhY2E4ZmI0Y2E1
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
via: 1.1 google

GET
H2

200

um
sync.teads.tv/ Frame DAEC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm&gdpr=0
https://sync.teads.tv/um?eid=3&uid=CAESEFEfd1Q2Fbbc-7Phtv9AEwA&google_cver=1&gdpr=0

23 B
286 B

59ms
28ms

Image
image/gif

184.29.129.73
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEFEfd1Q2Fbbc-7Phtv9AEwA&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPHpMxCpgz4Y5o_z0AEwAQ&v=APEucNVlnuzWgso1HOoW1RhHmDOs0BmyqvoDtiP0Ho7Yjayo3i5o4WoqFq3-_cbNMFydTNUeJ9Scp31DRvtYpUt3DMOeV3Iv-DZzMTQiJPTEpvYA4oExk7E
Protocol: H2
Server: 184.29.129.73 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-29-129-73.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.8 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
cache-control: max-age=0, no-cache, no-store
expires: Sat, 20 Aug 2022 21:53:19 GMT
server: akka-http/10.2.8
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESEFEfd1Q2Fbbc-7Phtv9AEwA&google_cver=1&gdpr=0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 292
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DAEC
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&gdpr=0&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=N2M1YmExNWEtZWNlMS00MmJkLTg1YzMtNGRkNDJmNGU2ODdj

170 B
188 B

37ms
36ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=N2M1YmExNWEtZWNlMS00MmJkLTg1YzMtNGRkNDJmNGU2ODdj

Requested by

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
server: akka-http/10.2.8
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=N2M1YmExNWEtZWNlMS00MmJkLTg1YzMtNGRkNDJmNGU2ODdj
cache-control: max-age=0, no-cache, no-store
content-length: 189
expires: Sat, 20 Aug 2022 21:53:19 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220817/r20110914/ Frame 003D 30 KB
12 KB 19ms
19ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220817/r20110914/abg_lite.js

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c0d0b5ecf5aa2cd5475929aefcb44d67c5d5cc8cbcdb3991e45f0944f0344619

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:49:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 232
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11819
x-xss-protection: 0
server: cafe
etag: 10563440404697844360
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 03 Sep 2022 21:49:27 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220817/r20110914/elements/html/ Frame 003D 8 KB
3 KB 22ms
21ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220817/r20110914/elements/html/omrhp.js

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c9499ea51a2956fd2c1600591ae117fe9ad81065d625b1b2c593c7720e5b228f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:49:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 248
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 18418590997839133011
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 03 Sep 2022 21:49:11 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 003D 0
27 B 43ms
43ms Ping
image/gif 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsue0sRFqZm661YAg-afMkmLya-CN8PAXA2d5iBuxft2obLTPlR-086hRs4Y7ouJcNx1dey2G5pl7MNrIh7I7F9sMk8I32xJT3QKbRDlac30mm01uy9rLp-5fBXR4RFEqolZmnnmMn3IS7xaI7wiv2Qi20vnd3H-Pmrju2Q_EEXwqhoTDFzEIC8XNXNeXir6AuUvgQbcBgM7slnkIxHGjAXjkvYviIvPi-kseZCLEYXbKjYVkWTV9Kf88RIq6L1agolQNhyaKWsGszhgqiEYrUX6doHRnnoRe340XbrT0wg3kLgXRy6F3eaneot1_sZgl6ELjU2cpD5Sm3E-2zdZ3bEekXEdMF7q4ZRRt_PSJwyj4obOGqACCRXXnY8ISMjObENGmXmCzYARtlOgDNcqgG4w8p6Eabg7JhGQmqqKZpa4MmMnhG8ZWSZJiRcD5l9ZUyaxC_IDkiHyvH5GcpR98NYz015e99OhY_31bwrH2Ae7ucGj6cWxkerkY22Gx4UMXABezx-fTS78DzCMDfERCgvp9OQGz_vbV8-vU8HaUmxbF-Qt0KsT1XWgNHyatUfyjED3iZKMpU2y5DAjD0JyU6bFFEw9ZpbgxLC-_5g_w2zKC1qrx31WOlgf-zfX3jF3iH2Sbj2TovHf3U4YFArCSjBR5DcfLzXPiNq_usshZxKJ4vim02dcFmsPKGrLVouW14IqeeIHBkOpO9S-8qCAx7_nGxwzXEBIfyaxk2igEAjk4SyYJjI1nAHvOIc9nuVopuyZYSgNx0wIL_f33S28SkYxm8nrL3oGW82VqOrLmN_sa5OREuODrKP2Zy2WOr3xURmJ6paKeVR6gnCbOeRKsqvHp9ICdW3j6hiQzdly3trdpWnxBb0X0fOr1M3S_tDYYSm3oXcx0dxvYTNNiNg2z3HC-RiJe3BCrFDo6us09eavy-v4Dn1I3bbD9CVo7ua6Fg-zU3mm30Y-KB-tKpcc7DFFga2j-CqPJxO9I7mh_z6xhMcZoZqOtyyR4z41-ztqeIlmCBvuFbMPz4H9Rpz_j4ij6r-BVfYmtqtlqxRHPbqZCtlZB8L-qLK-eHF6P_9oXRZOwBRVy5XhRtsOUvDkpLsDetwLJA_K22e2w6M16L8A5A83gg7KQh91k_WiG0APlRop6ktLKE3EhaY9f3SwojVFkDJn1jBsBMpAkplDTKN42lP6QKn7ctc_NE-Ya71lwIQN&sai=AMfl-YQtEjzDfQYRNAm50fWRQMdKavAX5dmk8UxCq2gsj_vrEsdSWXD4I3FySlg2WgQFcxtyIEcgCGYiF7TXsNf1EWlz2XFGC3WyvQMPtoN2M0xPgebKRuOZljP1HWGvdFFGywvADA4yb0ai0lhN5hIxr9XwKA_m546ZfSg-wU0-nSXba_FeCgs7M2_nLzR7sO5sy_im6V_biDFwVzXvyiVRu4bjpzVzaQ-L4tK_NdVdK1gLDoBT&sig=Cg0ArKJSzNxaR8z2w-XtEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20220817.29831&adurl=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B2LMXMYjDv8FdhwWUKpv5eUYbUXptxsP01lMHZ80XGv6cIdujDMzlXBoalB41EeMV6nR3aL3KfyvyU_Qk6_PV5G9y6Sw&cry=1&dbm_d=AKAmf-B7T7BK5hFcRZmqJ8psOvR9r7KNAURXYTKkIhz9lDGUcIq0YYlMeh_nGCnbbaEBSFYi8ooMEKW5abTGMixgijosGKUNpe9e7AQrtPgypmtnkITE8niqkW0TbiIxlNWAFY9Fdsiiz4s-EwLRRpjhc_XfYXDRHfyKQFA2xUhiMufBzvqNtUiya5Cwf9wTNOk2PUo7VijCK6f_9dSBgmH0dtMr2eFg24TW7Ykbwi2Hpom2UsYNiLg4xLF_FouAiLDEkjF9GBefIZBgPbY73Ajm1mBJNwQP-7jPU4Q0HoAoZf3rwVAaWmD1NZS5RWbD9QavNEl9_h-ymKvt1Z2j5m86y4aTkcSZ4nAjKFLDvrO9mF3MmYsOFA35giYYGhKaGlwM2UAGfHIXKJB8Zt0qMu_kmdnS11pWkNsZiDtX-QuxhVCYLJoFzp2jM7lIk9BWusYGzDvjw7mX95nLThsq02Z2aD7pHL7sMC9JLvrI09eSWCYuNFBcL7ah8wAdCBqYQTZ08S6OODL7rYovfxLmItgt2nwVa5GZsAhEF7Gh2A1Ht3O9KdblsCgeVXIASNkJtsfdEvP7VZnkItDrLDuz6iZqNVGc_NWVdz_IFg_bjBp8xj-X1XEpaXptQE294hS_YI2rolJa5YuQ0fmJIbgVq2OdyDhn3KB1pjfj_BMVbt5TcZrgBXHGK9JShsFzOgpbt-xdATqMSD43JDsMn-1_sIV0MMqsMVrS5nltFhh5VR0CwlN7qrzaF8N60XYQUvaArM5c94PF1FZv7yLskS11qWO3I_checD1IhHlL1WJTAuP7gczUeMAduUNy6bZ5izsWHDfOAdOKGpSU0QK7bqXNeu_r9TZe2Vs9nMqhfk63nvmX4v8rG-OpecN4ORCE_Zb2gkyenGWCfe8vjY_oKx7FEs9Hp1JLzd_XrRrGuNusNNRlk6WHfVzpkzc0EZVJZSIeVeKtg84yIEOsDH2S5B7vPKZrH64VWosvo3LThMF5WyvPHvNdb0C-UbrBHY-Y2AOhR0gyqRbB_E1laufgnSMHtFYqidRlxF9buvInZsA2buN41UlPWgOllZ82voxhKS1WHnDOepG8Kpx-EFNxKR4fONr12DMM2SrmzM7ZHwDpKNHfuEOhSbtjGPXTueCbum9P4AgKbQc-HKWvq_gKFjMenqAm8efqimshEfQ8xu1IvANxzGwVmwCS8y2O1fubJsFyRoMyM4Kg5SeEPhlP8oqBwCv4CNyACHuNds5pInx0vg34HnD2i9Elljr8BzrQO1Dm1tWP0hyWJH0cTLOXfEALf0CmygSiykqOvR02OFVnINIt6WxdT0wlEWWs-GVREr9GaZp8LgEZtme4f0UdkZLNH2_XY1_8OysRE7P0f3u5PRM84XK_wmCQbozMtRa_8tKv0S741OpqIBCyIS9PqV-jK4a6x6w7X7S-5GAERjkA_1_JFerIQIM-vCjBvsA-z-gbB-6cnm9EjSBGISDX2S2KgypUQZB4VLEI4J7CJ6NNWknjkvKYjeCqWiIDW23MN9Maxh6C_YxMsye9X4F_IGmSYRlKbbhxHR_P9lG2UP8k2z97UHNtc71loVWDYq3XkU7UrvgwiGBqWqYSiG5BYJcUG-LjeMuQTA5k1z6oxoN-eT_14Yff0RyKXzUsji36lfb1sIzksDGDBB7mqtLJW0k-QG9DpUSdFyPGzz1u47kf01B0tTXcKP69bZoqm1LNH7Y6QpZJk7skiBL1f5vgmumlFmOjgNc9ALSom3d0cEeZbx9GACbCoYyw3CBZ8e9DEdhoTrKu5Xv3oiDwITNJQ5OdcwQph5OTe1ZLSRDll1-tPgOWASE9ZE-m1y4h21FFDFnKI4FlPEpX-qIcBBYWyNOGvVWprGjzUGVnE0bMLTYlOUyFksmmO5jQCch9aEn5Nfvgjm5owS8cPPswGD4I9uvvsafMlmFgB1a4vNaYJR7AIXvVQQBR7t-1fexk7UfWCy44ZhdK74FAe-bQTWoTUzuWjntpeo7qWGjqt_pEqGxpX9S_t7ufkp_Fh3m6sYDrsOJNx5CqIu93D8TZ64h8Kq3GsG8hB9t1RWMoroFovjSAjkaVsdQPqOa_IEN7T6uqiDh9s1uFCK6ik37Di7tAPSv-80_zAVqpP4r7dw6-g1_1L91aPvYcbBwxt8x2Kn11sJNXtLqZySl5gaIpK15JirFA7vP5XRh4YpVH7XS3KSh0mcnx6FEcl9IWmaPY2zY-IEXJZ0gqN3OMqZ6Juupg2RWSVgV_RbC23I70FmlZDst62lW8WAzK-rhMBIFhfRP4RRx6XTnEZwyb4lR6Pqh1LeO-tcUHvzUSpfZSgZJpe5WmSozM0yuDlw_f2NfFQBmJrD5mIyfnI6Oi6Cwn_xoiiN3ybuaP4R-pHQZ5YZkNV9uSHs1IMfxUHLkq1Vl8X5RMkZggeFlaQuAPc8hlm1RvoTb8QMn2DMYK1kOkh-KEaq7SgUTW30PXuJj1QLeenxPRkDMrxoDgAr-VlMz2K5j6X56OLOH1sS07ZtBHNfHukHFXRQPuZXGrBD9RrcXPVrj0aFfxyxD5_Odg8B5Gmt5yq_3dI15_xFCMTTcLgdlh7sDCrCMYMfz7hIlAE7g4hmprXpZpr_c1JXEzx60s-N4I2C_eunuTn_ZIe7MDLfvxzIjwU25va-Ok8RyCTSkZLpyys-OkB-VZfz4D0FGaliqGJsCeML6xd4xrV2dbccDhrPsT0pj28GOIB2kprDE-a-uVJcwnzVLPZOvFr2wUZ0EPkA5VrSF4gWpaT18-10RodlgF6WY3bt8SiVHOOfo4KYMBVOuEuHsM_9nZRtNw-sAgIcFBRejqF4ER-VoPRdBEkqsxGgVKFm7oZ7hqqnPva-yS0mMiCEfSCOlcAe1e3D9Q1lUEwmnfh1PRE-noX6UUjyOgVsmdy4nGHhG_F4LJWDrEFN4DIpFCTIqCmAOnE1_n3fA2F5lg9m-4A-NYRjjNnNq4ZEZRg7C-6Z3-4DPdYi4aySQgpIJ5endVgWLYT2uqXYQeZSM7xz7mhMQv6LKtEVO-mHZrCZVJXTbt93Ue2mo73NflDRCO3s3--76JTeVfYIa16lBfR1E9jPcCVB0MUBifubGdPDd0WsCWAYFIXzI_ymY3NYxFRq4_ljg2QLAzhLCS6ICuapTWQ2eEuZDayjghZFiqpal238BlLaGPm3T9Qgq4vVoQYJwQ-_YMEzT2sCirxQ2zQJ-k7N-Ag&cid=CAASJeRoqhxxva6vRlUoPs9QxKYUdzxZmVbTLppimrFxA1K6bysoqQg&rfl=1%2Chttps%253A%252F%252Fwork.ink%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Sat, 20 Aug 2022 21:53:19 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 003D 41 KB
15 KB 25ms
23ms Script
text/javascript 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Fri, 19 Aug 2022 08:01:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 136322
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 19 Aug 2023 08:01:17 GMT

GET
H3 200 10353269172827273540
s0.2mdn.net/simgad/ Frame 003D 40 KB
40 KB 24ms
22ms Image
image/jpeg 2607:f8b0:4006:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/10353269172827273540

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2006 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bde4ad40b808dc3b2b2d3224d8b0ddb8204f36a184e1d1143f4981793ca4ba0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 17 Aug 2022 19:41:04 GMT
x-content-type-options: nosniff
age: 267135
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40915
x-xss-protection: 0
last-modified: Wed, 10 Aug 2022 18:17:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Aug 2023 19:41:04 GMT

GET
H2 200 beacon
tag.researchnow.com/t/ Frame 003D 42 B
442 B 136ms
20ms Image
image/gif 52.85.61.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tag.researchnow.com/t/beacon?pr=287288&adn=3&ca=28080344&si=2400725&pl=342915005&cr=176511747&did=ADID&ord=2280087564&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
Requested by: Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.61.63 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-61-63.ewr53.r.cloudfront.net
Software: Apache/2.4.54 () / PHP/7.2.34
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 20:59:06 GMT
via: 1.1 6a2d00c5c73022efc4bc2786f44b3cdc.cloudfront.net (CloudFront)
server: Apache/2.4.54 ()
age: 3253
x-powered-by: PHP/7.2.34
x-cache: Hit from cloudfront
p3p: CP='NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM'
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
x-amz-cf-pop: EWR53-P1
content-type: image/gif
content-length: 42
x-amz-cf-id: LEdLmjucxpQV875_CNXv-QzetUDS5pKT9Iwt0xn53j80LZb4A1DfCw==
expires: 0

GET
H/1.1 200
OK adServerESI.aspx
secure.insightexpressai.com/adServer/ Frame 003D 35 B
2 KB 163ms
53ms Image
image/gif 2600:1400:d:59b::1ec4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.insightexpressai.com/adServer/adServerESI.aspx?script=false&bannerID=10641154&siteID=N4478.1355339GOOGLE.COMDDMBIDMAN&creativeID=176511747&placementID=342915005&rnd=2280087564&gdpr=0&gdpr_consent=&redir=https://secure.insightexpressai.com/adserver/1pixel.gif

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1400:d:59b::1ec4 New York, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

22816a00dfe9fcdc30063d22717ab9cbab3aeb2a8e9844e9d774d256dc48b7c8

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOWALL
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
P3P: CP="NOI DSP COR NID CUR ADMa OUR STP STA"
Connection: keep-alive
Content-Length: 35
X-XSS-Protection: 1; mode=block
Request-Context: appId=cid-v1:5b4dbfaf-2d3f-4217-81a4-dbc3623f316f
Pragma: no-cache
Referrer-Policy: unsafe-url
X-Frame-Options: ALLOWALL
Date: Sat, 20 Aug 2022 21:53:19 GMT
Vary: Accept-Encoding
Content-Type: image/gif
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Request-Context
Cache-Control: max-age=0, no-cache
Feature-Policy: accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'none'
Expires: Sat, 20 Aug 2022 21:53:19 GMT

GET
H2

200

sync
partners.tremorhub.com/ Frame 1E8F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=tremor_video_dbm&google_cm&google_dbm&gdpr=0
https://partners.tremorhub.com/sync?UIGL=CAESEGxaTaHMJqDiOgxVRuuxC8o&google_cver=1&gdpr=0

43 B
183 B

104ms
23ms

Image
image/gif

2600:1f18:612b:4232:6e00:7b23:6545:3513
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partners.tremorhub.com/sync?UIGL=CAESEGxaTaHMJqDiOgxVRuuxC8o&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPHpMxCpgz4Y5o_z0AEwAQ&v=APEucNV99VXxnfVw2e2VBTHFsUE-EEKvg43Rr6iuqSiK0V4kOaHC1neSSFDAdQUeomgUWN8VQ7LdVA54HTB0CIS0QqPliviBapUqCBjQXMiIfmIqYBi5guM
Protocol: H2
Server: 2600:1f18:612b:4232:6e00:7b23:6545:3513 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:19 GMT
server: Apache-Coyote/1.1
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://partners.tremorhub.com/sync?UIGL=CAESEGxaTaHMJqDiOgxVRuuxC8o&google_cver=1&gdpr=0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 294
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200

partner
sync.search.spotxchange.com/ Frame 1E8F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm&gdpr=0
https://sync.search.spotxchange.com/partner?adv_id=7025&gdpr=0&uid=CAESEJevCb7rIanWDsN_7_NdUmM&google_cver=1
https://sync.search.spotxchange.com/partner?adv_id=7025&gdpr=0&uid=CAESEJevCb7rIanWDsN_7_NdUmM&google_cver=1&__user_check__=1&sync_id=80c78aa1-20d2-11ed-bfce-1b799b2c0103

43 B
549 B

27ms
27ms

Image
image/gif

192.35.249.120
SPOTX-IAD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=7025&gdpr=0&uid=CAESEJevCb7rIanWDsN_7_NdUmM&google_cver=1&__user_check__=1&sync_id=80c78aa1-20d2-11ed-bfce-1b799b2c0103
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPHpMxCpgz4Y5o_z0AEwAQ&v=APEucNV99VXxnfVw2e2VBTHFsUE-EEKvg43Rr6iuqSiK0V4kOaHC1neSSFDAdQUeomgUWN8VQ7LdVA54HTB0CIS0QqPliviBapUqCBjQXMiIfmIqYBi5guM
Protocol: HTTP/1.1
Server: 192.35.249.120 Ashburn, United States, ASN11742 (SPOTX-IAD, US),
Reverse DNS
Software: nginx /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Sat, 20 Aug 2022 21:53:19 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 298
Connection: keep-alive
Content-Length: 43

Redirect headers

Date: Sat, 20 Aug 2022 21:53:19 GMT
Server: nginx
Location: /partner?adv_id=7025&gdpr=0&uid=CAESEJevCb7rIanWDsN_7_NdUmM&google_cver=1&__user_check__=1&sync_id=80c78aa1-20d2-11ed-bfce-1b799b2c0103
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 373
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1E8F
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=7025&gdpr=0&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID
https://sync.search.spotxchange.com/partner?adv_id=7025&gdpr=0&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID&__user_check__=1...
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=ODBjNzhhNWUtMjBkMi0xMWVkLWJmY2UtMWI3OTliMmMwMTAz

170 B
188 B

39ms
38ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=ODBjNzhhNWUtMjBkMi0xMWVkLWJmY2UtMWI3OTliMmMwMTAz

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPHpMxCpgz4Y5o_z0AEwAQ&v=APEucNV99VXxnfVw2e2VBTHFsUE-EEKvg43Rr6iuqSiK0V4kOaHC1neSSFDAdQUeomgUWN8VQ7LdVA54HTB0CIS0QqPliviBapUqCBjQXMiIfmIqYBi5guM

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Sat, 20 Aug 2022 21:53:19 GMT
Server: nginx
Location: https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=ODBjNzhhNWUtMjBkMi0xMWVkLWJmY2UtMWI3OTliMmMwMTAz
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 308
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 06BE
Redirect Chain

https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&gdpr=0&redir=true
https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&gdpr=0&redir=true&verify=true
https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS1iNEFHSFRORTJ1RVkudjF2SExpcGxaQzZFRG55RG83Yn5B&gdpr=0&gdpr_consent=

170 B
188 B

36ms
36ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS1iNEFHSFRORTJ1RVkudjF2SExpcGxaQzZFRG55RG83Yn5B&gdpr=0&gdpr_consent=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPHpMxCpgz4Y5o_z0AEwAQ&v=APEucNV3jMvB7bi7839zXdaA3cb9DB2p5CYrncaSr6onIldDGBnZcMH4Dd8vpKex2l17psMDR26GedGd8dU-On2UTn5dtEfztu2FzhzYzra0o4bWERxUgNc

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS1iNEFHSFRORTJ1RVkudjF2SExpcGxaQzZFRG55RG83Yn5B&gdpr=0&gdpr_consent=
date: Sat, 20 Aug 2022 21:53:19 GMT
server: ATS/9.1.10.25
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200
OK

user-registering
ads.stickyadstv.com/ Frame 06BE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_cm&google_dbm&gdpr=0
https://ads.stickyadstv.com/user-registering?dataProviderId=141&userId=CAESEAl_mim2GlGPij18BE2GHOk&google_cver=1&gdpr=0

43 B
679 B

165ms
19ms

Image
image/gif

63.251.28.234

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.stickyadstv.com/user-registering?dataProviderId=141&userId=CAESEAl_mim2GlGPij18BE2GHOk&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPHpMxCpgz4Y5o_z0AEwAQ&v=APEucNV3jMvB7bi7839zXdaA3cb9DB2p5CYrncaSr6onIldDGBnZcMH4Dd8vpKex2l17psMDR26GedGd8dU-On2UTn5dtEfztu2FzhzYzra0o4bWERxUgNc
Protocol: HTTP/1.1
Server: 63.251.28.234 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 20 Aug 2022 21:53:19 GMT
Server: nginx
Transfer-Encoding: chunked
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
x-sticky-vk: 1661032399531045-294

Redirect headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ads.stickyadstv.com/user-registering?dataProviderId=141&userId=CAESEAl_mim2GlGPij18BE2GHOk&google_cver=1&gdpr=0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 328
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 06BE
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=11
https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_hm=MTc5YzgxYTlhNDExNmU0ZjcwNTk4YjNiMzQ2Y2RjMmI=&gdpr=0&gdpr_consent=

170 B
188 B

37ms
36ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_hm=MTc5YzgxYTlhNDExNmU0ZjcwNTk4YjNiMzQ2Y2RjMmI=&gdpr=0&gdpr_consent=

Requested by

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 20 Aug 2022 21:53:19 GMT
Server: nginx
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_hm=MTc5YzgxYTlhNDExNmU0ZjcwNTk4YjNiMzQ2Y2RjMmI=&gdpr=0&gdpr_consent=
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
x-sticky-vk: 1661032399524048-54

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220817/r20110914/ Frame 8A81 30 KB
12 KB 21ms
20ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220817/r20110914/abg_lite.js

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c0d0b5ecf5aa2cd5475929aefcb44d67c5d5cc8cbcdb3991e45f0944f0344619

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:49:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 232
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11819
x-xss-protection: 0
server: cafe
etag: 10563440404697844360
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 03 Sep 2022 21:49:27 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220817/r20110914/elements/html/ Frame 8A81 8 KB
3 KB 20ms
19ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220817/r20110914/elements/html/omrhp.js

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c9499ea51a2956fd2c1600591ae117fe9ad81065d625b1b2c593c7720e5b228f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:49:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 248
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 18418590997839133011
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 03 Sep 2022 21:49:11 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8A81 0
27 B 44ms
44ms Ping
image/gif 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvziiAZkSNjBKkr2wUgKcs6KyEQlVRyGuZIPSCGKILGgHElk-SOFjDRiaaD_I0MSK927PLJQzHI28cDAIgrIJugZfRwTCJPuh8oeN1n4jNEXc11B3wEB2znwg9MA0poN2Pamv6o6tk4zM7ZNuBr-ehYxdWmFFi9onsgx70dUAC2_nTGUd160uFXER9QjPsmJrKZS7rhUC5zmHqRUYY-ZOLKSGH9dVEsMiLKR1XivvwCyX2QyI373X5gH3KAnzc11L2-aHRnjZbcuztWow4y_jDdpbvvfXx3UY4HQ6EE8v1L5FGs4tJ0C8au3e0QSnVhexgGq6Ynj19BJ1dOXXN483WxX3XMWWaMwmmyDc9ALAYO9GotjQ4v8zekfaMT6xMrGP-QupTVaKN1gT0BVw7a17OtLqPZzqcdWP6EFz8MxFcah9xn0b52F_sYGhAlM9ITP59nZ-RlrKlQKwwV4HVUeQRN54lPsVhE0QzHr493GmJpiQW6EPFi4MbFUNT2mR0AxBKzvTaNCGBgc7eoSt1GP_1UowYG36n7l-YDxQ45nEvN-NKTBMYTAMY639qO5eWp2j1tnnStnbupa2sGVZ5Abni68voZ0vH1c2goejxqfewkKCkB9mCA3wPpIfS2OdaSqPRJa2YX0pPpwlxFlktnYF2WuvNCCtZoV64QfjCALVjyLGN2rgzuWMFTnGatL4En5OQRYqAZ5uvltTdXXC7AEKw31qESsT1Yo2VlCwiG46TumqMskeqtBGjhG-Rr4L1gYfN9eZXgLsn7zBkGBOqns7qsQKsd14uUqm7BfkTq76OPrmaD5LFQieCs56KkQKuS0V_1c9o9BD7MQjkLuRkGCpqEJERM2-BvYbr3mgVg9vW0ou9quqvpXdiuX1QZgMTCVUEyEOLOdSZPz4aTWJ_FWNTW1557Wr5SOGH9yYFmRAgS8FCXsvyNJcZ_LGqTOzQbKdyLth6vDYZ-L5cNKAeeCtF4dGI_TR4Hsc0_53iTXXMJAi0_3h5uIEr7TyOAK9WN5kICPmH0170Zlmg1Jx5YGjUGc8VU47AUwiVmj0-v4ZjHmooD6BtHwM0lftLmUK1fs5v6TiuWXT6W-mFB9jN5Q_tTxCYgXVKHPdlCuD_bDIGAU2q-MPlMNQgqc04EWq4klr46wsHrKkWaXEZl7M8Pt_4U249GQbpfNAPFm0XkUrGJOBeZudndKZfZEjoxA1SLTmn3a9PSMQ&sai=AMfl-YQVXdfkptpu0rfB7tIVN7icJsaz8jEF6FXQBEr8IsmnsVENneyzPMGQUikcCJGdvWpOuvec8WRSptUI4tHbp1oH9-QLTt5jaLNj3rqPjL8mlMwCZtw6nAxeQdn5HOBG4YzwflaTJcy3fJRY9YmxquRjJdPqtBUdxoVyyyTZ8PKTt7kpbstzsnhhNaBlnHYvpMQW1NrZvBDC8BZ9Xypu8yy33a1wUnxVA6t6W97aawedNvce&sig=Cg0ArKJSzMFZ6pBwi5OmEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20220817.51204&adurl=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ACSrPH6kQziU_iuoCS3h9IX9HrMsFDA7VN078TldfaLDwVHpFQTvLVPmMwvEmYESRWnNs49g4_1SFCCZO_ep7K-zPvhw&cry=1&dbm_d=AKAmf-Dxmje-4yLWMbOaKbCAk6eL5bgdF_J2R9XXDmZRmEksdQ_HvQRdUb3Ng28zoU8WMxJFygTpynkZ63nZcPR9phn8YQkLnk5WWk5EaTcv_3Xei63DkQEkFsJ_9zL0g5k9prqNcKzQr3LqjVqh4p4Ful7Ps1uQkeuQ3dKJHgKrE4wQBB4thUPRrhm-R0mnoUVYc-lP0AEiv0t9-IevETvUPVb3wGYibnHJSTnVmZCIbbocgWTIujUxBbQ7isrOkcFuWV24IDL3oNKxUubL_MRVs4iP8MhB7gt7nTD5mfvi_23tcTIYGIVTbxYSuNSs_qf919lyAL2EM4n7HiZ6t0n8vrAIbT1lcwX-g8spi2Ff41pt3KZb66n7-xF6XO4R0a9Q8sV5NpJ1Z9QCEEowQwAWLBjvurgaymFodctTQjVgCwDeVYNTTq0L6KqoGshuVNvajSNqxyhIG7CxfgOriiDCuaCZUxHaoQ1t6Kfge1LYFbH1MhmdlhVn8ap-lmpOEPHTVlOmPeUVBLpA1K-IUdOzD8eZD5z4KDMw_UU3odhlMQLbxzNDrNq9awx6yTmS-r5zBZGoWJyMOhQQ_fyEfb0j_agdt0KaqB0_3b5KTWxVlltiTcf7ZmDC6bMhAeQOO3nPpkzrW8SLXfNMoQW_fNfWIneOpxIA3PAfbRMHsdgNMqDs2v-HjHOyjBVFt6m_OS0yTKQNk6V3_kCLKVEgjMZZvoHg0jAZLzh17OkregOghWikTTrtEymh9hgGABnc7aCX2cYESg1nijV39NKzE0_qjEIqPX6WBSQXLwSBR_boB_j8zV04tvhF5fiKwIz8kVJy9r1ki7FEZKQsvgcC0NpmXWhnTfT5g1jakNG3t2d7Utne0DzZXW7eFcSofgPp9hyALOkqm-eoZBrFAMkP43JMglJqbX4oApkn6srKhuprigM_IK30LKQ83UWY0rY1C-qIvZkFt4h1q2-_H3gpOKTd5HcXR3AhFSuaRknmxTg_jXxrGS26SOALWFbdrtdlbGX_a5mG2F-VezorB1VaVwz6eyposYXJnxMC_FqEqcnGS-VuHQy89szKy2WuZi17__XAhBxcU6qu_LkfegQwru_Qavn5u3M1CFt9cmG5Fk9yR0ZFRXPJU12PMUWeHVOnRhXmSsf8fJ9qhaCiUyHiQDw5et5JtjhKJXYkpZqIRpHIoYYBol1sZbnjclvt1Wu2bwWOInNG5rM1Y2U_B3_AZoF8vO2rEbtPHrxcprDRcDYmPKXW0ZlGqTS4bzl6GvXgncArIDhySydeDDzmvBky_MreMdvdRMNuIpT0GonIMub2j-ZJyIA-Ts08ZfFjJtNEfSt18l-lA21DF4YYGqGsL2hKZdhLAtkgMo6s47y5vXsZYdJx8I3hSiQs50Y533ejRvT7c3Ymt_lSWzTksso0y1PtJRJS4vLSK4x10yyIPGmimb5f6RPbNGuLLzhCMfDKTuysIE0sZ8hurGWj6vOygcjhTzGgb9ygqvrvsIBY5FUbVgyqeNa7HU_MiF4Pqts_HYCqrYBGotEZK0mjp7UD19fbnV1euLHXCRva4y8G4rg6nOZou4Yfra8Z6DrYmdOVRAvEjQUUTY_KCQ82JaaYWp2NyW5cIz7BOJ_yJ34xOv3q_Zs0mf_62J745OKi6CiheA6BzL7A73zrXfoBzvL6fx0IjWZ6rd1SVrrIRJmygf6-qRr0EOEesrKXOQ2wQ5PqjxoDDo1Epn442VuakKzQIXehY744nZ_hGMykP6wp1UvKIxQnzbYQC8nqMTtPvjyO_05CWXQ-WapjhTHficI8VVw_YHm9SOVo8EDPqwtaYcSAreYAM984nUtl6HqTSvbKpkKguqKkO7SIUOmqCQRc_ZBGCtN_7WEWkuFD17X7lbpWHMBc1ViBNEVgCIT11sH1IrGTh2BNCj77nV6On0Z8wY1t5kJwCrI-auor8V9zAc-x6_GyOtRRdHcfu4uEY_Xjb_wY52BY9hWOudf69SUADhvoZ1Xq3sfQymtckLFdjYRmwmlWZHC2fGN_EujFGthCz1vAvfodsQUhC7Y7WWY4zJJLPLmJFalmK-1HUnS7ZvjADKLE2mhs4xwWVWUxufmktVxK32swk-S0GxRH-Gw21jwnLXLQOzLscXUVHOcUj9TSMyWKk04uUkPQGXFtES_4NNnArowR7P_H3xVg_9tf29xIbndFPaR5xMeRGPtyxLwYzD2XCmgG_P2NqPl1GHavt6EWoxFdaPSv4KRvVl5pCufgO92_IrOr-jF3ApzJLzXcTmMCAzQiEk85i-C2wtj3dQYvYeUW_vMScJYZ-24dyKUOQ1MO1C9nnSJ36OXRdJAomBfJkSB_xpKBLUyg6b-0zmT9m0vgsDDJ-YZgwqdfaZagJtnEpGyVzigO741mVEnVlijcJCvhoy2CGsy6BjqTBWw9I6l7i57xf-KMXDezQy_2F6wzm7cn2snQwSmq1YOH1-LAmipPanYRVv3Rd3nfft0Kh1NQyzJkiO-JMYBAF_evWDq_fTPJ6p-A2n7CTi2-v9lfzAV-s0ChB1FlgNa96DdMmTCePxKc2oYjnHxP74BAHkRtbt5lUIX-VN2yiMGj5xkc3LGt-QndQZgwHCsVvG9GU5hw_eSJMCVYzNXNovIvTZ_P2UasblkkLNnu-YLUreOaJWPYHlo3NniMsTJmzyRXYZ-p6Upk4wT_ksHbVBePm2ICqJyUaEb2q1dSHDWKHS-N8A4HudHZLf1UnRs5mirAf_0druSPi8zr-SlUNaFVEHFI795ahVnajDezf_7Rs4BYn0u4R21c5NIhDHfwkhc0UVL5ZvtJdfGdt9XUXITcLTCmLJOhyJLGfLgHF62yRfOYglOcyevkA9IZ5OmTAULu7wpgaJUzzMbsAZFqxUwD5CkvxhbbUj4YTBd80iwbm_m4cmbjjDoekWDDgtc2ifyLF9ZRxhf0HNqeB56M9QVkaLuYtwOJ15v0ExzNmaz7XmanUWK_-58j_YpUIpWOpIXSWkXElbVNdV9JcbbwPvniYFEVZcH0GIy4rYJ9xywwERQTV79589sz228_6Wll1qgbwkAippbIG_oDwMc0qprJJeeqvqa7HTlp-W9_F3J0o6pbE8OVg5EVjM1NPj5lzUU_4LlVFfR2T5BjORNqL7vy36bUyuAm_NaE8juC6mEXcXnCmU1-vOdoGeJIrhYHwZumj6bdzwn_Z3kskni0FkyLAKvFBb1PHw&cid=CAASJeRo8Z2ycvP-Szch5PVfjOHC60NVDerT3kWutDRHdkCFNaQwMhA&rfl=1%2Chttps%253A%252F%252Fwork.ink%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Sat, 20 Aug 2022 21:53:19 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 8A81 41 KB
15 KB 20ms
20ms Script
text/javascript 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Fri, 19 Aug 2022 08:01:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 136322
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 19 Aug 2023 08:01:17 GMT

GET
H3 200 5290471328931430772
s0.2mdn.net/simgad/ Frame 8A81 59 KB
59 KB 22ms
21ms Image
image/jpeg 2607:f8b0:4006:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/5290471328931430772

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2006 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6efa96c4520f94c3ad862386bba0cdf7da499592d52b7c8d102741872e05ec9a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 17 Aug 2022 19:41:03 GMT
x-content-type-options: nosniff
age: 267136
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60643
x-xss-protection: 0
last-modified: Wed, 10 Aug 2022 18:16:07 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Aug 2023 19:41:03 GMT

GET
H2 200 beacon
tag.researchnow.com/t/ Frame 8A81 42 B
442 B 92ms
20ms Image
image/gif 52.85.61.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tag.researchnow.com/t/beacon?pr=287288&adn=3&ca=28080344&si=2400725&pl=342915005&cr=175972678&did=ADID&ord=1012042268&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
Requested by: Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.61.63 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-61-63.ewr53.r.cloudfront.net
Software: Apache/2.4.54 () / PHP/7.2.34
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 20:59:06 GMT
via: 1.1 6a2d00c5c73022efc4bc2786f44b3cdc.cloudfront.net (CloudFront)
server: Apache/2.4.54 ()
age: 3253
x-powered-by: PHP/7.2.34
x-cache: Hit from cloudfront
p3p: CP='NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM'
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
x-amz-cf-pop: EWR53-P1
content-type: image/gif
content-length: 42
x-amz-cf-id: x2JrrS-7IQ8c137Rcjni3bx-28jQmOz2qVNzhq9TyQ9_YFvvOfhp1Q==
expires: 0

GET
H/1.1 200
OK adServerESI.aspx
secure.insightexpressai.com/adServer/ Frame 8A81 35 B
2 KB 127ms
62ms Image
image/gif 2600:1400:d:59b::1ec4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.insightexpressai.com/adServer/adServerESI.aspx?script=false&bannerID=10641154&siteID=N4478.1355339GOOGLE.COMDDMBIDMAN&creativeID=175972678&placementID=342915005&rnd=1012042268&gdpr=0&gdpr_consent=&redir=https://secure.insightexpressai.com/adserver/1pixel.gif

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1400:d:59b::1ec4 New York, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

22816a00dfe9fcdc30063d22717ab9cbab3aeb2a8e9844e9d774d256dc48b7c8

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOWALL
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
P3P: CP="NOI DSP COR NID CUR ADMa OUR STP STA"
Connection: keep-alive
Content-Length: 35
X-XSS-Protection: 1; mode=block
Request-Context: appId=cid-v1:5b4dbfaf-2d3f-4217-81a4-dbc3623f316f
Pragma: no-cache
Referrer-Policy: unsafe-url
X-Frame-Options: ALLOWALL
Date: Sat, 20 Aug 2022 21:53:19 GMT
Vary: Accept-Encoding
Content-Type: image/gif
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Request-Context
Cache-Control: max-age=0, no-cache
Feature-Policy: accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'none'
Expires: Sat, 20 Aug 2022 21:53:19 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 003D 0
26 B 38ms
37ms Ping
image/gif 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 20 Aug 2022 21:53:19 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 5290471328931430772
s0.2mdn.net/simgad/ Frame 536D 59 KB
59 KB 21ms
20ms Image
image/jpeg 2607:f8b0:4006:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/5290471328931430772

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2006 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6efa96c4520f94c3ad862386bba0cdf7da499592d52b7c8d102741872e05ec9a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 17 Aug 2022 19:41:03 GMT
x-content-type-options: nosniff
age: 267136
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60643
x-xss-protection: 0
last-modified: Wed, 10 Aug 2022 18:16:07 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Aug 2023 19:41:03 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220817/r20110914/ Frame 536D 30 KB
12 KB 20ms
19ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220817/r20110914/abg_lite.js

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c0d0b5ecf5aa2cd5475929aefcb44d67c5d5cc8cbcdb3991e45f0944f0344619

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:49:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 232
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11819
x-xss-protection: 0
server: cafe
etag: 10563440404697844360
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 03 Sep 2022 21:49:27 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220817/r20110914/elements/html/ Frame 536D 8 KB
3 KB 19ms
19ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220817/r20110914/elements/html/omrhp.js

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c9499ea51a2956fd2c1600591ae117fe9ad81065d625b1b2c593c7720e5b228f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:49:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 248
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 18418590997839133011
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 03 Sep 2022 21:49:11 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 536D 0
27 B 47ms
47ms Ping
image/gif 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstLVKsqJ_bYgOUtkMWW_R__dKhLIGQCwdWVYJRrsZmw_P8o7YahsSj28NZwhVe6bq2iMneoajgH0JlmQQZ1NjCkFH5rpxz6DjW11cXRHEFXSdoSYeh80jC3n3Q7hNQac1CTx4o70-KPrq1_PUVk1_-jjpwnotywIlJus12KMbffg8X-8mxpigU5yXUIXWaYLZHUKf-U4Ds30n-9JUcgc4VIIeyoq1Zvx4AAp3kMStWyXnhZXY2J9mq7FRbxvkuJd1AtUKwlDyQpezsf8QgWspEbnm-OvtIbPABR6__Jj4J1aaiREWkA3I2sWyqQ8vDypp68dGqT3q0DIWUOhWQHDY8_hNKPJ1kYkb1VrbCkOzP3egQnUyY9xVRf_pqeR4NYWtakjRM5fVBZ6KMMrDCtTsa62MuGt_vkh9I0BYuzouwGLmLSBEzzFhHyhyZkDe3BQJiWK7JsOVwR-HyePbp0UX108RVTICRryw2NCf9vpf8-HG8mY-l0zCFvcDPtZBhIM6Xl6cAJ_UJrGNe8V8m6g3n61JmXJVLbS0TsBi55GxVxONBNNl2PFlUjPG9PBoGfXXhlQ_At6aYZRffYmr7iY8Xy5zJqjajSGFJ0jV2yI8ghgWgNis_KDl0R-KjtBkNGc6ybL1isikyDeJM2mzCYPt8ekaKcV1bjCa4xS9HbHDJhcdZDGd5kQlMLEZhgn507F3wokx30WnXiPzYlaJJsH0dIAXBvRknEB2mSHeBHwnjciAPrwpJi8frbJ88v-WfAE5KnAeg64LlZn7Qc1r1EfsogMPbCuycc1SbaKRRvxlpzEZ9BPNFvNOwguQWBi62dB6TioFnVDh_fV_hDJIa5TTEZxiI0DNVuBPUK0C0sZ8F-WLoyKBUwhixhjA7eSlsiM6_MWdqvZmy7GCu41VzDrWkcGkLpP_MBS3Q-9Pzf5BQuBnxTgw89OU9peLojyxACUb2AcxdppApOAfM5iogThFzxiapgb_pVmo1uzxu_ABv2FRd5Fx5h8dMMjEXJHYI3ltJFSBXKBUHVMeTGC4fnjqdNUkB5zagVpz_o-q-DKx9cXWE6JAE-yhRmaqTx-MJgqqk-_XnUcOpwRWxSl5Wzb7kDgpBsNntizT4MG-VZ_dKXq2vXsu_fkO4vydSUYxWqxxAHW3CT-n5jRXcyIbbCQnZRiGtrxhlFQwpnVXhwS7rUshv1z85udlKxnKKnmIMYxTRfGBkn7w&sai=AMfl-YS_BuhdTjrRG1-goLt2GMGZTEGbFYzH1F9KZPMtRT6oYyqJkZGLWaiq3de5IcTpCsvt1E9p06rA5q1bGtClloDe5ElhE_ssXL1Yp852_nG5FvHuQlBi9Qxob0kURtRZZokzisxTC8fmyQ6wHhpT6BztyASlIV-wpmDWgNhIrgA8CldYXlFB9CX6VqdHVkY5vrm_enGbq0xbJ6f4s3Fy3_8o8TxCdEHljEuoOq-eK9WNIY_9&sig=Cg0ArKJSzLdnXeIbvy0wEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20220817.79208&adurl=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AWuSm9p5QFUvoq-KQ6HUNAdg0iBdVnbIcg9ZEfJ4tIgOHAbDSDGFbLLi0fuBk5hjt7-irK0avD-wrVoQBemBVyxZCOSQ&cry=1&dbm_d=AKAmf-CFllxGSG6MroSkKfJbtLuKU1uFN7OkxPW2J_XRpKon8pMeFKRg_kzdp_PWZL3kn2GFBeRHuGk9jSE8KoWm9KS5Gkomyzn17VNjmnIh9zhwW2UMDf33XB3EJiLlUbBFHnFYoa1MQpGhgZ-hsXIjO9b9mjMCemuBKDU-unXDmRg4H0tvPmX3CXhG-Jy9PX2bqKz8E9x7iGxJ35NY9-l-CX5h0nDL5GOdAdyoYbguXz00dSNF1-ao8Bf8ZrlXlcUFxQ9TpbymxuDYNK6ycR6dPJqn9Cs2OHLEADGfyuaV7BG3A22K4VyPK17_uybs0d6-c_pJD41OLWc3Ucwcq6t-1Ze6ikKzkK_gJzrpKpnT3aX_OO5lVMsXc8bQ2oRg0zwUdVPEJDwRWboyqEyRGSgBwp4fFtw8RUetEIbNRLHdoCRJNGEdf7JW5iCTPl4MZeJTMsSGYGHzoDKApogOM6oUnWTB8XLHElwMsTCo2KQtWc5SlEbAbKT1e9bKpg4DXP8hAzCsYtAi8dY8SATmDf_Akbmt9lOPRZg8wlahsMIBA0ief67XpZwYnPqAXhim2bGCc0NBLnB9xTV5sEwhReN1UkvJT6YAifHBvyrkG-zofgUN134u1c7y91Ht_x8LzwtPC9aIOzqy7FVmqe7XCst4CpMhFjvMeneoeOQGDB96u_eFcqgmrLJ1UxnxwWELiqqqEvrMV4qXUkjuVEqzN0s_WxO1s3dyWvM4lYu8CasPBj3p2mV4YlcAK__J3drMRU1L7w2y9JPGe-F0FqgPlud-knAhuzqj1N6Qe_R6aPTj1zIM7SqH8YWw61VKML6J7rNi0c-UfNO5CZyPe_LFI2T27QvrfMuBtWUKmXFrDpgPjRQvxPNu3ZlkW6qOgP3-5Po_uV8VtTG8HOPerVvqOBzaMHoQ1rA4LRUCNCPuq61LsSVnh50wYPqsXdDSDsL81ur5I5G4ecLGtheMlTvvewg_7PSEyIE2cATCa03Tat_Lm0PkR-Reeym4aqSa4pEuDA5F7HVt0VX8JQxTcRCoTZ2IW6l1TGaUqY5APk9sBHGNEuJcw4bzp4mfShl9W0-7Q01qUVSNGp6ajOdkmt6XhJGZtBwBdIe6RoD6O8QMCotvkr1pm-6MkjkWU8kyNBBNnZnCNJZDuVAxnRBg80B5eQHZt25E8QN4biCaGJUtkfD-iKHQlmWhK1mpyV8GjqWoAw5Ew1oT1a7XMD0oWuaGe_K6lwpXVQC6hFsTmjiHJLb0EzGpdokezQww6NQ0p4hYK7_r30z_BY1ph5JJiEZkHI2e6oz_p96Zk3x6-XrFE-cWj85rLmsHiv2VBSCIFtZ7J_47-DPGRgh-4oSSuzhGgln1Knl8Ny95SXlIoiQtjiFeI1Cz2Y4mOU5414itao71PdEkid1mmdXyWghFnUFo7_cVJ7Um9qh-CDXpmMHDEMGOGdOSKXXRkiX-qxrWiSNy0y-fVrNcrsQq1DAPhnp1pyAngoI8K4rQV4ur6LjkZrzi7Emdxi5juOKtpXfsjmE8Dqh9EBpbOrlq3DM90Jo-9RY0Ch0oo4CkPKKOIgGFN3tkJIRpRIgeYHtQu-Q4RA6bdDH__F0oMfStTsQZFLUmlucGtlsCcjIjY9HBGgNizypvOt0vkbRFtIRq07-yQuq94mk_uuED4ReHuolZcmrQ5Gr0Jv5fKfW__LOWDFeSD4-AOHLR2ScICb3VXuaVbCGH371m_9raCsViSghQ_ej3-RkBwdcgBSWEasHII_JTm638pSKq7B1qvndWVKhEF9aG1uTEYKp_PCe3Ta-zGWtz2XVfYhhK7hkL1Pz2Ftjg5MOtvqp7V2IyNu7Uc62jhgScAkSJggWpan9tWu6W4BAjSreoMNdtHBqdPurWjUmPZgVe6_lclgeaxwqc00h105UhUSduB3vmRe-tsqlejvp5dPbykIpia76YYWctIzypQCTrTqGizgLvalLS4wemKXs7kUZ_Ip8RsLjl4_FZCoLQxgRS29GQTTU6JStrNrPc_8ngaLIoE3SZ8_3hF5M0VeQ4ZX6cBZPYDQltOKe6Wl9AdT7AuGnQy2SB8F8BI16cmLUe5Ok0prTP3pnaE2vjSyqTb2Wtzh1QmhESayE5Rcnry8vKr6v0QrUyo4h9Q92BB9HbUwEBkXs-G8t1HRKV0cbdSqYLPLG7LVRGjhY-BAWT-w1uP5gfkC_vjai8Qi7zmPQKzfkElP9GPs3CAP-_SCtcBd26D-e2U6cnnONTDptUESfHS0mhPe98ymh3vrKnTfILiKbfngflD4eRyehUivez6pD6S-ZJ1WNTyhGiTTI4cqkHUiHOLWyRI8j3FXVRuKwaWSSKC4xcDRsgIO6IO1GV00XXcrvKEaFS84IXNC02axuR2vmWA8S0EmfvO4BojTnOg-_Q8vnLpPemrECzvzmCE8-sWM4a3MDFI88ZAXEAMzQRXIoBP2-RoduYDX_YcfYVwDsGRonZCvd9U5_JVCReDpUd_4EDCPF7VOSnqBHKVqiMvzXg_0HWLMipd2yltXUjqzkCLXvoJ6rToWNkVmEQP-w4gCbAS237_FBVpYKnQSLakay_8ZxSQeQWoHTrJznRV9-MkbHPWkMDxmMgKYHFwwUm095ZFxdZQG8YDAtaEZgggrwo3KCLEatKn0Q_X38e2SaHCy5L7WoZCcZaV2gyv1MEFBubnBVC_5AJ2WrGwDl8yCevcKorGAab8KFlqtzNToRFSz9R94xOPqMbMY9kvNeopOku47LeGw0NwTgSIpk5ULuihVSNb2APbqKa0U995VNW_vd3Dw0OrLIf158vsAYnhc-qU8la3VGRWmW5oS2qjMjAA6sMJ6odufdKMztpqqY2jfw0HPJ87PEkcotNN_dxBqNYoFnANkiM_nx3HwRotr_ogIkNVWss5QbSAydDql10mTtOjK09lC-brTnkuyniTm5l1e_nPmAagXl3o-H5-8jBDV9Kru0p_IzwQTZIrdkNBO1jYdg9_YGH_YD7r6A_xY9xvvzC3EP-yjsfHtpaOtNz47XrhnUR3PL7gOaC3paxxFAhnTs5I1gex42t6pr9F-Fr86aJ6lGHEkLhZKJYod-p0XX6Pl7Zi0lDuT5DlrTWrrCaxaPS0amG0d0-VfO0WJdoi7EYpuwCaROA2jjECFo-Dz-xSdMoikCBRg3HZzjBTRAIfokUFcZabiVfrGV6kHqPufFjKaBElBfMbjcCWUXWnYiOPg&cid=CAASJeRoyDe_aVWwzoBucnqKLSrtFhTN1Zu54tNcnb49YzsChqqxdDI&rfl=1%2Chttps%253A%252F%252Fwork.ink%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Sat, 20 Aug 2022 21:53:19 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 536D 41 KB
15 KB 20ms
20ms Script
text/javascript 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Fri, 19 Aug 2022 08:01:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 136322
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 19 Aug 2023 08:01:17 GMT

GET
H2 200 beacon
tag.researchnow.com/t/ Frame 536D 42 B
442 B 56ms
21ms Image
image/gif 52.85.61.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tag.researchnow.com/t/beacon?pr=287288&adn=3&ca=28080344&si=2400725&pl=342915005&cr=175972678&did=ADID&ord=3310537509&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
Requested by: Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.61.63 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-61-63.ewr53.r.cloudfront.net
Software: Apache/2.4.54 () / PHP/7.2.34
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 20:59:06 GMT
via: 1.1 6a2d00c5c73022efc4bc2786f44b3cdc.cloudfront.net (CloudFront)
server: Apache/2.4.54 ()
age: 3253
x-powered-by: PHP/7.2.34
x-cache: Hit from cloudfront
p3p: CP='NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM'
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
x-amz-cf-pop: EWR53-P1
content-type: image/gif
content-length: 42
x-amz-cf-id: qWLK2mt_oeMvsFlKDGeJrF2y7uWBDCrPjtDkxt8FATkywMG713X14g==
expires: 0

GET
H/1.1 200
OK adServerESI.aspx
secure.insightexpressai.com/adServer/ Frame 536D 35 B
2 KB 98ms
58ms Image
image/gif 2600:1400:d:59b::1ec4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.insightexpressai.com/adServer/adServerESI.aspx?script=false&bannerID=10641154&siteID=N4478.1355339GOOGLE.COMDDMBIDMAN&creativeID=175972678&placementID=342915005&rnd=3310537509&gdpr=0&gdpr_consent=&redir=https://secure.insightexpressai.com/adserver/1pixel.gif

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1400:d:59b::1ec4 New York, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

22816a00dfe9fcdc30063d22717ab9cbab3aeb2a8e9844e9d774d256dc48b7c8

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOWALL
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
P3P: CP="NOI DSP COR NID CUR ADMa OUR STP STA"
Connection: keep-alive
Content-Length: 35
X-XSS-Protection: 1; mode=block
Request-Context: appId=cid-v1:5b4dbfaf-2d3f-4217-81a4-dbc3623f316f
Pragma: no-cache
Referrer-Policy: unsafe-url
X-Frame-Options: ALLOWALL
Date: Sat, 20 Aug 2022 21:53:19 GMT
Vary: Accept-Encoding
Content-Type: image/gif
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Request-Context
Cache-Control: max-age=0, no-cache
Feature-Policy: accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'none'
Expires: Sat, 20 Aug 2022 21:53:19 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 2D84 1 KB
749 B 20ms
19ms Document
text/html 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 13454
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 20 Aug 2022 18:09:05 GMT
etag: 48472445140208031
expires: Sun, 21 Aug 2022 18:09:05 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 003D 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a2e3f2ea1d5587e9582816f24285269be4ff1863861dcf7ef18164e0df702b63

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 3392 22 KB
8 KB 21ms
20ms Document
text/html 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 63243
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 20 Aug 2022 04:19:16 GMT
expires: Sun, 20 Aug 2023 04:19:16 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8A81 0
26 B 38ms
38ms Ping
image/gif 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 20 Aug 2022 21:53:19 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 536D 0
26 B 37ms
36ms Ping
image/gif 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 20 Aug 2022 21:53:19 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame D122 1 KB
749 B 20ms
19ms Document
text/html 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 13454
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 20 Aug 2022 18:09:05 GMT
etag: 48472445140208031
expires: Sun, 21 Aug 2022 18:09:05 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 3FCE 22 KB
8 KB 20ms
20ms Document
text/html 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 63243
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 20 Aug 2022 04:19:16 GMT
expires: Sun, 20 Aug 2023 04:19:16 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 634F 1 KB
749 B 20ms
19ms Document
text/html 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 13454
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 20 Aug 2022 18:09:05 GMT
etag: 48472445140208031
expires: Sun, 21 Aug 2022 18:09:05 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 8A81 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6efccb3559e47c628d4c107a0ca0bcd84e0b3410e2823d55ce464e3b41b23b40

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 536D 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: edbff1a0210cdc29158399e2566148bb5fdd69feae2894794c391555e2a12839

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2D84
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESELutKwNAGJX_8qMOeW1PXg4&google_cver=1&google_push=AehlK4ACKqKhgbTckN0KeF5xUrrywBIz56gEOeSSfq3lw6bkEZcguoSCTH3St2YrUdBHqvoFqIqt8hM7EKcniyyB...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AehlK4ACKqKhgbTckN0KeF5xUrrywBIz56gEOeSSfq3lw6bkEZcguoSCTH3St2YrUdBHqvoFqIqt8hM7EKcniyyBXKedV8BWHMMOeQ

170 B
188 B

36ms
35ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AehlK4ACKqKhgbTckN0KeF5xUrrywBIz56gEOeSSfq3lw6bkEZcguoSCTH3St2YrUdBHqvoFqIqt8hM7EKcniyyBXKedV8BWHMMOeQ

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Sat, 20 Aug 2022 21:53:19 GMT
Server: MT3 4494 7cf1da7 master iad-pixel-x13 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AehlK4ACKqKhgbTckN0KeF5xUrrywBIz56gEOeSSfq3lw6bkEZcguoSCTH3St2YrUdBHqvoFqIqt8hM7EKcniyyBXKedV8BWHMMOeQ
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Sat, 20 Aug 2022 21:53:18 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2D84
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEHLmNMYIFJz5g0PBxbtw19o&google_push=AehlK4CrP-tJgfcmxj7xpJ_sIiE_iBMz7coX89G5CTiV-no9ZKqUQvZvbn...

170 B
188 B

36ms
36ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEHLmNMYIFJz5g0PBxbtw19o&google_push=AehlK4CrP-tJgfcmxj7xpJ_sIiE_iBMz7coX89G5CTiV-no9ZKqUQvZvbnlGciRVaadQX6qEGzfwRxHA_RXWlkT_P56FGrBs7pyZ-g

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1661032400.582498,VS0,VE15
x-served-by: cache-yul12829-YUL
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEHLmNMYIFJz5g0PBxbtw19o&google_push=AehlK4CrP-tJgfcmxj7xpJ_sIiE_iBMz7coX89G5CTiV-no9ZKqUQvZvbnlGciRVaadQX6qEGzfwRxHA_RXWlkT_P56FGrBs7pyZ-g
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2D84
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEHrduZiwvAdRn0gEI8eC_lc&google_cver=1&google_push=AehlK4A2MT5SHKVY9ZZMUTSVwDaCzWio8uqJS6kUoadC7zcOxFMO1kni4BqOg15kfReHxyKYXprG0PelGGT2ZZ5dv2q1ey-zJLpLMQ
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=28B3CDCBC30449059D28FA29E56CFAC6&google_push=AehlK4A2MT5SHKVY9ZZMUTSVwDaCzWio8uqJS6kUoadC7zcOxFMO1kni4BqOg15kfReHxyKYXprG0PelGGT2ZZ5...

170 B
188 B

66ms
65ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=28B3CDCBC30449059D28FA29E56CFAC6&google_push=AehlK4A2MT5SHKVY9ZZMUTSVwDaCzWio8uqJS6kUoadC7zcOxFMO1kni4BqOg15kfReHxyKYXprG0PelGGT2ZZ5dv2q1ey-zJLpLMQ

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 20 Aug 2022 21:53:19 GMT
x-content-type-options: nosniff
server: openresty
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=28B3CDCBC30449059D28FA29E56CFAC6&google_push=AehlK4A2MT5SHKVY9ZZMUTSVwDaCzWio8uqJS6kUoadC7zcOxFMO1kni4BqOg15kfReHxyKYXprG0PelGGT2ZZ5dv2q1ey-zJLpLMQ
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Fri, 19 Aug 2022 21:53:19 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2D84
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEKEo1l_WwMFPkMmeM4-Amgk&google_cver=1&google_push=AehlK4AqwX8WqVtTcZUKlv1XWrqcvTH6H02WKrCLRjpbcmaHYz_zNQwIQ60yUVF46KZu3cXcoBDGuuY...
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=8&google_gid=CAESEKEo1l_WwMFPkMmeM4-Amgk&google_cver=1&google_push=AehlK4AqwX8WqVtTcZUKlv1XWrqcvTH6H02WKrCLRjpbcmaHYz_zNQwIQ60yUVF46KZu3...
https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=D0xKILPZQNqy_A-NZ9dix2MBV88

170 B
188 B

51ms
51ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=D0xKILPZQNqy_A-NZ9dix2MBV88

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:18 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=D0xKILPZQNqy_A-NZ9dix2MBV88
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2D84
Redirect Chain

https://sync.extend.tv/r.gif?exchange=googleadx&google_gid=CAESECNbmd96NW7sgc7fOUCqgHI&google_cver=1&google_push=AehlK4BFtJz6vP4jrVZdLa3TDhSBytZfMCBFcjWCjhzczODXgIoKZu3QQNqj8P-OjqWECf0rtTdr_fHoBQrZ...
https://cm.g.doubleclick.net/pixel?google_nid=extendtv&google_push=AehlK4BFtJz6vP4jrVZdLa3TDhSBytZfMCBFcjWCjhzczODXgIoKZu3QQNqj8P-OjqWECf0rtTdr_fHoBQrZrR4nNq3Y1S2jeF4eCg

170 B
188 B

72ms
71ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=extendtv&google_push=AehlK4BFtJz6vP4jrVZdLa3TDhSBytZfMCBFcjWCjhzczODXgIoKZu3QQNqj8P-OjqWECf0rtTdr_fHoBQrZrR4nNq3Y1S2jeF4eCg

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 20 Aug 2022 21:53:19 GMT
Access-Control-Allow-Origin: *
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=extendtv&google_push=AehlK4BFtJz6vP4jrVZdLa3TDhSBytZfMCBFcjWCjhzczODXgIoKZu3QQNqj8P-OjqWECf0rtTdr_fHoBQrZrR4nNq3Y1S2jeF4eCg
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 196
Expires: Tue, 29 May 1984 15:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2D84
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=AiLlj7uJQZOByAD2XN0foA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

52ms
51ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=AiLlj7uJQZOByAD2XN0foA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AehlK4A6ID3quXHPWCJj35eoLIwyRPwHVq82AjY9jMKAkXCuL0QKuyZi1Mla2oBKBhj40-QmmTa84WtbNuIzI9_8KQyUDZ-zRRuoMg

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=AiLlj7uJQZOByAD2XN0foA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AehlK4A6ID3quXHPWCJj35eoLIwyRPwHVq82AjY9jMKAkXCuL0QKuyZi1Mla2oBKBhj40-QmmTa84WtbNuIzI9_8KQyUDZ-zRRuoMg
date: Sat, 20 Aug 2022 21:53:19 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2D84
Redirect Chain

https://rtb2-useast.e-volution.ai/sync?exchange=193&google_gid=CAESEDwB4sfVMV2CdEfke2y2T1E&google_cver=1&google_push=AehlK4DuvJIySgfIbS-biD64cvBRUqinMUd0U9B9jA_SuwxsIePNr8_BML7LpZ0Um5tbQY_FR0Ecj61E...
https://dsp.adkernel.com/adkuid?r=https%3A%2F%2Frtb2-useast.e-volution.ai%2Fsync%3Fexchange%3D193%26google_gid%3DCAESEDwB4sfVMV2CdEfke2y2T1E%26google_cver%3D1%26google_push%3DAehlK4DuvJIySgfIbS-biD...
https://rtb2-useast.e-volution.ai/sync?adkuid=A6476105000756181552&exchange=193&google_gid=CAESEDwB4sfVMV2CdEfke2y2T1E&google_cver=1&google_push=AehlK4DuvJIySgfIbS-biD64cvBRUqinMUd0U9B9jA_SuwxsIePN...
https://cm.g.doubleclick.net/pixel?google_nid=metup_srl_w_bidswitch&google_hm=QTY0NzYxMDUwMDA3NTYxODE1NTI&google_push=AehlK4DuvJIySgfIbS-biD64cvBRUqinMUd0U9B9jA_SuwxsIePNr8_BML7LpZ0Um5tbQY_FR0Ecj61...

170 B
188 B

51ms
38ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=metup_srl_w_bidswitch&google_hm=QTY0NzYxMDUwMDA3NTYxODE1NTI&google_push=AehlK4DuvJIySgfIbS-biD64cvBRUqinMUd0U9B9jA_SuwxsIePNr8_BML7LpZ0Um5tbQY_FR0Ecj61Eff1zRKYMgHVWXYTRU3krDA

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=metup_srl_w_bidswitch&google_hm=QTY0NzYxMDUwMDA3NTYxODE1NTI&google_push=AehlK4DuvJIySgfIbS-biD64cvBRUqinMUd0U9B9jA_SuwxsIePNr8_BML7LpZ0Um5tbQY_FR0Ecj61Eff1zRKYMgHVWXYTRU3krDA
Date: Sat, 20 Aug 2022 21:53:19 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 2D84 0
12 B 34ms
33ms Image
text/html 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Ihiiv8vwQrAlpN_GINQ1k1Appb3h6TM_y1_3BlwYN0RS3OJWFVRqt8Xa34ozztPz49QDrTaw

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:19 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame DDFD 22 KB
8 KB 21ms
20ms Document
text/html 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: work.ink
URL: https://work.ink/en/l/1VA/ToxicModzZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 63243
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 20 Aug 2022 04:19:16 GMT
expires: Sun, 20 Aug 2023 04:19:16 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D122
Redirect Chain

https://px.owneriq.net/ecmg?google_gid=CAESEBfD-o1A9BdUkkd_8GEaqmI&google_cver=1&google_push=AehlK4BW5qMHtJb6y0m_HGf6GspGNJebkgkjZWJTJzqnIj1paIvKX17idOav3G3bVRgDM64Pg7QuFey2vSrimOIl2v2WKdKjZONA
https://px.owneriq.net/ecc?redir=https%3a%2f%2fcm.g.doubleclick.net%2fpixel%3fgoogle_nid%3downeriq1%26google_sc%26google_push%3dAehlK4BW5qMHtJb6y0m_HGf6GspGNJebkgkjZWJTJzqnIj1paIvKX17idOav3G3bVRgDM...
https://cm.g.doubleclick.net/pixel?google_nid=owneriq1&google_sc&google_push=AehlK4BW5qMHtJb6y0m_HGf6GspGNJebkgkjZWJTJzqnIj1paIvKX17idOav3G3bVRgDM64Pg7QuFey2vSrimOIl2v2WKdKjZONA&google_cver=1&googl...

170 B
188 B

38ms
36ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=owneriq1&google_sc&google_push=AehlK4BW5qMHtJb6y0m_HGf6GspGNJebkgkjZWJTJzqnIj1paIvKX17idOav3G3bVRgDM64Pg7QuFey2vSrimOIl2v2WKdKjZONA&google_cver=1&google_gid=CAESEBfD-o1A9BdUkkd_8GEaqmI&google_hm=UTcxNDMxODc5OTE5NTI5OTcyMjE=

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Sat, 20 Aug 2022 21:53:19 GMT
Server: Apache/2.4.6 (CentOS)
X-Powered-By: PHP/7.3.33
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://cm.g.doubleclick.net/pixel?google_nid=owneriq1&google_sc&google_push=AehlK4BW5qMHtJb6y0m_HGf6GspGNJebkgkjZWJTJzqnIj1paIvKX17idOav3G3bVRgDM64Pg7QuFey2vSrimOIl2v2WKdKjZONA&google_cver=1&google_gid=CAESEBfD-o1A9BdUkkd_8GEaqmI&google_hm=UTcxNDMxODc5OTE5NTI5OTcyMjE=
Cache-Control: max-age=20894
Connection: keep-alive
Content-Type: text/html
Content-Length: 154

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D122
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEHrduZiwvAdRn0gEI8eC_lc&google_cver=1&google_push=AehlK4CP7YZMwj9DPDbNLSl5IkjNdAO9OPAJtPP4oWniohsi_oLVx1ndsNRVhMa1MUs7yRJ0AnlhTOc29qj0Bxe-ogozsS2xoqc
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=31D6DD2260AC4E4E8F9BC9174146041F&google_push=AehlK4CP7YZMwj9DPDbNLSl5IkjNdAO9OPAJtPP4oWniohsi_oLVx1ndsNRVhMa1MUs7yRJ0AnlhTOc29qj0Bxe...

170 B
188 B

67ms
65ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=31D6DD2260AC4E4E8F9BC9174146041F&google_push=AehlK4CP7YZMwj9DPDbNLSl5IkjNdAO9OPAJtPP4oWniohsi_oLVx1ndsNRVhMa1MUs7yRJ0AnlhTOc29qj0Bxe-ogozsS2xoqc

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 20 Aug 2022 21:53:19 GMT
x-content-type-options: nosniff
server: openresty
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=31D6DD2260AC4E4E8F9BC9174146041F&google_push=AehlK4CP7YZMwj9DPDbNLSl5IkjNdAO9OPAJtPP4oWniohsi_oLVx1ndsNRVhMa1MUs7yRJ0AnlhTOc29qj0Bxe-ogozsS2xoqc
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Fri, 19 Aug 2022 21:53:19 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D122
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEOsMr538FQH3RD0-43LFTd0&google_cver=1&google_push=AehlK4Dh5xXG3t4etwvkTaN1GyJZ7NEB4VwywwuOm9o7MV-cFUUQCt0EZumQ4J3cnEC3HHehpiTTFEtBa6QnHt9...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=_xsoixhlRBlMfqOWdfENw5U4mb0&google_push=AehlK4Dh5xXG3t4etwvkTaN1GyJZ7NEB4VwywwuOm9o7MV-cFUUQCt0EZumQ4J3cnEC3HHehpiTTFEtBa6QnHt...

170 B
188 B

72ms
71ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=_xsoixhlRBlMfqOWdfENw5U4mb0&google_push=AehlK4Dh5xXG3t4etwvkTaN1GyJZ7NEB4VwywwuOm9o7MV-cFUUQCt0EZumQ4J3cnEC3HHehpiTTFEtBa6QnHt9j5bbHacrCoWI

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=_xsoixhlRBlMfqOWdfENw5U4mb0&google_push=AehlK4Dh5xXG3t4etwvkTaN1GyJZ7NEB4VwywwuOm9o7MV-cFUUQCt0EZumQ4J3cnEC3HHehpiTTFEtBa6QnHt9j5bbHacrCoWI
Date: Sat, 20 Aug 2022 21:53:19 GMT
Connection: keep-alive
Content-Length: 241
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D122
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESENhLvD5KHtKUx2a98PxlUXY&google_cver=1&google_push=AehlK4DExXx8J0mgGCiimyaVv_fFt_-jMX_RlENZUkZR9ZCe9bPehZi9xq2rZsYuzP3EEYq1PY1-StnyB9PzCOKdo...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AehlK4DExXx8J0mgGCiimyaVv_fFt_-jMX_RlENZUkZR9ZCe9bPehZi9xq2rZsYuzP3EEYq1PY1-StnyB9PzCOKdoOSCe-u6bfXp&google_hm=FLfheBZHWg4-NovDQZaHMoI1

170 B
188 B

38ms
38ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AehlK4DExXx8J0mgGCiimyaVv_fFt_-jMX_RlENZUkZR9ZCe9bPehZi9xq2rZsYuzP3EEYq1PY1-StnyB9PzCOKdoOSCe-u6bfXp&google_hm=FLfheBZHWg4-NovDQZaHMoI1

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Sat, 20 Aug 2022 21:53:19 GMT
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AehlK4DExXx8J0mgGCiimyaVv_fFt_-jMX_RlENZUkZR9ZCe9bPehZi9xq2rZsYuzP3EEYq1PY1-StnyB9PzCOKdoOSCe-u6bfXp&google_hm=FLfheBZHWg4-NovDQZaHMoI1
Access-Control-Allow-Credentials: true
Connection: close
X-Sovrn-Pod: ad_ap6ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D122
Redirect Chain

https://ads.yieldmo.com/exptsync?google_gid=CAESEPTPeUH1pDg8dtzIEEkZF2M&google_cver=1&google_push=AehlK4CKyriPPTfHyfh6pDiZYCchHLac0smmHDW5srl7ae9kZalbrdmRhjTeqSVqfAiLyBnKWxFoFQOTNPjfT7bVfHQKIyESz__n
https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AehlK4CKyriPPTfHyfh6pDiZYCchHLac0smmHDW5srl7ae9kZalbrdmRhjTeqSVqfAiLyBnKWxFoFQOTNPjfT7bVfHQKIyESz__n&google_hm=Z2ZmYWFlNGJiNDkzMWM2...

170 B
188 B

75ms
75ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AehlK4CKyriPPTfHyfh6pDiZYCchHLac0smmHDW5srl7ae9kZalbrdmRhjTeqSVqfAiLyBnKWxFoFQOTNPjfT7bVfHQKIyESz__n&google_hm=Z2ZmYWFlNGJiNDkzMWM2YTQ0MmQ=

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
location: https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AehlK4CKyriPPTfHyfh6pDiZYCchHLac0smmHDW5srl7ae9kZalbrdmRhjTeqSVqfAiLyBnKWxFoFQOTNPjfT7bVfHQKIyESz__n&google_hm=Z2ZmYWFlNGJiNDkzMWM2YTQ0MmQ=
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D122
Redirect Chain

https://cs.media.net/cksync?type=g&google_gid=CAESEA2qCejU2mjN591NrhqQP7k&google_cver=1&google_push=AehlK4Ds99XkHaqBtRJVW2KAjOyfN08UoQu1VWYXqxbAcDDS3ECl8J2CVSwxbCpAfDlSATwDrdEYYeaQExxb7umcGQSdVjjcIghP
https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MzA0MDMzOTk5MTQ1NTc4MjAwMFYxMA%3d%3d&mn_hm=MzA0MDMzOTk5MTQ1NTc4MjAwMFYxMA%3d%3d&google_sc=1&google_push=AehlK4Ds99XkHaqBtRJVW2KAjOyfN08...

170 B
188 B

44ms
43ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MzA0MDMzOTk5MTQ1NTc4MjAwMFYxMA%3d%3d&mn_hm=MzA0MDMzOTk5MTQ1NTc4MjAwMFYxMA%3d%3d&google_sc=1&google_push=AehlK4Ds99XkHaqBtRJVW2KAjOyfN08UoQu1VWYXqxbAcDDS3ECl8J2CVSwxbCpAfDlSATwDrdEYYeaQExxb7umcGQSdVjjcIghP&gdpr=&gdpr_consent=

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 20 Aug 2022 21:53:19 GMT
Server: Apache
P3P: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Location: https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MzA0MDMzOTk5MTQ1NTc4MjAwMFYxMA%3d%3d&mn_hm=MzA0MDMzOTk5MTQ1NTc4MjAwMFYxMA%3d%3d&google_sc=1&google_push=AehlK4Ds99XkHaqBtRJVW2KAjOyfN08UoQu1VWYXqxbAcDDS3ECl8J2CVSwxbCpAfDlSATwDrdEYYeaQExxb7umcGQSdVjjcIghP&gdpr=&gdpr_consent=
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html
Content-Length: 154
X-MNET-HL2: E
Expires: Sat, 20 Aug 2022 21:53:19 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D122
Redirect Chain

https://rtb2-useast.torchad.com/sync?exchange=309&google_gid=CAESEEp44Y4G1pYGFXreGrXGn7A&google_cver=1&google_push=AehlK4CFUCunOUKYUXj3gXhxUG6Y94LiZI-V_7kHBIZ6zxn7uPstOdXaMgo2gLNoNmSXptojreS2oNBmZF...
https://dsp.adkernel.com/adkuid?r=https%3A%2F%2Frtb2-useast.torchad.com%2Fsync%3Fexchange%3D309%26google_gid%3DCAESEEp44Y4G1pYGFXreGrXGn7A%26google_cver%3D1%26google_push%3DAehlK4CFUCunOUKYUXj3gXhx...
https://rtb2-useast.torchad.com/sync?adkuid=A5713747766938781350&exchange=309&google_gid=CAESEEp44Y4G1pYGFXreGrXGn7A&google_cver=1&google_push=AehlK4CFUCunOUKYUXj3gXhxUG6Y94LiZI-V_7kHBIZ6zxn7uPstOd...
https://cm.g.doubleclick.net/pixel?google_nid=unmatched_solutions_ltd&google_hm=QTU3MTM3NDc3NjY5Mzg3ODEzNTA&google_push=AehlK4CFUCunOUKYUXj3gXhxUG6Y94LiZI-V_7kHBIZ6zxn7uPstOdXaMgo2gLNoNmSXptojreS2o...

170 B
188 B

49ms
36ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=unmatched_solutions_ltd&google_hm=QTU3MTM3NDc3NjY5Mzg3ODEzNTA&google_push=AehlK4CFUCunOUKYUXj3gXhxUG6Y94LiZI-V_7kHBIZ6zxn7uPstOdXaMgo2gLNoNmSXptojreS2oNBmZF0NMoP7wftAc_SOUZQ8

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=unmatched_solutions_ltd&google_hm=QTU3MTM3NDc3NjY5Mzg3ODEzNTA&google_push=AehlK4CFUCunOUKYUXj3gXhxUG6Y94LiZI-V_7kHBIZ6zxn7uPstOdXaMgo2gLNoNmSXptojreS2oNBmZF0NMoP7wftAc_SOUZQ8
Date: Sat, 20 Aug 2022 21:53:19 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame D122 0
12 B 34ms
33ms Image
text/html 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JteAP15SY_33C1LyAtmc-J5x4LccCJdMp5g2uuj6MXEoB5Yi-CfYtTmqqREVBbQxAZLIQN

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:19 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 hd9qiIGAqjescZkeItwy2wgAtCffeqilIyGkY3Q_MTc.js Show response
pagead2.googlesyndication.com/bg/ Frame 3392 36 KB
14 KB 20ms
20ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/hd9qiIGAqjescZkeItwy2wgAtCffeqilIyGkY3Q_MTc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

85df6a888180aa37ac71991e22dc32db0800b427df7aa8a52321a463743f3137

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 16 Aug 2022 14:56:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 370606
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14041
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 08:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 16 Aug 2023 14:56:33 GMT

GET /
google2waycm.netmng.com/cm/ Frame 634F 0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 634F
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEKCpZGKbGsTByOkv8luWdLo&google_cver=1&google_push=AehlK4CIiJxbroEII_AV9GoM0dOamTug8hIjNb1aUR6yXiAnNixFKxxBnibRcQ5oivvTGC6AZ1x1nOKSJ3OJSQoLUgnwJs2w_w
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AehlK4CIiJxbroEII_AV9GoM0dOamTug8hIjNb1aUR6yXiAnNixFKxxBnibRcQ5oivvTGC6AZ1x1nOKSJ3OJSQoLUgnwJs2w_w&google_hm=NzEyODYyNDc2NzUxNTQxODA5...

170 B
188 B

36ms
35ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AehlK4CIiJxbroEII_AV9GoM0dOamTug8hIjNb1aUR6yXiAnNixFKxxBnibRcQ5oivvTGC6AZ1x1nOKSJ3OJSQoLUgnwJs2w_w&google_hm=NzEyODYyNDc2NzUxNTQxODA5Mw%3D%3D

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 20 Aug 2022 21:53:19 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AehlK4CIiJxbroEII_AV9GoM0dOamTug8hIjNb1aUR6yXiAnNixFKxxBnibRcQ5oivvTGC6AZ1x1nOKSJ3OJSQoLUgnwJs2w_w&google_hm=NzEyODYyNDc2NzUxNTQxODA5Mw%3D%3D
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H3 200 dot.gif
s0.2mdn.net/ Frame 634F 43 B
71 B 36ms
33ms Image
image/gif 2607:f8b0:4006:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dot.gif?google_gid=CAESEKgnjSA0gVWW63JAyD7kLtA&google_cver=1&google_push=AehlK4DBbkW437yqwmJemXdTXX_i33zs1zretYQxtu_lBxMcQsiSNHiOLqhZ0Bmxti_sWsevW-4m15a9Ou1ZQ0Z3pYLddW07mvE

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2006 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:19 GMT
x-content-type-options: nosniff
last-modified: Sun, 01 Feb 2009 08:00:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 21 Aug 2022 21:53:19 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 634F
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=tTtyInXMSZK_AQfHDi5sOw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

52ms
51ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=tTtyInXMSZK_AQfHDi5sOw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AehlK4A4PPhl6Fc4f9lHkLUI8IbPHR1HIgNu3UTSkTMVBspuChMvdaHpOExq3CyxN0up0EsYaUGgtkTCgiz4k-wUfXgDQQ4o1Q

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=tTtyInXMSZK_AQfHDi5sOw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AehlK4A4PPhl6Fc4f9lHkLUI8IbPHR1HIgNu3UTSkTMVBspuChMvdaHpOExq3CyxN0up0EsYaUGgtkTCgiz4k-wUfXgDQQ4o1Q
date: Sat, 20 Aug 2022 21:53:18 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 634F
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEFm45KZuO_al8FHyZ9Tf63k&google_cver=1&google_push=AehlK4CctsxWKbyvYKZxe6DEcoxVpoYW031OjFNqyFlbXHCwsPEs-coUcs6mHy6U6JwBW33-4oo...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDcyRlNZNlctMUstRVRGWA==&google_push=AehlK4CctsxWKbyvYKZxe6DEcoxVpoYW031OjFNqyFlbXHCwsPEs-coUcs6mHy6U6JwBW33-4ooY8Aim0wACj2MVNFzZRIH7WNE

170 B
188 B

62ms
61ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDcyRlNZNlctMUstRVRGWA==&google_push=AehlK4CctsxWKbyvYKZxe6DEcoxVpoYW031OjFNqyFlbXHCwsPEs-coUcs6mHy6U6JwBW33-4ooY8Aim0wACj2MVNFzZRIH7WNE

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDcyRlNZNlctMUstRVRGWA==&google_push=AehlK4CctsxWKbyvYKZxe6DEcoxVpoYW031OjFNqyFlbXHCwsPEs-coUcs6mHy6U6JwBW33-4ooY8Aim0wACj2MVNFzZRIH7WNE
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: bd0f62a3fbacfef6a33ae6abaf6daf37
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 634F
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEL...
https://sync.1rx.io/usersync2/rmpssp?sub=google&zcc=1&google_push=AehlK4CUAFGCCbnIahmhw_Ednonqw6yiAbVP8sV9I2P8pRmmRbuyJvd9yNwQ6tCIObuL5tAGHUbbnCdIlpb1uzVSTxrpXyzCtRY&redir=https%3A%2F%2Fcm.g.double...
https://sync.targeting.unrulymedia.com/csync/RX-edc74d43-63a3-4ba0-9440-abd2b59dd35f-005?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DAehlK4CUAFGCCbnIahmhw_Edn...
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AehlK4CUAFGCCbnIahmhw_Ednonqw6yiAbVP8sV9I2P8pRmmRbuyJvd9yNwQ6tCIObuL5tAGHUbbnCdIlpb1uzVSTxrpXyzCtRY&google_hm=Be3HTUNjo0uglECr0rWd018

170 B
188 B

44ms
43ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AehlK4CUAFGCCbnIahmhw_Ednonqw6yiAbVP8sV9I2P8pRmmRbuyJvd9yNwQ6tCIObuL5tAGHUbbnCdIlpb1uzVSTxrpXyzCtRY&google_hm=Be3HTUNjo0uglECr0rWd018

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AehlK4CUAFGCCbnIahmhw_Ednonqw6yiAbVP8sV9I2P8pRmmRbuyJvd9yNwQ6tCIObuL5tAGHUbbnCdIlpb1uzVSTxrpXyzCtRY&google_hm=Be3HTUNjo0uglECr0rWd018
Date: Sat, 20 Aug 2022 21:53:19 GMT
Connection: keep-alive
Content-Type: text/html
ETag: RXedc74d4363a34ba09440abd2b59dd35f005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

GET
H3 200 dot.gif
s0.2mdn.net/ Frame 634F 43 B
71 B 36ms
35ms Image
image/gif 2607:f8b0:4006:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dot.gif?google_gid=CAESEFWlg4CEH0gMmwDcBW8HpuA&google_cver=1&google_push=AehlK4CToCsmrp3wUXiBDR3Gr_h3Zig16wCk6FiCOCLp0zhSf6igrO5uN7v89el8AMSVa5DkDIGzC1vJW6b6_5wuSNdKxhZvchfX

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2006 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:19 GMT
x-content-type-options: nosniff
last-modified: Sun, 01 Feb 2009 08:00:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 21 Aug 2022 21:53:19 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 634F 0
12 B 36ms
34ms Image
text/html 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13I8UIei0W8oGkXvAr15IbCbzRqgwONBEY4WDg27ybQvGB3ytSPWCL7tKFMDvCHwNaOISbAhGg

Requested by

Host: 968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com
URL: https://968396be1f4ea4936d0016c01b4b3b34.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:19 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 hd9qiIGAqjescZkeItwy2wgAtCffeqilIyGkY3Q_MTc.js Show response
pagead2.googlesyndication.com/bg/ Frame 3FCE 36 KB
14 KB 21ms
19ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/hd9qiIGAqjescZkeItwy2wgAtCffeqilIyGkY3Q_MTc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

85df6a888180aa37ac71991e22dc32db0800b427df7aa8a52321a463743f3137

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 16 Aug 2022 14:56:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 370606
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14041
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 08:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 16 Aug 2023 14:56:33 GMT

GET
H3 200 hd9qiIGAqjescZkeItwy2wgAtCffeqilIyGkY3Q_MTc.js Show response
pagead2.googlesyndication.com/bg/ Frame DDFD 36 KB
14 KB 20ms
19ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/hd9qiIGAqjescZkeItwy2wgAtCffeqilIyGkY3Q_MTc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

85df6a888180aa37ac71991e22dc32db0800b427df7aa8a52321a463743f3137

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 16 Aug 2022 14:56:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 370606
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14041
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 08:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 16 Aug 2023 14:56:33 GMT

GET
H2 200 sync.html Show response
public.servenobid.com/ Frame 4C9C 9 KB
4 KB 284ms
23ms Document
text/html 99.84.37.98

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html?usp_consent=1---
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.37.98 -, , ASN (),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7efdca1ce8a8ee4fb50887d9f88bdace1026e0f76ea1e64a802b97402d825a79

Request headers

Referer: https://work.ink/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 60662
cache-control: max-age=86400
content-encoding: br
content-type: text/html
date: Sat, 20 Aug 2022 05:02:18 GMT
etag: W/"3b058e9cd661ca6990301a82cf5d448f"
last-modified: Wed, 17 Aug 2022 23:23:08 GMT
server: AmazonS3
vary: Accept-Encoding Origin
via: 1.1 ef83386f79c9e19f4894237e9cf67dd2.cloudfront.net (CloudFront)
x-amz-cf-id: WcQchJsHcrz-ZcqDJLDw6UTzTVaciEA2uEDLq4N8H-8QBLmaHJHZ_g==
x-amz-cf-pop: EWR52-C4
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:us-east-1:559734745816:build/adserver-public-prod:049b4e88-3480-44ce-bc71-9207efe847a1
x-amz-meta-codebuild-content-md5: 77e8f986028c7819a018b65a51e4d1c5
x-amz-meta-codebuild-content-sha256: 4cf0411e60b9185dacd3ae0196e3adabe45eed1b64ea27e89ed58c43c33d4297
x-cache: Hit from cloudfront

GET
H2

200

sync Show response
eb2.3lift.com/ Frame FD39
Redirect Chain

https://eb2.3lift.com/sync?us_privacy=1---&
https://eb2.3lift.com/sync?us_privacy=1---&&ld=1

1 KB
1022 B

27ms
25ms

Document
text/html

35.71.139.29

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?us_privacy=1---&&ld=1
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.139.29 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cc3a7ec5a8efc872cd9a38919bba304757bd5fda59621603c373b2fabae5c901

Request headers

Referer: https://work.ink/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-length: 455
content-type: text/html; charset=utf-8
date: Sat, 20 Aug 2022 21:53:19 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Sat, 20 Aug 2022 21:53:19 GMT
location: /sync?us_privacy=1---&&ld=1
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 9B20 2 KB
814 B 12ms
12ms Document
text/html 51.222.239.232
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1661032395502&gdpr=0&us_privacy=1---

Requested by

Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.239.232 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://work.ink/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 0FD0 34 KB
11 KB 302ms
43ms Document
text/html 23.41.168.23

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUT8W5DX&prvid=2034%2C2033%2C2031%2C2030%2C173%2C251%2C175%2C157%2C2028%2C3018%2C2027%2C3017%2C159%2C2026%2C214%2C3016%2C336%2C117%2C337%2C338%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C201%2C3007%2C246%2C4%2C126%2C203%2C226%2C10000%2C80%2C108%2C9%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---

Requested by

Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.41.168.23 -, , ASN (),

Reverse DNS

Software

Apache /

Resource Hash

0794c78fcdc9114a3ac6c06ad4074bf2b38b6d0efc4c59dc29767ec9074d95d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://work.ink/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 11442
content-type: text/html; charset=UTF-8
date: Sat, 20 Aug 2022 21:53:19 GMT
expires: Mon, 22 Aug 2022 21:53:19 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 200 apacdex Show response
sync.quantumdex.io/usersync/ Frame 5850 3 KB
1 KB 69ms
57ms Document
text/html 2606:4700:10::6816:2460
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.quantumdex.io/usersync/apacdex
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:2460 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b648e979b761ab5181287e2cd85bfe6b5d862555fef8181568a10ce7a99987ce

Request headers

Referer: https://work.ink/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cf-cache-status: DYNAMIC
cf-ray: 73de5c721f8becea-YUL
content-encoding: gzip
content-type: text/html
date: Sat, 20 Aug 2022 21:53:19 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 6BB2 52 KB
17 KB 276ms
12ms Document
text/html 151.101.1.108

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.108 -, , ASN (),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://work.ink/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 61513
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Sat, 20 Aug 2022 21:53:19 GMT
ETag: W/"623de86a-cf34"
Expires: Wed, 03 Aug 2022 04:41:10 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 1, 224992
X-Served-By: cache-lga13628-LGA, cache-yul12821-YUL
X-Timer: S1661032400.944070,VS0,VE0

GET

/
de.tynt.com/deb/ Frame 5BB8
Redirect Chain

https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=dVQ06ADzGr6yooaKlId8sQ&gdpr_consent=undefined&us_privacy=1---&gdpr=0
https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dVQ06ADzGr6yooaKlId8sQ&gdpr_consent=undefined&us_privacy=1---&gdpr=0

0
0

GET
H/1.1 200
OK beacon Show response
ap.lijit.com/ Frame E172 2 KB
3 KB 94ms
19ms Document
text/html 63.251.114.137
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/beacon?us_privacy=1---&informer=12352498
Requested by: Host: cdn.thisiswaldo.com
URL: https://cdn.thisiswaldo.com/static/js/11929.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 63.251.114.137 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: 886540ed5e1909a879ab11a8bbf9a70b998dea3db2262d6cac8a5886e35e21a7

Request headers

Referer: https://work.ink/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Content-Length: 2213
Content-Type: text/html
Date: Sat, 20 Aug 2022 21:53:19 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
X-Sovrn-Pod: ad_ap6ewr1

GET
H2

204

yahoo
prebid.a-mo.net/setuid/
Redirect Chain

https://ups.analytics.yahoo.com/ups/58570/occ?gdpr=0&gdpr_consent=&uid=c8e5063d-f220-4bd7-8599-8de4599b8b43
https://prebid.a-mo.net/setuid/yahoo?uid=y-aK3LdY5E2uEiaBhvDKG33y3wgYM70kXMdxMvLDI-~A&gdpr=0&gdpr_consent=

0
147 B

33ms
19ms

Image
text/plain

145.40.88.5
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/yahoo?uid=y-aK3LdY5E2uEiaBhvDKG33y3wgYM70kXMdxMvLDI-~A&gdpr=0&gdpr_consent=
Protocol: H2
Server: 145.40.88.5 Secaucus, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:18 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://prebid.a-mo.net/setuid/yahoo?uid=y-aK3LdY5E2uEiaBhvDKG33y3wgYM70kXMdxMvLDI-~A&gdpr=0&gdpr_consent=
date: Sat, 20 Aug 2022 21:53:19 GMT
server: ATS/9.1.10.25
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET

sync
x.bidswitch.net/
Redirect Chain

https://x.bidswitch.net/sync?ssp=themediagrid&gdpr=0&us_privacy=1---
https://x.bidswitch.net/ul_cb/sync?ssp=themediagrid&gdpr=0&us_privacy=1---
https://sync.mathtag.com/sync/img?mt_exid=46&redir=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D80%26user_id%3D%5BUUID%5D%26expires%3D30%26ssp%3Dthemediagrid%26bsw_param%3D3fdb5a68-a229-4b52-940b-5a7526...
https://x.bidswitch.net/sync?dsp_id=80&user_id=44ba6301-57cf-4200-870a-ffd920e553ef&expires=30&ssp=themediagrid&bsw_param=3fdb5a68-a229-4b52-940b-5a7526eb3a31&gdpr=0&gdpr_consent=

0
0

GET
H2

204

magnite
prebid.a-mo.net/setuid/
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx&gdpr=0&gdpr_consent=&us_privacy=1---
https://prebid.a-mo.net/setuid/magnite?uid=L72FSY87-1P-4SQI&gdpr=0&us_privacy=1---

0
115 B

33ms
20ms

Image
text/plain

145.40.88.5
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/magnite?uid=L72FSY87-1P-4SQI&gdpr=0&us_privacy=1---
Protocol: H2
Server: 145.40.88.5 Secaucus, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:19 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
vary: Accept-Encoding

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://prebid.a-mo.net/setuid/magnite?uid=L72FSY87-1P-4SQI&gdpr=0&us_privacy=1---
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: bd0f62a3fbacfef6a33ae6abaf6daf37
Expires: 0

GET
H2

200

ImgSync
image8.pubmatic.com/AdServer/
Redirect Chain

https://prebid.a-mo.net/cchain?cb=https%3A%2F%2Fib.adnxs.com%2Fprebid%2Fsetuid%3Fbidder%3Damx%26uid%3Dc8e5063d-f220-4bd7-8599-8de4599b8b43&gdpr=0&gdpr_consent=&us_privacy=1---
https://image8.pubmatic.com/AdServer/ImgSync?p=158355&gdpr=1&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D158355%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fprebid.a-mo....

0
42 B

257ms
20ms

Image
text/plain

162.248.18.11

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?p=158355&gdpr=1&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D158355%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fprebid.a-mo.net%252Fcchain%252F0%252F409%253Fgdpr%253D0%2526gdpr_consent%253D%2526us_privacy%253D1---%2526A%253Dc8e5063d-f220-4bd7-8599-8de4599b8b43%2526bidder%253Dpubmatic%2526cbx%253DaHR0cHM6Ly9pYi5hZG54cy5jb20vcHJlYmlkL3NldHVpZD9iaWRkZXI9YW14JnVpZD1jOGU1MDYzZC1mMjIwLTRiZDctODU5OS04ZGU0NTk5YjhiNDM%25253D%2526uid%253D%2523PMUID
Protocol: H2
Server: 162.248.18.11 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://work.ink/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:19 GMT
content-length: 0

Redirect headers

location: https://image8.pubmatic.com/AdServer/ImgSync?p=158355&gdpr=1&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D158355%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fprebid.a-mo.net%252Fcchain%252F0%252F409%253Fgdpr%253D0%2526gdpr_consent%253D%2526us_privacy%253D1---%2526A%253Dc8e5063d-f220-4bd7-8599-8de4599b8b43%2526bidder%253Dpubmatic%2526cbx%253DaHR0cHM6Ly9pYi5hZG54cy5jb20vcHJlYmlkL3NldHVpZD9iaWRkZXI9YW14JnVpZD1jOGU1MDYzZC1mMjIwLTRiZDctODU5OS04ZGU0NTk5YjhiNDM%25253D%2526uid%253D%2523PMUID
date: Sat, 20 Aug 2022 21:53:19 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
content-length: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3FCE 0
20 B 49ms
49ms Image
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B6NVTz1cBY5vIDc65NZ3SpRAAAAAAOAHgBAI&bg=!uLulu__NAAYUOm8VNDo7ACkAdvg8WirjTwrhHt8EWGi448nkde_-c_IEe8sGH-MtLfaPzzqJ76jJ2wIAAADzUgAAAAFoAQeZAygMgQ2B_t5LIPVVgytmmw9t1_ysdm7P7tbvcQz5QYTZBN60ub5JAiJKGa0beTHCCNyoFwtQ5x1nx31KtjEvAay2Vc3bipK7FlNoKml1SwceeCYxLtCYn9r-IWXwtTwRoWYZ2fuNQhYbKNwBoQFMnpyuaqFT3RjJXsaEbosovYsBuiVEnWXXIuqNcHxeqME8YfXLC4hAoPiSplf5QFs1aWBNXt3yzR4Is85-Nr_pkgR0CW-rSytccHP-xQqFb1ZwKiV-ttqMDxps35QMGX9oDLOEgvhS0y13454JunNv7PmafAFoSEOp9H_S_Lu5mXj3alYu-S_ldev-cDlS3aptHhryttkzHW4EnglDAkXVggsYDxzfuGGQjayPgHZSI7HIRaWriUWGmhKlgWc3OonXVJ2XI-zzhX0GwlG6IpxRV130E2tBx6xJrtAW6s_MlyPYO4qk6xcpIrOVschz0DZLoP6pGSc90GziC1JZxRaTsEagI1K_KowEMUMgbJ39seukp3cRIFqcW0NC1FQ8fIDMcDKy44oftumgJFnCReSeA8r4uHEj_kkzchwtxhergh_iSiu48YH8Sqt3VNECLQRQ5rBeRVw-aTzPWl57RCI_rO3n52klUHmNbjg5f2jsZ_SPx5aOBkubLP5BunZpGBz-XEZ1aQ6Brmz4_nDyEtJnD1JabyoScqL5bagvztqkrLQ4aJ8hl284VzScPm_39S9OgDcfJLGZnojXZj-iakN40968hKLG4b9BOMfKCekDUH4wtqTdkx3W2fBN2JvB8kLW0Zr4yKSvfVH3c6Mky0yQ_A8BqXKC_bHiyUbUTJqY5D4OJZAbxnwZiWwmNyvZ3O4xVW8M5Ol3_4R-NrzqUIQD7Zq83JeXGqCrjKO74CLksvq8eKrnjAN0avkizdKRVA-i8D96cdHtId4-msRmhJJLBOAmvLJEWg9LoebcdX2QFTBwfayZz-3v_f5gtoYm11J2QUmiPl1Ws8_dIg1qcX58ETixq29dh-DS1ruZSeIK9yTt47KSv2Pr3LP_K3-6yl2HzWGAQK7OuFaR3UyCCN7n1IQRZYJLFN_jA6jp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3392 0
20 B 50ms
50ms Image
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B4kpoz1cBY4PWCsySoPwPyei64A4AAAAAOAHgBAI&bg=!oKOlo-fNAAYUOm8VNDo7ACkAdvg8Wq7wzwiEkWiZs0GOA8aw8t9ah-JGokscozjwKFO942ABRWoJBgIAAAEKUgAAAAJoAQeZAx1S2TX02qUf56DjZlHIezzgSzzKWwN5xUHRR1HHTb2h6drIOBgbVmoTgLMhOM6jpreqBUVSNVh6_FUORwdgmAgacyxxUZYaihSkHpHNodqAGErDN4FN0TrMg4Bi1LGzpsGlz7gQUIErvAYo1zL4OjWNlQFM0L1YXWW9LHbIBWgtco4JKKcaOmcr-2EouaiT9rAt64X-8FbHNNQi_ZRFe-RdoVNSnpP3OTHy2iUG1_m3V0WZOGGfIRoCIeoAyoL3xwb0cb4s5hmIwowPqclUvlbsnCfSW0trNNylRF6GG9nm9VT84VRhHmpNnIVaDzBltdB0CCNDKvDD0mtIB18sZ1Kmx8CbiO7EG-phgz7pDvDPd-dAUnAodD0u6692Biop4-y2DGSd3aRCVlN17PoxoPqeUSamc0GGgKHN8SKG2_CU-fQr3D5nj7Xes__TD8TtpDVOQa-rprTGRqgPBHtMMynvnFr-SbeOOFtJdIxZ41B0Ob9dYkEc1V8bPnyvoJG05v29dFlQ-4KoufSqGQY1buh-xRh3ddiJsonnfvPA9hvp5ptxUq5tMyzb1eg70oy41zyAeVN25-Eja-RgBvSDkTVD-1NeORCMwxJ6n0s4U3lNHuiJW1MaJqM1uDDv9vb4btitXcMM-2_MjDLEKI9rm4Qcd9XPeuVSca5CiJq_abGhBVuX9G-d6XgxNvyQtJW7fDrwfYzT-iFxzrxpNEzB8grjYg5seuQNdJnqXqvoBnmQji-xVJghHQiVq4_7fEJJ9eCU-SQyO4-L8rMn9ZciFC-Zjmx72H2eMeCAHrUGg-XjjhUabV3_LWIpCbkLgaiRhRGySaOp8ifWLgJn5y6wWyJOMO5Gl0ypudxJ3GaEnzuYyvAHXdHlb8wBtZfaaPXJHEjj1nNpTAhQ3RtbcnEtuWkeM8r_1kEOKOS5x7-lq4LiWR6mtaUzMX3m-silyRJ7-VdQhgxaOoWq4UFfzihvgTb5D4wKaXdmHK0qxcwH82bJU9jlBWUuQlwbTVkU5pRc6zoTTg_OXQ61UWgdwYjGcdvrywHKub5YIvkSvAd6tA

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DDFD 0
20 B 49ms
49ms Image
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B8lxyz1cBY6uBEI6UzgWskbTwAgAAAAA4AeAEAg&bg=!k5ClkNTNAAYUOm8VNDo7ACkAdvg8WsYVMM48UlDIwHr28LglXWK58nzNzZ2cICOUDRvGb5R1MY30ZQIAAADSUgAAAAJoAQeZAyykA7bW5g1WhRSUdgu-p6b1UNcynFb1qr5LpgnzZ4VZ-DMjODHtzjUnYUImD6aIjf26hN2n1z1jEDfQKebgx9xG9XBoWgOxt-qg5RrVKlPrMlrBVKR-oh8TzSahJuP0qfFVSbTc_WVTZubPivAbVxDj7Rx5BtSzI5Oc26Cl2euusc5KJFJNd1vw9HIXXWjxW4dkFbxgN3l0y1qmC8x5xJx3ptMmcw52nha4Tfbj06EK1nWBCMitJMtcVzUFr0xuBkR-7WtwO9-P8BedLX0LzVOuuxA4-HBRLrs5PbIdI_uARQe3JdzGBCaJYNzMUWTwcRJv0qbsoIt3L2vW5v_Bm0b8GK-Yf8d74U-clUmeGdT_8ggFDNjlyxtSad5OwQE-SQum5racpEA6rPRAhSB1BWeIsQq7t0kz2mX7B2WLQtotPAi1rl8Puzs21gGw2qM65GeQ58u3D9fdmVMXnLaUWc6ivEstaJ4Mx2ixd9s5TPlTgZztuRDZorbxgYmA9MAbVpUJAq6U-gR6uHpxqnP7OdvLTVc4hLfkGHqoTKSGMt1k8sJl65qmtPfO6skfiGxp8p7K7n307lYkreKGZQlmFhVFDBmWM0o9MJGIvclP4Dh-0ulqh43azEYrzDPQgrsBjLuFomI8y34woIQkRT4piQgpPHFIwmzVxpYjomsTIgIU0Sh02KyYi_bzz2IUjrYpdVfAegVmq_Ryhl4pFI_hMjWhg70h8H9rNds53CG3Bau6lKZmubsQRE0IN8dmtSGPpo8bTsMbAzTJHscoa3_r_eYcphIVhuFUkUHQqY1Ru4kEdEw1ewUpNyeldMdUv6zl2DWAfnfSNJ0BC3oClfgVLcq57XYAewddf7Zy7MyIND5MP23CCNgOjBCP67j7WOga3CUA1QgXh5EPicaHHRxZ7cUZm3l6y1oR6uGWyJ5owDRT36Ppmtz8wsHtNENtRlx5POVa9Z97_kpWYhEaFEu5JLuLkgFhA-iPllkvM1f-NVHTXnwNJ-wfgvQYpzMuVaEeF2qjzCs4yZ2Ln9aYy0ZsNraFwxBLBVPdnIEryPBNt7o6ZeNAYVmEqBJ_JbPjZw

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Perth Amboy, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET

setuid
sync.quantumdex.io/ Frame 5850
Redirect Chain

https://match.sharethrough.com/FGMrCMMc/v1?redirectUri=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dsharethrough%26uid%3D%24UID
https://sync.quantumdex.io/setuid?bidder=sharethrough&uid=c7e76996-fb27-45aa-932e-368eeac4fab5

0
0

GET
H2

200

setuid
sync.quantumdex.io/ Frame 5850
Redirect Chain

https://ups.analytics.yahoo.com/ups/58424/occ
https://sync.quantumdex.io/setuid?bidder=verizon-display&uid=y-aK3LdY5E2uEiaBhvDKG33y3wgYM70kXMdxMvLDI-~A

43 B
129 B

58ms
57ms

Image
image/gif

2606:4700:10::6816:2460
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=verizon-display&uid=y-aK3LdY5E2uEiaBhvDKG33y3wgYM70kXMdxMvLDI-~A
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/apacdex
Protocol: H2
Server: 2606:4700:10::6816:2460 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:20 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 73de5c73e927ecea-YUL
content-length: 43
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: image/gif

Redirect headers

location: https://sync.quantumdex.io/setuid?bidder=verizon-display&uid=y-aK3LdY5E2uEiaBhvDKG33y3wgYM70kXMdxMvLDI-~A
date: Sat, 20 Aug 2022 21:53:19 GMT
server: ATS/9.1.10.25
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

setuid
sync.quantumdex.io/ Frame 5850
Redirect Chain

https://s.ad.smaato.net/c/?adExInit=p&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dsmaato%26uid%3D%24UID
https://sync.quantumdex.io/setuid?bidder=smaato&uid=8f7b11f9

43 B
95 B

51ms
36ms

Image
image/gif

2606:4700:10::6816:2460
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=smaato&uid=8f7b11f9
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/apacdex
Protocol: H2
Server: 2606:4700:10::6816:2460 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:20 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 73de5c74fa0eecea-YUL
content-length: 43
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: image/gif

Redirect headers

date: Sat, 20 Aug 2022 21:53:20 GMT
via: 1.1 ae9634deb2e9d6f8d396fc6f1e0586fa.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: EWR53-P1
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://sync.quantumdex.io/setuid?bidder=smaato&uid=8f7b11f9
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: D3Lb3m8f7XOcedCClw40jO1NxwHBE4lwl9_hBUoDmZrYYlA4dZj58A==

GET
H2

200

setuid
sync.quantumdex.io/ Frame 5850
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dappnexus%26uid%3D%24UID
https://sync.quantumdex.io/setuid?bidder=appnexus&uid=8345552742478484192

43 B
95 B

39ms
31ms

Image
image/gif

2606:4700:10::6816:2460
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=appnexus&uid=8345552742478484192
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/apacdex
Protocol: H2
Server: 2606:4700:10::6816:2460 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:20 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 73de5c74597aecea-YUL
content-length: 43
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: image/gif

Redirect headers

Pragma: no-cache
Date: Sat, 20 Aug 2022 21:53:19 GMT
X-Proxy-Origin: 149.56.153.189; 149.56.153.189; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: b875c35c-5df1-4de3-9eeb-ff280142c4e5
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://sync.quantumdex.io/setuid?bidder=appnexus&uid=8345552742478484192
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET /
ssp.disqus.com/redirectuser/ Frame 5850 0
0

GET

setuid
sync.quantumdex.io/ Frame 5850
Redirect Chain

https://hbx.media.net/cksync.php?cs=1&type=pbs&ovsid=setstatuscode&bidder=medianet&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dmedianet%26uid%3D%3C...
https://sync.quantumdex.io/setuid?bidder=medianet&uid=3040339991455782000V10

0
0

GET
H2

200

setuid
sync.quantumdex.io/ Frame 5850
Redirect Chain

https://ap.lijit.com/pixel?redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dsovrn%26uid%3D%24UID
https://sync.quantumdex.io/setuid?bidder=sovrn&uid=FLfheBZHWg4-NovDQZaHMoI1

43 B
95 B

38ms
30ms

Image
image/gif

2606:4700:10::6816:2460
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=sovrn&uid=FLfheBZHWg4-NovDQZaHMoI1
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/apacdex
Protocol: H2
Server: 2606:4700:10::6816:2460 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:20 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 73de5c745979ecea-YUL
content-length: 43
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: image/gif

Redirect headers

Date: Sat, 20 Aug 2022 21:53:19 GMT
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://sync.quantumdex.io/setuid?bidder=sovrn&uid=FLfheBZHWg4-NovDQZaHMoI1
Access-Control-Allow-Credentials: true
Connection: close
X-Sovrn-Pod: ad_ap6ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

GET 0.gif
id5-sync.com/i/495/ Frame 5850 0
0

GET

setuid
sync.quantumdex.io/ Frame 5850
Redirect Chain

https://ads.betweendigital.com/match?bidder_id=43894&callback_url=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dbetween%26uid%3D%24%7BUSER_ID%7D
https://ads.betweendigital.com/match?bidder_id=43894&callback_url=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dbetween%26uid%3D%24%7BUSER_ID%7D&crf=1
https://sync.quantumdex.io/setuid?bidder=between&uid=d2608305-7589-53e9-9051-ee9cf350b94c

0
0

GET

iu3
s.amazon-adsystem.com/ Frame E172
Redirect Chain

https://s.amazon-adsystem.com/x/ae12848777b41970a5f2?gdpr=0&gdpr_consent=
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=sovrn&gdpr=0&gdpr_consent=&dcc=t

0
0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame E172
Redirect Chain

https://aorta.clickagy.com/pixel.gif?ch=185&cm=FLfheBZHWg4-NovDQZaHMoI1&redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D84%263pid%3D%7Bvisitor_id%7D&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=84&3pid=c:4a36d2d1c97a4286ba44157802242f42

43 B
1 KB

33ms
20ms

Image
image/gif

63.251.114.137
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=84&3pid=c:4a36d2d1c97a4286ba44157802242f42
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?us_privacy=1---&informer=12352498
Protocol: HTTP/1.1
Server: 63.251.114.137 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 20 Aug 2022 21:53:20 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap6ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

date: Sat, 20 Aug 2022 21:53:20 GMT
server: Aorta/20220801.70a5aba4
location: https://ce.lijit.com/merge?pid=84&3pid=c:4a36d2d1c97a4286ba44157802242f42
expect: 0
access-control-max-age: 31536000
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/plain
access-control-allow-origin
access-control-expose-headers: Set-Cookie
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-aorta-region: us-east-1
x-aorta-host: 6689142f609d
access-control-allow-headers: Origin,cache-control,content-type,man,messagetype,soapaction
content-length: 0

GET
H/1.1

200
OK

epx.gif
px.owneriq.net/fr/ Frame E172
Redirect Chain

https://px.owneriq.net/eucm/p/sv?gdpr=0&gdpr_consent=
https://px.owneriq.net/fr/epx.gif

43 B
401 B

81ms
20ms

Image
image/gif

23.3.125.39

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.owneriq.net/fr/epx.gif
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?us_privacy=1---&informer=12352498
Protocol: HTTP/1.1
Server: 23.3.125.39 -, , ASN (),
Reverse DNS
Software: Apache/2.4.6 (CentOS) / PHP/7.3.33
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Sat, 20 Aug 2022 21:53:20 GMT
Server: Apache/2.4.6 (CentOS)
X-Powered-By: PHP/7.3.33
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: max-age=76824
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 21 Aug 2022 19:13:44 GMT

Redirect headers

Date: Sat, 20 Aug 2022 21:53:20 GMT
Server: Apache/2.4.6 (CentOS)
X-Powered-By: PHP/7.3.33
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://px.owneriq.net/fr/epx.gif
Cache-Control: max-age=29865
Connection: keep-alive
Content-Type: text/html
Content-Length: 154

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame E172
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=17&mt_exuid=FLfheBZHWg4-NovDQZaHMoI1&redirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D3%263pid%3D%5BUUID%5D&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=3&3pid=44ba6301-57cf-4200-870a-ffd920e553ef&gdpr=0&gdpr_consent=

43 B
1 KB

62ms
20ms

Image
image/gif

63.251.114.137
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=3&3pid=44ba6301-57cf-4200-870a-ffd920e553ef&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?us_privacy=1---&informer=12352498
Protocol: HTTP/1.1
Server: 63.251.114.137 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 20 Aug 2022 21:53:20 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap6ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Date: Sat, 20 Aug 2022 21:53:19 GMT
Server: MT3 4494 7cf1da7 master iad-pixel-x22 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://ce.lijit.com/merge?pid=3&3pid=44ba6301-57cf-4200-870a-ffd920e553ef&gdpr=0&gdpr_consent=
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Sat, 20 Aug 2022 21:53:18 GMT

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame E172 43 B
235 B 80ms
61ms Image
image/gif 35.211.178.172

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=fmx&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?us_privacy=1---&informer=12352498
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.211.178.172 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Sat, 20 Aug 2022 21:53:19 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET cm-notify
creativecdn.com/ Frame E172 0
0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame E172
Redirect Chain

https://data.adsrvr.org/track/cmf/generic?ttd_pid=federatedmedia&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=27&3pid=6736ccd3-9836-46e8-af56-35518e384388&gdpr=0&gdpr_consent=

43 B
1 KB

67ms
22ms

Image
image/gif

63.251.114.137
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=27&3pid=6736ccd3-9836-46e8-af56-35518e384388&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?us_privacy=1---&informer=12352498
Protocol: HTTP/1.1
Server: 63.251.114.137 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 20 Aug 2022 21:53:20 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap6ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 20 Aug 2022 21:53:19 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://ce.lijit.com/merge?pid=27&3pid=6736ccd3-9836-46e8-af56-35518e384388&gdpr=0&gdpr_consent=
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 223

GET

reporting
ap.lijit.com/dsp/google/ Frame E172
Redirect Chain

https://ap.lijit.com/dsp/google/cookiematch/beacon?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=RkxmaGVCWkhXZzQtTm92RFFaYUhNb0kx&gdpr=0
https://ap.lijit.com/dsp/google/reporting?gdpr=0

0
0

GET
H2 200 usermatch
ssum-sec.casalemedia.com/ Frame 523B 1 KB
2 KB 168ms
68ms Document
text/html 104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/apacdex
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 73de5c746ec35443-YYZ
content-encoding: br
content-type: text/html
date: Sat, 20 Aug 2022 21:53:20 GMT
dropped-udsids: 230|241|39|46|41|64|47|4
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VLrt7CuxSnu0azAuPr%2F%2F%2FRYMzmqGpFott%2B4zrPGlYmVH3vkFNyk%2Fm7k3d%2BT9hIyRXCYNAN9ZrhHABTze2yu6uVBuXGSkheOZzlB8XYtvXAIByolP8sl2r2JGn4CsXn4Dw3eL2wRallngXw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Is-Traffic-Usersync, Accept-Encoding

GET
H/1.1 204
No Content pbsync
usermatch.targeting.unrulymedia.com/ Frame 11F7 0
0 181ms
23ms Document
text/plain 199.127.204.142

General

Check archive.org

Show headers Download Go to

Full URL: https://usermatch.targeting.unrulymedia.com/pbsync?gdpr=${GDPR}&consent=${GDPR_CONSENT}&us_privacy=${US_PRIVACY}&rurl=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dunruly%26uid%3D%24UID
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/apacdex
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 199.127.204.142 -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Connection: keep-alive
Date: Sat, 20 Aug 2022 21:53:20 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 418E 15 KB
6 KB 28ms
19ms Document
text/html 104.77.8.253
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dpubmatic%26uid%3D
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/apacdex
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.77.8.253 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-77-8-253.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=100522
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Sat, 20 Aug 2022 21:53:19 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Mon, 22 Aug 2022 01:48:41 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame EC28 2 KB
814 B 19ms
11ms Document
text/html 51.222.239.232
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=2bb78272a859ca6

Requested by

Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/apacdex

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.239.232 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame B252 15 KB
6 KB 28ms
20ms Document
text/html 104.77.8.253
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=1&gdpr_consent=ABCFETYFDJLNBFCV&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?us_privacy=1---&informer=12352498
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.77.8.253 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-77-8-253.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://ap.lijit.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=100522
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Sat, 20 Aug 2022 21:53:19 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Mon, 22 Aug 2022 01:48:41 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET

merge
ce.lijit.com/ Frame 1473
Redirect Chain

https://d.turn.com/r/dd/id/L21rdC8xMjcvY2lkLzI4NTUyOTczL3QvMg/url/https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D1%263pid%3D%24!%7BTURN_UUID%7D&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=1&3pid=7452293479422994595&gdpr=0&gdpr_consent=

0
0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 4374 15 KB
6 KB 48ms
48ms Document
text/html 104.77.8.253
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.77.8.253 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-77-8-253.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=100522
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Sat, 20 Aug 2022 21:53:19 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Mon, 22 Aug 2022 01:48:41 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 13926
g2.gumgum.com/usync/ Frame E65B 4 KB
2 KB 151ms
25ms Document
text/html 54.158.111.180

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.158.111.180 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Sat, 20 Aug 2022 21:53:20 GMT
etag: W/"01430ca3446c8230cabe3509779f1a400"
server: nginx
timing-allow-origin: *

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame B967 2 KB
814 B 47ms
36ms Document
text/html 51.222.239.232
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1---&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.239.232 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET sync
ssbsync.smartadserver.com/api/ Frame 7F16 0
0

GET
H2 200 usermatch
ssum-sec.casalemedia.com/ Frame BE84 2 KB
1 KB 136ms
75ms Document
text/html 104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 73de5c746ec45443-YYZ
content-encoding: br
content-type: text/html
date: Sat, 20 Aug 2022 21:53:20 GMT
dropped-udsids: 73|3|130|206|105|156|24|17
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q30yaU%2Flh5Wg9MQsLZbz7cspJcl5LYheDtR%2FQqspob3YLNm5DmgAHMYcnHeaOf6sstH3ZtccbOI5ottI0pmQhcekp%2B51eETGoTx2MNoUJPsBYWIGEd4knKFgFgkYIiuAC73wiLs4mKD%2BnA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Is-Traffic-Usersync, Accept-Encoding

GET

usync.html
eus.rubiconproject.com/ Frame 5520
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=duration_media&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east

0
0

GET
H/1.1

200
OK

setuid
x.yieldlift.com/ Frame 4C9C
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=13702&gdpr=0&gdpr_consent=&us_privacy=1---&
https://x.yieldlift.com/setuid?bidder=rubicon&uid=L72FSY87-1P-4SQI&gdpr=0&us_privacy=1---

0
570 B

101ms
24ms

Image
application/json

3.229.251.39

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.yieldlift.com/setuid?bidder=rubicon&uid=L72FSY87-1P-4SQI&gdpr=0&us_privacy=1---
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---
Protocol: HTTP/1.1
Server: 3.229.251.39 -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Accept: application/json
Pragma: no-cache
Expires: 0
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Content-Type: application/json;charset=utf-8

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://x.yieldlift.com/setuid?bidder=rubicon&uid=L72FSY87-1P-4SQI&gdpr=0&us_privacy=1---
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: bd0f62a3fbacfef6a33ae6abaf6daf37
Expires: 0

GET

sync
ads.servenobid.com/ Frame 4C9C
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=312&uid=8345552742478484192

0
0

GET
H2

200

sync
ads.servenobid.com/ Frame 4C9C
Redirect Chain

https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1---&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D
https://ads.servenobid.com/sync?pid=310&uid=FLfheBZHWg4-NovDQZaHMoI1

0
350 B

33ms
24ms

Image
image/avif

52.207.67.12
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=310&uid=FLfheBZHWg4-NovDQZaHMoI1
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---
Protocol: H2
Server: 52.207.67.12 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-67-12.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:20 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Sat, 20 Aug 2022 21:53:20 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Location: https://ads.servenobid.com/sync?pid=310&uid=FLfheBZHWg4-NovDQZaHMoI1
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap6ewr1
Content-Length: 0
Expires: Fri, 20 Mar 2009 00:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 4C9C
Redirect Chain

https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1---&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=310&uid=FLfheBZHWg4-NovDQZaHMoI1

0
350 B

33ms
23ms

Image
image/avif

52.207.67.12
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=310&uid=FLfheBZHWg4-NovDQZaHMoI1
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---
Protocol: H2
Server: 52.207.67.12 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-67-12.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:20 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Date: Sat, 20 Aug 2022 21:53:20 GMT
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://ads.servenobid.com/sync?pid=310&uid=FLfheBZHWg4-NovDQZaHMoI1
Access-Control-Allow-Credentials: true
Connection: close
X-Sovrn-Pod: ad_ap6ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

GET

sync
ads.servenobid.com/ Frame 4C9C
Redirect Chain

https://x.yieldlift.com/getuid?r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D314%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=314&uid=eyJ4dWlkIjoiY2RjMmM3NTYtOWUyNy00MjM4LWJhN2YtYmI2Mzk5ZmNkZDA4IiwiZHAiOnt9LCJiZGF5IjoiMjAyMi0wOC0yMFQyMTo1MzoyMC4xNTM1NzRaIn0=

0
0

GET

RX-edc74d43-63a3-4ba0-9440-abd2b59dd35f-005
sync.targeting.unrulymedia.com/csync/ Frame 4C9C
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5622657734
https://sync.1rx.io/usersync/tradedesk/6736ccd3-9836-46e8-af56-35518e384388
https://sync.targeting.unrulymedia.com/csync/RX-edc74d43-63a3-4ba0-9440-abd2b59dd35f-005?redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3DRX-edc74d43-63a3-4ba0-9440-abd2b59dd35f-005

0
0

GET cm
p.rfihub.com/ Frame 4C9C 0
0

GET usa
sync.go.sonobi.com/ Frame 4C9C 0
0

GET

pixel
ap.lijit.com/ Frame 4C9C
Redirect Chain

https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1---&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D
https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F1%2F363%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---%26A%3Dc8e5063d-f220-4bd7-8599-8de4599b8b43%26bidder%3Dappnexus%26cbx%3D...
https://prebid.a-mo.net/cchain/1/363?gdpr=0&gdpr_consent=&us_privacy=1---&A=c8e5063d-f220-4bd7-8599-8de4599b8b43&bidder=appnexus&cbx=aHR0cHM6Ly9hZHMuc2VydmVub2JpZC5jb20vc3luYz9waWQ9MzI3JnVpZD0%3D&u...
https://ap.lijit.com/pixel?gdpr=1&gdpr_consent=&us_privacy=1---&redir=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F2%2F363%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---%26A%3Dc8e5063d-f220-4bd7-8599...

0
0

GET
H2

200

sync
ads.servenobid.com/ Frame 4C9C
Redirect Chain

https://ups.analytics.yahoo.com/ups/58559/occ
https://ads.servenobid.com/sync?pid=337&uid=y-aK3LdY5E2uEiaBhvDKG33y3wgYM70kXMdxMvLDI-~A

0
367 B

33ms
23ms

Image
image/avif

52.207.67.12
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=337&uid=y-aK3LdY5E2uEiaBhvDKG33y3wgYM70kXMdxMvLDI-~A
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---
Protocol: H2
Server: 52.207.67.12 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-67-12.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:20 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=337&uid=y-aK3LdY5E2uEiaBhvDKG33y3wgYM70kXMdxMvLDI-~A
date: Sat, 20 Aug 2022 21:53:20 GMT
server: ATS/9.1.10.25
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET redirectuser
ssp.disqus.com/ Frame 4C9C 0
0

GET
H2

200

sync
ads.servenobid.com/ Frame 4C9C
Redirect Chain

https://ups.analytics.yahoo.com/ups/58632/occ
https://ads.servenobid.com/sync?pid=339&uid=y-aK3LdY5E2uEiaBhvDKG33y3wgYM70kXMdxMvLDI-~A

0
367 B

33ms
24ms

Image
image/avif

52.207.67.12
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=339&uid=y-aK3LdY5E2uEiaBhvDKG33y3wgYM70kXMdxMvLDI-~A
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---
Protocol: H2
Server: 52.207.67.12 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-67-12.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 21:53:20 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=339&uid=y-aK3LdY5E2uEiaBhvDKG33y3wgYM70kXMdxMvLDI-~A
date: Sat, 20 Aug 2022 21:53:20 GMT
server: ATS/9.1.10.25
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 6BB2 0
745 B 39ms
39ms Script
text/html 68.67.160.24
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.24 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS