filecr.com Open in urlscan Pro
2606:4700:3031::6815:3106 Public Scan

Software

nginx /

Resource Hash

bd8127c21fbe94bd12e2c57f6631a2f694dc9516cb60a50cd08e7e39edace520

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-nc: HIT mxp 8
date: Sat, 22 Jan 2022 11:57:29 GMT
x-content-type-options: nosniff
last-modified: Tue, 30 Mar 2021 13:10:53 GMT
server: nginx
etag: "15829e9c765919ed"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <http://filecr.com/wp-content/uploads/2018/12/Icon_utorrent_free-download.png>; rel="canonical"
content-length: 2980
expires: Fri, 31 Mar 2023 01:10:53 GMT

GET
H2 200 Bootstrap-Studio-Logo.png
i0.wp.com/filecr.com/wp-content/uploads/2019/05/ 828 B
1 KB 58ms
15ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/filecr.com/wp-content/uploads/2019/05/Bootstrap-Studio-Logo.png

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

7a5a93555a9ae33a15fcf3bdc1eed6ed7ea2caef8d6155da3168190b5d38c89a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-nc: HIT mxp 4
date: Sat, 22 Jan 2022 11:57:29 GMT
x-content-type-options: nosniff
last-modified: Tue, 30 Mar 2021 13:13:58 GMT
server: nginx
etag: "2ebdc29fb1396008"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <http://filecr.com/wp-content/uploads/2019/05/Bootstrap-Studio-Logo.png>; rel="canonical"
content-length: 828
expires: Fri, 31 Mar 2023 01:13:58 GMT

GET
H2 200 stellar-data-recovery-pro-icon.png
i1.wp.com/filecr.com/wp-content/uploads/2022/01/ 40 KB
40 KB 60ms
18ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i1.wp.com/filecr.com/wp-content/uploads/2022/01/stellar-data-recovery-pro-icon.png

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

3733f48df66a699be095ed019d21001ccc00744bc24c7265358cfafe8a6903de

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-nc: HIT mxp 2
date: Sat, 22 Jan 2022 11:57:29 GMT
x-content-type-options: nosniff
last-modified: Fri, 21 Jan 2022 13:05:00 GMT
server: nginx
etag: "29688de469159171"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <http://filecr.com/wp-content/uploads/2022/01/stellar-data-recovery-pro-icon.png>; rel="canonical"
content-length: 41216
expires: Mon, 22 Jan 2024 01:05:00 GMT

GET
H2 200 Icon_Wondershare-Recoverit_free-download.png
i0.wp.com/filecr.com/wp-content/uploads/2018/12/ 2 KB
2 KB 58ms
16ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/filecr.com/wp-content/uploads/2018/12/Icon_Wondershare-Recoverit_free-download.png

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

440275c5d6768fc9c25857d789093197731521a41a204d58ceb29ff8f2d4a81d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-nc: HIT mxp 5
date: Sat, 22 Jan 2022 11:57:29 GMT
x-content-type-options: nosniff
last-modified: Tue, 30 Mar 2021 13:10:59 GMT
server: nginx
etag: "c6f3935db1f1aedd"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <http://filecr.com/wp-content/uploads/2018/12/Icon_Wondershare-Recoverit_free-download.png>; rel="canonical"
content-length: 1536
expires: Fri, 31 Mar 2023 01:10:59 GMT

GET
H2 200 Icon_Topaz-DeNoise-AI-1.1.0_free-download.png
i3.wp.com/filecr.com/wp-content/uploads/2019/05/ 3 KB
4 KB 60ms
16ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i3.wp.com/filecr.com/wp-content/uploads/2019/05/Icon_Topaz-DeNoise-AI-1.1.0_free-download.png

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

1c87f8fde56c36f01417ca212ade4725c2d2a4dfd099b5596c1998335552c59e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-nc: HIT mxp 5
date: Sat, 22 Jan 2022 11:57:29 GMT
x-content-type-options: nosniff
last-modified: Tue, 30 Mar 2021 13:09:52 GMT
server: nginx
etag: "aa3112828a5a0972"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <http://filecr.com/wp-content/uploads/2019/05/Icon_Topaz-DeNoise-AI-1.1.0_free-download.png>; rel="canonical"
content-length: 3262
expires: Fri, 31 Mar 2023 01:09:52 GMT

GET
H2 200 Icon_Advanced-SystemCare_free-download.png
i2.wp.com/filecr.com/wp-content/uploads/2018/12/ 5 KB
5 KB 59ms
17ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i2.wp.com/filecr.com/wp-content/uploads/2018/12/Icon_Advanced-SystemCare_free-download.png

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

56782e1add1c1faf75be28a60eae59ee505a203548c1773a36f849f3cf46b96f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-nc: HIT mxp 3
date: Sat, 22 Jan 2022 11:57:29 GMT
x-content-type-options: nosniff
last-modified: Tue, 30 Mar 2021 13:18:22 GMT
server: nginx
etag: "356244669d240770"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <http://filecr.com/wp-content/uploads/2018/12/Icon_Advanced-SystemCare_free-download.png>; rel="canonical"
content-length: 4770
expires: Fri, 31 Mar 2023 01:18:22 GMT

GET
H2 200 on1-effects-icon.png
i0.wp.com/filecr.com/wp-content/uploads/2021/05/ 18 KB
18 KB 58ms
16ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/filecr.com/wp-content/uploads/2021/05/on1-effects-icon.png

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

93007660fab26f276d4c6c8e58ee11a4cec73e1632f26ce4fbaddf51593b59b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-nc: HIT mxp 2
date: Sat, 22 Jan 2022 11:57:29 GMT
x-content-type-options: nosniff
last-modified: Thu, 21 Oct 2021 14:16:57 GMT
server: nginx
etag: "dd5feef2888ca3d6"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <http://filecr.com/wp-content/uploads/2021/05/on1-effects-icon.png>; rel="canonical"
content-length: 18234
expires: Sun, 22 Oct 2023 02:16:57 GMT

GET
H2 200 PDFelement.png
i1.wp.com/filecr.com/wp-content/uploads/2021/09/ 2 KB
3 KB 31ms
26ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i1.wp.com/filecr.com/wp-content/uploads/2021/09/PDFelement.png

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

b9ea3d9899126cbafb9d0ab6ff0cd814c36cf497eb090d07df3d42e30b0f5f79

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-nc: HIT mxp 7
date: Sat, 22 Jan 2022 11:57:29 GMT
x-content-type-options: nosniff
last-modified: Mon, 20 Sep 2021 13:37:24 GMT
server: nginx
etag: "bc515f97ee9fc2a7"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <http://filecr.com/wp-content/uploads/2021/09/PDFelement.png>; rel="canonical"
content-length: 2484
expires: Thu, 21 Sep 2023 01:37:24 GMT

GET
H2 200 SnapTube.png
i3.wp.com/filecr.com/wp-content/uploads/2021/05/ 3 KB
3 KB 27ms
22ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i3.wp.com/filecr.com/wp-content/uploads/2021/05/SnapTube.png

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

bcaed03e08f7c64607442e34049408f9644e7f8742b7f6461b513afc207334dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-nc: HIT mxp 3
date: Sat, 22 Jan 2022 11:57:29 GMT
x-content-type-options: nosniff
last-modified: Thu, 27 May 2021 08:35:07 GMT
server: nginx
etag: "f6149f2d0f12cb63"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <http://filecr.com/wp-content/uploads/2021/05/SnapTube.png>; rel="canonical"
content-length: 3326
expires: Sat, 27 May 2023 20:35:07 GMT

GET
H2 200 powerdirector-icon.png
i2.wp.com/filecr.com/wp-content/uploads/2020/05/ 3 KB
4 KB 25ms
20ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i2.wp.com/filecr.com/wp-content/uploads/2020/05/powerdirector-icon.png

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

0ada291c40e0a9e1a16027017afca21159ce7d9e65f4235c268e879777001c59

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-nc: HIT mxp 6
date: Sat, 22 Jan 2022 11:57:29 GMT
x-content-type-options: nosniff
last-modified: Tue, 30 Mar 2021 13:13:38 GMT
server: nginx
etag: "007dde1197a85d56"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <http://filecr.com/wp-content/uploads/2020/05/powerdirector-icon.png>; rel="canonical"
content-length: 3518
expires: Fri, 31 Mar 2023 01:13:38 GMT

GET
H2 200 photo-lab-pro-picture-editor-icon.png
i3.wp.com/filecr.com/wp-content/uploads/2020/04/ 6 KB
6 KB 27ms
22ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i3.wp.com/filecr.com/wp-content/uploads/2020/04/photo-lab-pro-picture-editor-icon.png

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

c9a2201ad247bdf280490658cd2c8a09a592d774228e2e08012ae0107fa25671

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-nc: HIT mxp 6
date: Sat, 22 Jan 2022 11:57:29 GMT
x-content-type-options: nosniff
last-modified: Tue, 30 Mar 2021 13:10:45 GMT
server: nginx
etag: "21e896f75d736062"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <http://filecr.com/wp-content/uploads/2020/04/photo-lab-pro-picture-editor-icon.png>; rel="canonical"
content-length: 6194
expires: Fri, 31 Mar 2023 01:10:45 GMT

GET
H2 200 RAR-Logo.png
i0.wp.com/filecr.com/wp-content/uploads/2019/11/ 2 KB
2 KB 30ms
25ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/filecr.com/wp-content/uploads/2019/11/RAR-Logo.png

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

0ae5c83f204f2c4792a8c4953af1c83fb1c2305a0b3186e0fb2e690fef3b60ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-nc: HIT mxp 3
date: Sat, 22 Jan 2022 11:57:29 GMT
x-content-type-options: nosniff
last-modified: Tue, 30 Mar 2021 13:05:25 GMT
server: nginx
etag: "9958623ed3ae2257"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <http://filecr.com/wp-content/uploads/2019/11/RAR-Logo.png>; rel="canonical"
content-length: 1992
expires: Fri, 31 Mar 2023 01:05:25 GMT

GET
H2 200 teatv-logo.png
i0.wp.com/filecr.com/wp-content/uploads/2020/11/ 9 KB
10 KB 30ms
25ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/filecr.com/wp-content/uploads/2020/11/teatv-logo.png

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

9bc908fb056aff9520c76443794306051a85478befec755294a84c4eb8a3b381

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-nc: HIT mxp 8
date: Sat, 22 Jan 2022 11:57:29 GMT
x-content-type-options: nosniff
last-modified: Tue, 22 Jun 2021 11:59:43 GMT
server: nginx
etag: "be99b5a6e61587cf"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <http://filecr.com/wp-content/uploads/2020/11/teatv-logo.png>; rel="canonical"
content-length: 9650
expires: Thu, 22 Jun 2023 23:59:43 GMT

GET
H2 200 MacroDroid-Device-Automation-Logo.png
i2.wp.com/filecr.com/wp-content/uploads/2019/10/ 2 KB
2 KB 26ms
21ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i2.wp.com/filecr.com/wp-content/uploads/2019/10/MacroDroid-Device-Automation-Logo.png

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

b0bd3151710882cc08c758905dfebf4171856eb80d849c54c514c360d89a63e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-nc: HIT mxp 2
date: Sat, 22 Jan 2022 11:57:29 GMT
x-content-type-options: nosniff
last-modified: Tue, 30 Mar 2021 13:24:47 GMT
server: nginx
etag: "9e05e851ad091465"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <http://filecr.com/wp-content/uploads/2019/10/MacroDroid-Device-Automation-Logo.png>; rel="canonical"
content-length: 1964
expires: Fri, 31 Mar 2023 01:24:47 GMT

GET
H2 200 x-plore-file-manager-logo.png
i0.wp.com/filecr.com/wp-content/uploads/2020/09/ 3 KB
3 KB 30ms
25ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/filecr.com/wp-content/uploads/2020/09/x-plore-file-manager-logo.png

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

58ef3b8afe5dee523e1c9c8b67c610e6d522e1307da7e96986520fd7b0d6596e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-nc: HIT mxp 4
date: Sat, 22 Jan 2022 11:57:29 GMT
x-content-type-options: nosniff
last-modified: Tue, 30 Mar 2021 13:20:58 GMT
server: nginx
etag: "8db02ca7cc419cdc"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <http://filecr.com/wp-content/uploads/2020/09/x-plore-file-manager-logo.png>; rel="canonical"
content-length: 2594
expires: Fri, 31 Mar 2023 01:20:58 GMT

GET
H2 200 novatv.png
i3.wp.com/filecr.com/wp-content/uploads/2019/11/ 2 KB
2 KB 27ms
23ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i3.wp.com/filecr.com/wp-content/uploads/2019/11/novatv.png

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

d3d5812b9eb0456cd977e8b1ee77cb58001b2011501076ffef3831883c11e1f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-nc: HIT mxp 6
date: Sat, 22 Jan 2022 11:57:29 GMT
x-content-type-options: nosniff
last-modified: Tue, 30 Mar 2021 13:11:16 GMT
server: nginx
etag: "460417facabf4e5f"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <http://filecr.com/wp-content/uploads/2019/11/novatv.png>; rel="canonical"
content-length: 1938
expires: Fri, 31 Mar 2023 01:11:16 GMT

GET
H2 200 Icon_Adobe-Photoshop-CC_free-download.png
i3.wp.com/filecr.com/wp-content/uploads/2018/11/ 1 KB
1 KB 28ms
24ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i3.wp.com/filecr.com/wp-content/uploads/2018/11/Icon_Adobe-Photoshop-CC_free-download.png

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

66de3ae11690818c128fb306c08b1f18a920ab1fba2564842b2099a84e246e20

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-nc: HIT mxp 4
date: Sat, 22 Jan 2022 11:57:29 GMT
x-content-type-options: nosniff
last-modified: Tue, 30 Mar 2021 13:04:24 GMT
server: nginx
etag: "7cc620ece58f587b"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <http://filecr.com/wp-content/uploads/2018/11/Icon_Adobe-Photoshop-CC_free-download.png>; rel="canonical"
content-length: 1268
expires: Fri, 31 Mar 2023 01:04:24 GMT

GET
H2 200 Microsoft-Office-for-Mac-2021.png
i2.wp.com/filecr.com/wp-content/uploads/2021/10/ 22 KB
22 KB 26ms
21ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i2.wp.com/filecr.com/wp-content/uploads/2021/10/Microsoft-Office-for-Mac-2021.png

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

7c06481269ba2f82dc841852b295e6fbf33266267833b626a043ae8124bebd06

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-nc: HIT mxp 4
date: Sat, 22 Jan 2022 11:57:29 GMT
x-content-type-options: nosniff
last-modified: Wed, 13 Oct 2021 17:10:03 GMT
server: nginx
etag: "5c539114b17e504d"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <http://filecr.com/wp-content/uploads/2021/10/Microsoft-Office-for-Mac-2021.png>; rel="canonical"
content-length: 22182
expires: Sat, 14 Oct 2023 05:10:03 GMT

GET
H2 200 ON1-Photo-RAW-2021-logo.png
i2.wp.com/filecr.com/wp-content/uploads/2020/07/ 5 KB
5 KB 25ms
21ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i2.wp.com/filecr.com/wp-content/uploads/2020/07/ON1-Photo-RAW-2021-logo.png

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

119304315bf1eb923b7630c6392688ff2b6687ab7e33d37f29ba6fa1ee99c737

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-nc: HIT mxp 3
date: Sat, 22 Jan 2022 11:57:29 GMT
x-content-type-options: nosniff
last-modified: Tue, 30 Mar 2021 13:21:29 GMT
server: nginx
etag: "0ef4a2e4cc63d301"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <http://filecr.com/wp-content/uploads/2020/07/ON1-Photo-RAW-2021-logo.png>; rel="canonical"
content-length: 5222
expires: Fri, 31 Mar 2023 01:21:29 GMT

GET
H2 200 Icon_4K-Stogram_download.png
i3.wp.com/filecr.com/wp-content/uploads/2018/11/ 3 KB
3 KB 28ms
24ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i3.wp.com/filecr.com/wp-content/uploads/2018/11/Icon_4K-Stogram_download.png

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

8a7126b46a60d4a6b9bf33541fc5d8860f0cbf4d38fd3b0f499805ce9274519e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-nc: HIT mxp 1
date: Sat, 22 Jan 2022 11:57:29 GMT
x-content-type-options: nosniff
last-modified: Wed, 31 Mar 2021 14:30:06 GMT
server: nginx
etag: "2944df1741f93a73"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <http://filecr.com/wp-content/uploads/2018/11/Icon_4K-Stogram_download.png>; rel="canonical"
content-length: 3176
expires: Sat, 01 Apr 2023 02:30:06 GMT

GET
H2 200 extension-feature-image.png
i1.wp.com/filecr.com/wp-content/themes/filecr/assets/images/ 10 KB
10 KB 31ms
26ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i1.wp.com/filecr.com/wp-content/themes/filecr/assets/images/extension-feature-image.png

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

0e88ad62ff0a0c72ef67e1daf40764b12861d27f3c7d1ddce8e7124d69621d59

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-nc: HIT mxp 8
date: Sat, 22 Jan 2022 11:57:29 GMT
x-content-type-options: nosniff
last-modified: Mon, 24 May 2021 11:51:15 GMT
server: nginx
etag: "f77aee6827a7a1ca"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <http://filecr.com/wp-content/themes/filecr/assets/images/extension-feature-image.png>; rel="canonical"
content-length: 10528
expires: Wed, 24 May 2023 23:51:15 GMT

GET
H3 200 script.js Show response
filecr.com/wp-content/plugins/advanced-ads-responsive/public/assets/js/ 2 KB
1 KB 25ms
25ms Script
application/javascript 2606:4700:3031::6815:3106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://filecr.com/wp-content/plugins/advanced-ads-responsive/public/assets/js/script.js?ver=1.10.2
Requested by: Host: filecr.com
URL: https://filecr.com/en/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:3106 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 8af0b5fd87f0cf0c57915fb6094244ca5c108f21c063fd6917ee809259ae3a97

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/en/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:28 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1653
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 07 Jul 2021 11:56:39 GMT
server: cloudflare
etag: W/"60e59677-b92"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nlbnL3MoLdMeD4aTtLoPaaRV9ppPJCQdZGIlpke73EMHdx2zPzuB16%2F4slUICuYYRkq44TVFeImE76ITCgHSrL84zx7K623vBMoKt1BNQjiE9%2BvIS5KeaerZOFamT5WBgt%2F47he%2FXXdk"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-polished: origSize=2962
cf-ray: 6d189ae00938f91b-MXP
cf-bgj: minify

GET
H3 200 ads.js Show response
filecr.com/wp-content/plugins/deblocker/js/ 126 B
697 B 25ms
24ms Script
application/javascript 2606:4700:3031::6815:3106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://filecr.com/wp-content/plugins/deblocker/js/ads.js?ver=3.1.0
Requested by: Host: filecr.com
URL: https://filecr.com/en/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:3106 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 3dbfe6eda0abf69eb1901f4696d5daf4e276cb6dd8c30dfaa26b724b60251635

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/en/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:28 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1847
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Sun, 21 Mar 2021 11:33:20 GMT
server: cloudflare
etag: W/"33f-5be0a50e9c000-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UIFT%2FGpIdxOf3zv1Ey2Qj7U7MFJB2aHrWsRSCIqXniKQIbhtQzYuUy%2Fw%2FPAcfN8yhc7m%2FeynwXCCjv3zrOKHZr90kVFUzWG0ibSS5%2Bv7jzwPLOFhIFpv0Ed05dVbbjZG0pSqkXseACTD"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-accel-version: 0.01
cache-control: max-age=31536000
cf-polished: origSize=831
cf-ray: 6d189ae02961f91b-MXP
cf-bgj: minify

GET
H3 200 advanced-ads-pro.min.js Show response
filecr.com/wp-content/plugins/advanced-ads-pro/assets/js/ 6 KB
2 KB 26ms
25ms Script
application/javascript 2606:4700:3031::6815:3106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://filecr.com/wp-content/plugins/advanced-ads-pro/assets/js/advanced-ads-pro.min.js?ver=2.15.0
Requested by: Host: filecr.com
URL: https://filecr.com/en/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:3106 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 308c252b2381b887baf74268990c582643dbdaad9e9b332d158112745e2c65ea

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/en/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1654
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Sat, 04 Dec 2021 13:06:34 GMT
server: cloudflare
etag: W/"61ab67da-1620"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GjQarLA7qXRLTvSyVggdjIArF4Cf100V7x%2FYuwdR26c52W8%2FhzGYXV4nKmNrNW1Q1g%2BzWjVHSFCFHlUjK%2FY%2BkImOQYhA8476SmEfcYKPVVmG1ZxSu%2BlKsRYqrzaYJ85A4jA8Z6QgHda1"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 6d189ae059c2f91b-MXP

GET
H3 200 script.js Show response
filecr.com/wp-content/themes/filecr/assets/js/ 272 KB
84 KB 43ms
39ms Script
application/javascript 2606:4700:3031::6815:3106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://filecr.com/wp-content/themes/filecr/assets/js/script.js?ver=1.1.2
Requested by: Host: filecr.com
URL: https://filecr.com/en/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:3106 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 11cd1e1d49bf0a95c35aeb868dd4673260a225078ed2e054ed0fa6a8cb64e99e

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/en/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 90
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 20 Sep 2021 20:04:29 GMT
server: cloudflare
etag: W/"6148e94d-4d0f6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h%2FwniYxwPhjmdGlzAcmK62NyJ9%2BBTuK1MngX8XbS5llFo2Rbw%2Bp70HLlqHBdpu8JbGVHB7sbmwTV9oVAR8cmZJoavZ9VWw2Sm7sV5ztt5TR%2FuM%2B3AmX0bp5ey5epwB%2FRCHCcuWnYvvPV"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-polished: origSize=315638
cf-ray: 6d189ae059c9f91b-MXP
cf-bgj: minify

GET
H3 200 ratings.js Show response
filecr.com/wp-content/themes/filecr/assets/js/ 3 KB
2 KB 31ms
26ms Script
application/javascript 2606:4700:3031::6815:3106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://filecr.com/wp-content/themes/filecr/assets/js/ratings.js?ver=1.1.2
Requested by: Host: filecr.com
URL: https://filecr.com/en/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:3106 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 3e4609b61e3f7b1135d9d5dac5113fdeccf8085478d37cea8ea11cf63034e8af

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/en/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6677
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 20 Sep 2021 20:04:29 GMT
server: cloudflare
etag: W/"6148e94d-f89"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c13tpfwzrddt3knchCQpTu4%2B278K88VBgbZhm7mI43hULTwB%2B5UgdhitWUIbp%2BU7xrPK%2BWV%2F%2BLoG1BHR5%2BYlCrrB0OABfSeo0qI%2Bpgs6y7NeElj1Pj62zh9wPkchfguKT2%2BiPpeVSVin"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-polished: origSize=3977
cf-ray: 6d189ae059ccf91b-MXP
cf-bgj: minify

GET
H3 200 confirm.js Show response
filecr.com/wp-content/themes/filecr/assets/js/ 2 KB
1 KB 33ms
27ms Script
application/javascript 2606:4700:3031::6815:3106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://filecr.com/wp-content/themes/filecr/assets/js/confirm.js?ver=1.1.2
Requested by: Host: filecr.com
URL: https://filecr.com/en/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:3106 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 89e267039d32f778ee14f762d623290ef56cc3965c0d8843a9f81d5748322d72

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/en/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6677
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 20 Sep 2021 20:04:29 GMT
server: cloudflare
etag: W/"6148e94d-842"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G16MGspY94YiPbrSqdEaP8QfpCgu2u44UMUM6i20QRQPraaQdFygDRIZ44T4lbGsCis%2BO7WTYUXVy7RoC4CPJxv%2BwEhAkWlnsI%2FCWbCmHlOQIMN8D%2B0ZbctOY8ffZgweaJUFZjjiV1g2"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-polished: origSize=2114
cf-ray: 6d189ae059cdf91b-MXP
cf-bgj: minify

GET
H3 200 ext-notification.js Show response
filecr.com/wp-content/themes/filecr/assets/js/ 2 KB
1 KB 74ms
68ms Script
application/javascript 2606:4700:3031::6815:3106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://filecr.com/wp-content/themes/filecr/assets/js/ext-notification.js?ver=1.1.2
Requested by: Host: filecr.com
URL: https://filecr.com/en/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:3106 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 15e116457c9d49a0e37d9128e98dd0da56c3413408aeb2e49903e490e98fc7c7

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/en/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 229
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 20 Sep 2021 20:04:29 GMT
server: cloudflare
etag: W/"6148e94d-88e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PirYZQtXapqpKqc84HppW8MazLOQQZwsQE4dfVta4t5SDCZBkxrqvQCQ%2FGE7ije%2FG%2FykmVJ9RLG%2FHPM2JmrwKqdnBJdNtPcyziyp7HIIJZqAtqmB4YrBYdFGu6JsH%2FlZanlg2qrsht9T"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-polished: origSize=2190
cf-ray: 6d189ae059cff91b-MXP
cf-bgj: minify

GET
H3 200 custom-front.js Show response
filecr.com/wp-content/themes/filecr/assets/js/ 13 KB
3 KB 32ms
26ms Script
application/javascript 2606:4700:3031::6815:3106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://filecr.com/wp-content/themes/filecr/assets/js/custom-front.js?ver=1.1.2
Requested by: Host: filecr.com
URL: https://filecr.com/en/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:3106 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: e2b0c644e90d90d54a55d3c7dd7dde3f8897a92f18ee6d69d74d5cab0167405e

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/en/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 229
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 20 Sep 2021 20:04:29 GMT
server: cloudflare
etag: W/"6148e94d-47ff"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X0yg6Dy9YQTRyNJvQih9AaOV%2FuxBId2eTWix80MtU%2ByoYaf%2BG5OG%2B99TZW2z1GzQzl2XyQdo7wAF8A1OHgLy4K9x3%2Fi9MMAJvOiXGW6VLRECJTGZkyiiATlR0lH0nIe5ZR2qPJcbrR0w"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-polished: origSize=18431
cf-ray: 6d189ae059d2f91b-MXP
cf-bgj: minify

GET
H3 200 ext.js Show response
filecr.com/wp-content/themes/filecr/assets/js/ 12 KB
4 KB 34ms
28ms Script
application/javascript 2606:4700:3031::6815:3106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://filecr.com/wp-content/themes/filecr/assets/js/ext.js?ver=1.1.2
Requested by: Host: filecr.com
URL: https://filecr.com/en/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:3106 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: e60ebb7a34b9e7d06c9c4ddf4a44eb523b03f2826b34159f04a86996625c0a21

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/en/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6677
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 20 Sep 2021 20:04:29 GMT
server: cloudflare
etag: W/"6148e94d-36a2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6JEM9veOZit0xbgDHL8PkNtWRkZPSNDdW3y6ooUziX8NGRkHpgENmMfv5JoCFHeOh8Wijgns2Cc85vKhZYHks9TdCZooa59vH4PLPCsjYKEl6IcuHVl7Oxi6a7GyB32JURisSpGRW1XH"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-polished: origSize=13986
cf-ray: 6d189ae059d4f91b-MXP
cf-bgj: minify

GET
H3 200 base.min.js Show response
filecr.com/wp-content/plugins/advanced-ads-pro/assets/js/ 71 KB
24 KB 38ms
32ms Script
application/javascript 2606:4700:3031::6815:3106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://filecr.com/wp-content/plugins/advanced-ads-pro/assets/js/base.min.js?ver=2.15.0
Requested by: Host: filecr.com
URL: https://filecr.com/en/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:3106 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: c03a0c272ac4982cee8a10ba55930a4abf2612c8795f39810c8a22364de7c8cb

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/en/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1654
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Sat, 04 Dec 2021 13:06:34 GMT
server: cloudflare
etag: W/"61ab67da-11df2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0xf%2F%2BHbchUGhy%2BLxw8gMo1o%2Br1iKLN9Uq2TJP3ui6w4NIDhZE3QgSim4EcbrU6TMYyaUyCef%2FbA8ZgoP8xPUNSqW8dszp6LCXNYSE5WDjXVTAU9whOxrVvr9Ur9hq%2F3Cnd%2Bf1zA15%2FGM"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 6d189ae059d6f91b-MXP

GET
H3 200 wp-embed.min.js Show response
filecr.com/wp-includes/js/ 1 KB
1 KB 36ms
31ms Script
application/javascript 2606:4700:3031::6815:3106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://filecr.com/wp-includes/js/wp-embed.min.js?ver=5.8.3
Requested by: Host: filecr.com
URL: https://filecr.com/en/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:3106 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/en/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6677
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 06 Jan 2021 15:29:24 GMT
server: cloudflare
etag: W/"5ff5d754-592"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Rdgafgi8uUIWhfiwaDJZbIijvjeTrHHvlrAQBxEMNEQDHU6A372H0bENozYaLTXxL5kPUIYtB%2FLzOxwjfbDWxL4wPF3RcVvPSQLB%2F4FZ83%2BiCPTHKbxpFsUSqZRNJNHLrMfR9i1%2F6knl"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 6d189ae059daf91b-MXP

GET
H3 200 wp-emoji-release.min.js Show response
filecr.com/wp-includes/js/ 18 KB
5 KB 36ms
33ms Script
application/javascript 2606:4700:3031::6815:3106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://filecr.com/wp-includes/js/wp-emoji-release.min.js?ver=5.8.3
Requested by: Host: filecr.com
URL: https://filecr.com/en/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:3106 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/en/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6677
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 27 Jul 2021 13:25:43 GMT
server: cloudflare
etag: W/"61000957-4705"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9hvbxs3y1DshhYOM%2BFulaLs3phWL1c%2BfDsR9rVJ3TzXglSr3JI%2BOtKn2PS8dzES16WHCqz%2FBbr%2BPjTURIhPvGreR98OWTqjqYS4mJR4RLwHr5FXPEmgGwzZ2IFyiAQbXUmqKQ2CN0Z93"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 6d189ae059dcf91b-MXP

GET
H2 200 filecr.js Show response
cdn4.buysellads.net/pub/ 561 KB
191 KB 94ms
27ms Script
application/javascript 94.31.29.32
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000
Requested by: Host: filecr.com
URL: https://filecr.com/en/?id=94759749504
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 94.31.29.32 , United Kingdom, ASN33438 (HIGHWINDS2, US),
Reverse DNS: 94.31.29.32.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: 1e9a68b875db7eda031bfb76069afadb58b53a66af4c664622d69dd1edfb551f

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
content-encoding: gzip
last-modified: Fri, 21 Jan 2022 19:43:07 GMT
server: NetDNA-cache/2.2
x-amz-request-id: 96PRAP6JKESWTFMX
etag: W/"a6aee0f09f058453d9810a4d379cf70b"
x-cache: HIT
content-type: application/javascript
cache-control: max-age=31104000
x-amz-id-2: bezHkPKhJInOK6yq0YtQ4FpbBqHOqsSAfNpmwxW8qJh6u/fXZrbmlIC2Y/s6MJ/MPB1YY90frhU=
expires: Tue, 17 Jan 2023 11:57:29 GMT

GET
H3 200 Simple-Line-Icons.woff2
cdnjs.cloudflare.com/ajax/libs/simple-line-icons/2.5.5/fonts/ 29 KB
30 KB 78ms
58ms Font
application/octet-stream 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/simple-line-icons/2.5.5/fonts/Simple-Line-Icons.woff2?v=2.4.0

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/simple-line-icons/2.5.5/css/simple-line-icons.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2b139d2871e745eeca0ed22ce994df828a96faefe86aa5e47d06c58184845445

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://cdnjs.cloudflare.com/ajax/libs/simple-line-icons/2.5.5/css/simple-line-icons.css
Origin: https://filecr.com
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 141770
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 30064
timing-allow-origin: *
last-modified: Mon, 10 Aug 2020 15:57:38 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f316e72-7570"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NBhjXfSYgNo%2BJX4sPtiaxRN2JuynXQx%2FUoLYZkMQTQOMCwGWh%2BlTBw6f4f1wJqh3Od7uDpswLIlZ23TQPhSE5g76vLXhf5CIpq8uBZg7nAp29QcYpklJucosHfMpKr5Wq25pRl1O4zxk%2BFCE3C5gjz0T"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6d189ae0ab0f3744-MXP
expires: Thu, 12 Jan 2023 11:57:29 GMT

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7a31b0310331c8959b07a0fffd3bcbc1d7b67100ad78576323a5a0136146a080

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 comm Show response
webcrx.io/extension/ Frame A565 3 KB
1 KB 614ms
569ms Document
text/html 2606:4700:3035::6815:5fcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://webcrx.io/extension/comm

Requested by

Host: filecr.com
URL: https://filecr.com/wp-content/themes/filecr/assets/js/ext.js?ver=1.1.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3035::6815:5fcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a969b6aad84c69a5a60aa38b1dc211818c0b713f020ae274424e7546c4169501

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
content-type: text/html; charset=utf-8
x-dns-prefetch-control: off
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
access-control-allow-origin: *
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9Z0Wakma9DYlizGQ5qjIc6x8BMqkb4D7zjLpDj6Q9v7BwFGRDMnHlnmEqxFiAxoJ8igS8XZRTyo46pfbhl%2BYRs5orHXGu9YKB717xnA7okETwKUgzJUDCLtFZJFJGfeOCHXbuIs2VuM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6d189ae1cbc83748-MXP
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 146 KB
51 KB 81ms
48ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54d0cf580dbb9d14dff3a6f8395796a9a1ea08166171b3d2befc3af217c46efb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51913
x-xss-protection: 0
server: cafe
etag: 13679759460364781754
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sat, 22 Jan 2022 11:57:29 GMT

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202201120101/ 284 KB
102 KB 66ms
65ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202201120101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-3553508983172692&plah=filecr.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-3553508983172692

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b309a677799a40b8fde4220b242a605386cdda843feb5aa742401e7a09d5c5c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 104511
x-xss-protection: 0
server: cafe
etag: 10386340077950508822
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 22 Jan 2022 11:57:29 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220119/r20190131/ Frame 29D9 11 KB
5 KB 90ms
29ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220119/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-3553508983172692

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

425b48211e0ebe795b6ead9ec2f1bcd9e04e9930a7dd30e08cdb2fef0bcb834c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4885
x-xss-protection: 0
date: Fri, 21 Jan 2022 16:20:20 GMT
expires: Fri, 04 Feb 2022 16:20:20 GMT
cache-control: public, max-age=1209600
age: 70629
etag: 13671712056976469594
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 91ms
28ms Script
text/javascript 2a00:1450:4001:812::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-139662474-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 1355
date: Sat, 22 Jan 2022 11:34:54 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Sat, 22 Jan 2022 13:34:54 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 78 KB
27 KB 111ms
35ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

52d0cb89ee01b00f8646adad02fa4e97914ba96ccc47cfb8d5a13b29f8fd6856

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26997
x-xss-protection: 0
server: sffe
etag: "1109 / 328 of 1000 / last-modified: 1642808442"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 22 Jan 2022 11:57:29 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 214 B
644 B 116ms
40ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=filecr.com&callback=_gfp_s_&client=ca-pub-3553508983172692

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202201120101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-3553508983172692&plah=filecr.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e9ef07ecd3bdfce7aa5448e2202a4649f497bceb0432ea89471d3d359a9659e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 199
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.it/adsid/ 107 B
792 B 102ms
39ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.it/adsid/integrator.js?domain=filecr.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 22 Jan 2022 11:57:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 94ms
37ms Script
application/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=filecr.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 22 Jan 2022 11:57:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 61ms
60ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Ffilecr.com%2Fen%2F%3Fid%3D94759749504&tn=DIV&id=site-alert&cls=alert%20fixed&ign=false&pw=1600&ph=1200&x=1575&y=1175

Requested by

Host: filecr.com
URL: https://filecr.com/en/?id=94759749504

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 78D1 155 KB
42 KB 540ms
506ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3553508983172692&output=html&adk=1812271804&adf=3025194257&lmt=1642852649&plat=1%3A16777216%2C3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Ffilecr.com%2Fen%2F%3Fid%3D94759749504&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642852649303&bpp=2&bdt=447&idt=134&shv=r20220119&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=7232286050971&frm=20&pv=2&ga_vid=317101765.1642852649&ga_sid=1642852649&ga_hid=1620821296&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063752%2C44750774%2C44753740%2C31064124%2C31063221%2C31063246&oid=2&pvsid=588111893478375&pem=904&tmod=124202828&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=151

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

32cb61dadda9c8f16ca2d419a5e368508229d12c4f5e3fbd1d5f50d8c037da05

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 22 Jan 2022 11:57:29 GMT
server: cafe
content-length: 43141
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 22 Jan 2022 11:57:29 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame AB4A 83 KB
29 KB 612ms
601ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3553508983172692&output=html&h=280&slotname=6956700837&adk=1140498346&adf=3690141461&pi=t.ma~as.6956700837&w=1158&fwrn=4&fwrnh=100&lmt=1642852649&rafmt=1&psa=0&format=1158x280&url=https%3A%2F%2Ffilecr.com%2Fen%2F%3Fid%3D94759749504&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642852649305&bpp=2&bdt=449&idt=167&shv=r20220119&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=7232286050971&frm=20&pv=1&ga_vid=317101765.1642852649&ga_sid=1642852649&ga_hid=1620821296&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=221&ady=111&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063752%2C44750774%2C44753740%2C31064124%2C31063221%2C31063246&oid=2&pvsid=588111893478375&pem=904&tmod=124202828&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=KrIebJ77Qa&p=https%3A//filecr.com&dtd=172

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bf214ebf9803962d7a68991901b55f40f81f2a52dc93fdadbd59dfb80de0fc07

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 22 Jan 2022 11:57:30 GMT
server: cafe
content-length: 29441
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 22 Jan 2022 11:57:30 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 878C 75 KB
28 KB 765ms
764ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3553508983172692&output=html&h=600&slotname=7034607982&adk=97701817&adf=403192329&pi=t.ma~as.7034607982&w=296&fwrn=4&fwrnh=100&lmt=1642852649&rafmt=1&psa=0&format=296x600&url=https%3A%2F%2Ffilecr.com%2Fen%2F%3Fid%3D94759749504&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642852649307&bpp=1&bdt=452&idt=184&shv=r20220119&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1158x280&nras=1&correlator=7232286050971&frm=20&pv=1&ga_vid=317101765.1642852649&ga_sid=1642852649&ga_hid=1620821296&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1073&ady=521&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063752%2C44750774%2C44753740%2C31064124%2C31063221%2C31063246&oid=2&pvsid=588111893478375&pem=904&tmod=124202828&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=uC7h7jAprH&p=https%3A//filecr.com&dtd=187

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5e666b4703b0701323a032599de31465302ff9fdfe2af6cd2e5c63afcb06df35

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 22 Jan 2022 11:57:30 GMT
server: cafe
content-length: 29073
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 22 Jan 2022 11:57:30 GMT
cache-control: private

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 71ms
36ms XHR
text/plain 2a00:1450:4001:812::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1620821296&t=pageview&_s=1&dl=https%3A%2F%2Ffilecr.com%2Fen%2F%3Fid%3D94759749504&ul=en-us&de=UTF-8&dt=FileCR%20-%20THE%20BIGGEST%20SOFTWARE%20STORE&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAUABAAAAAC~&jid=1540602577&gjid=231918145&cid=317101765.1642852649&tid=UA-139662474-1&_gid=2016503958.1642852650&_r=1&gtm=2ou1j0&z=847692521

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://filecr.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:29 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://filecr.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_2022011408.js Show response
securepubads.g.doubleclick.net/gpt/ 351 KB
119 KB 106ms
38ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011408.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0530384d8115b9411cd4fac3bad2e6565ab2ddf9c866c86b1422a65dfccb3980

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:15:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2543
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 120805
x-xss-protection: 0
last-modified: Sat, 15 Jan 2022 00:18:29 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sun, 22 Jan 2023 11:15:06 GMT

GET
H2 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 29 B
681 B 120ms
38ms XHR
application/json 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=filecr.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-18-185-154-32.eu-central-1.compute.amazonaws.com

Software

cafe /

Resource Hash

f312a20c6132b5c1b0ea46ee9d034b4ad198ceefbcf46b8e22672d4604182da5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 22 Jan 2022 11:57:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45
x-xss-protection: 0
expires: Sat, 22 Jan 2022 11:57:29 GMT

GET
H2 200 localstore.js Show response
script.4dex.io/ 483 B
965 B 93ms
31ms Script
application/javascript 2606:4700:20::681a:8a9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/localstore.js
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:8a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1851
content-type: application/javascript
x-amz-request-id: tx002dec70dafe483ba85bc-0061adedd1
x-amz-id-2: tx002dec70dafe483ba85bc-0061adedd1
last-modified: Mon, 06 Dec 2021 11:00:36 GMT
server: cloudflare
etag: W/"922cffdd75f7192f75231d92684885aa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p0gXTqNcKtPJLksxjTgPtTgdbNew391kRf7eFAE8lJD6I05%2B7q9PgS7%2FPbjWKJJn5aSBPZzTz1Z%2FxBBaJCg5dwnpGxQRnfvoUosu8L07emDvJGw9Avbj2pJpiDevr9Wx1r%2FLYfMgWwv2BvzO"}],"group":"cf-nel","max_age":604800}
x-amz-version-id: 1638788436623244
cache-control: public, max-age=1800
cf-ray: 6d189ae56e665a31-MXP
expires: Sat, 22 Jan 2022 12:27:29 GMT

POST
H2 200 adreq Show response
ads.servenobid.com/ 645 B
679 B 161ms
54ms XHR
application/json 18.202.39.221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=9517
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.202.39.221 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-39-221.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: d5ea8863883f7ea3f217f221c251e85aa8b43a9e0340344bded0c540580de744

Request headers

Referer: https://filecr.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://filecr.com
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
260 B 197ms
136ms XHR
application/json 18.185.154.32
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=4.43.0&referrer=https%3A%2F%2Ffilecr.com%2Fen%2F%3Fid%3D94759749504&tmax=900

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.185.154.32 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://filecr.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:29 GMT
content-type: application/json; charset=utf-8
access-control-allow-origin: https://filecr.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 133ms
70ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a9691a0017c7c276934280b04cd001d&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 40a5d552261f2e576f28a2d53a69ae7a42ddeff373a6bc12f6cac432d7dd410a

Request headers

Referer: https://filecr.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://filecr.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
288 B 130ms
67ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969544017c7c276e6e280a57d4001b&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: fdb6de7ad0039c71b58c2ecd5f122587b462c83420f740614170fbd0124f9eca

Request headers

Referer: https://filecr.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://filecr.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 139ms
76ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee2809e73b0016&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: b69ae0db8ad456e8e2164be23bdf16e876fa27af12fc64411c28e0344c38edb0

Request headers

Referer: https://filecr.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://filecr.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 140ms
77ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a9691a0017c7c276934280be73c001e&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 35b75f6fe1669d450c69cce4e644d1903b6eadb843209e6728d9ede132f4ac4e

Request headers

Referer: https://filecr.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://filecr.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 138ms
75ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9691a0017c7c2769342812c4ac0020&pos=8a969d17017c7c2764ee28140f1d001b&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: b3f51fdda08d64592ef4251b6892e120077473e74eb3350d033b0d3d49eaa7b9

Request headers

Referer: https://filecr.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://filecr.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 135ms
73ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969544017c7c276e6e280b8d4d001c&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 20aaff62bf2cea10bf0a75adbaf649baa1850e77c411d5094364109fc9a1efa3

Request headers

Referer: https://filecr.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://filecr.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 140ms
78ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee280c36f30017&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: fdc125aa51fdb1d4f212b056b75933fdec3e34c49e09a2cc9ebe46534e47bc6c

Request headers

Referer: https://filecr.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://filecr.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 157ms
95ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee2809e73b0016&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: d80cba02245f4931c2611347b78d08b82eaab9ceb63d6c2e513c44296f9d6395

Request headers

Referer: https://filecr.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://filecr.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 168ms
107ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee2809e73b0016&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 851514b2ea1e329ecc91c21d9021028c66594ad3c4cdb195364b662e60322ad4

Request headers

Referer: https://filecr.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://filecr.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 165ms
103ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee2809e73b0016&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: c3354382a961305aad5b672a0e0ff11048075674d63b7bec68969e87e9b86a0c

Request headers

Referer: https://filecr.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://filecr.com
access-control-allow-credentials: true
content-length: 62

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 358 B
703 B 104ms
39ms XHR
application/json 185.255.84.150
IGUANE-

General

Check archive.org

Show headers Download Go to

Full URL

https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Ffilecr.com%2Fen%2F%3Fid%3D94759749504&CanonicalUrl=https%3A%2F%2Ffilecr.com%2Fen%2F&PublisherDomain=https%3A%2F%2Ffilecr.com

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.255.84.150 Paris, France, ASN200271 (IGUANE-, FR),

Reverse DNS

Software

ayl-lb-fra02 /

Resource Hash

f089b336752aa0c9c25cac382aec0d4a7dc696dfb0c2850063a562c603411b92

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://filecr.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:29 GMT
x-content-type-options: nosniff
server: ayl-lb-fra02
vary: Accept-Encoding
access-control-allow-methods: OPTIONS, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://filecr.com
access-control-max-age: 3600
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 7
access-control-allow-headers: Accept-Encoding, Content-Type
content-length: 358
expires: 0

GET
H2 200 display Show response
mantodea.mantisadnetwork.com/prebid/ 56 B
337 B 345ms
105ms XHR
application/javascript 35.174.217.176
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://mantodea.mantisadnetwork.com/prebid/display?tz=0&buster=1642852649770&secure=true&version=9&title=FileCR%20-%20THE%20BIGGEST%20SOFTWARE%20STORE&url=https%3A%2F%2Ffilecr.com%2Fen%2F%3Fid%3D94759749504&measurable=true&bids[0][bidId]=350f6f244613a68&bids[0][config][property]=6115725d81c45d000f945f3e&bids[0][config][zone]=FileCR_S2S_Leaderboard_ROS_ATF&bids[0][sizes][0][width]=728&bids[0][sizes][0][height]=90&bids[0][sizes][1][width]=970&bids[0][sizes][1][height]=90&bids[0][sizes][2][width]=970&bids[0][sizes][2][height]=250&bids[1][bidId]=368efaadc482874&bids[1][config][property]=6115725d81c45d000f945f3e&bids[1][config][zone]=FileCR_S2S_Sidebar_Right_ROS_Pos1&bids[1][sizes][0][width]=300&bids[1][sizes][0][height]=250&bids[1][sizes][1][width]=300&bids[1][sizes][1][height]=600&bids[1][sizes][2][width]=160&bids[1][sizes][2][height]=600&bids[2][bidId]=379df5490f3d0d5&bids[2][config][property]=6115725d81c45d000f945f3e&bids[2][config][zone]=FileCR_S2S_InContent_ROS_Pos1&bids[2][sizes][0][width]=728&bids[2][sizes][0][height]=90&bids[3][bidId]=3810f3c690ebf9d&bids[3][config][property]=6115725d81c45d000f945f3e&bids[3][config][zone]=FileCR_S2S_InContent_ROS_Pos2&bids[3][sizes][0][width]=728&bids[3][sizes][0][height]=90&bids[4][bidId]=3959898da91e896&bids[4][config][property]=6115725d81c45d000f945f3e&bids[4][config][zone]=FileCR_S2S_InContent_ROS_Pos3&bids[4][sizes][0][width]=728&bids[4][sizes][0][height]=90&property=6115725d81c45d000f945f3e&foo
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.174.217.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-174-217-176.compute-1.amazonaws.com
Software: / Express
Resource Hash: e24bd9b97ed52cff8876282f06c9b74bcfb86bcccf01bb43802d48d13dc30fee

Request headers

Referer: https://filecr.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:30 GMT
x-powered-by: Express
etag: W/"38-JLuvM731/JOaQynVSKZDfl+HSB0"
vary: Origin
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://filecr.com
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 56
expires: -1

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
307 B 135ms
63ms XHR
application/json 178.250.0.165
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=33&wv=4.43.0&cb=50064276111

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.165 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

bidder.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://filecr.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://filecr.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 44

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 610 B
1 KB 121ms
56ms XHR
application/json 185.33.221.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.90 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

f47673232c5aa02f385883993c249cf1eb84a3b6395fae74376f16ef8679799e

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://filecr.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

Date: Sat, 22 Jan 2022 11:57:29 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 192.145.127.216; 192.145.127.216; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 13148885-bfcf-4305-b449-73aa5f9c96d4
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://filecr.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 prebid Show response
mp.4dex.io/ 99 B
471 B 131ms
77ms XHR
application/json 2606:4700::6812:272
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mp.4dex.io/prebid
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:272 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 463d9ed7665533bf71c038c36df9387aaf6b1e7c46dbf021776a313955bef4aa

Request headers

Referer: https://filecr.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

cf-ray: 6d189ae58cc883bb-MXP
pragma: no-cache
date: Sat, 22 Jan 2022 11:57:29 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
x-warn: Selecting bids. No selected bids
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://filecr.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-encoding: gzip
server: cloudflare
expires: 0

POST
H2 204 v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
109 B 88ms
29ms XHR
text/plain 35.157.152.254
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.157.152.254 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-152-254.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://filecr.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://filecr.com
date: Sat, 22 Jan 2022 11:57:29 GMT
access-control-allow-credentials: true
vary: Origin

POST
H2 204 v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
110 B 87ms
28ms XHR
text/plain 35.157.152.254
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.157.152.254 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-152-254.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://filecr.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://filecr.com
date: Sat, 22 Jan 2022 11:57:29 GMT
access-control-allow-credentials: true
vary: Origin

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
357 B 112ms
36ms XHR
application/json 51.89.9.252
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://filecr.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
access-control-allow-origin: https://filecr.com
cache-control: no-transform, no-cache
access-control-allow-credentials: true
content-type: application/json
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 306 B
1 KB 162ms
42ms XHR
application/json 2602:803:c003:200::31
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=386922&zone_id=2155654&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!buysellads.com,13694,1,,,&rf=https%3A%2F%2Ffilecr.com%2Fen%2F%3Fid%3D94759749504&tk_flint=pbjs_lite_v4.43.0&x_source.tid=b4d37835-f961-42e1-878d-ed43b32900c3&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.8717138182767472
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 2602:803:c003:200::31 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 0b9268f702c489915ea0cb307cd933783ddfca6c3a3a414321b252c70c3e1525

Request headers

Referer: https://filecr.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:29 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://filecr.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 306
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 306 B
1 KB 163ms
43ms XHR
application/json 2602:803:c003:200::31
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=386922&zone_id=2155654&size_id=15&alt_size_ids=9%2C10&rp_schain=1.0,1!buysellads.com,13694,1,,,&rf=https%3A%2F%2Ffilecr.com%2Fen%2F%3Fid%3D94759749504&tk_flint=pbjs_lite_v4.43.0&x_source.tid=2b47b8aa-7a11-4e11-99e9-b95adf9d3c55&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.6188401884553267
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 2602:803:c003:200::31 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 814a82f3f7a72ff7a5ad17d17315f29032104c1566f2ea18cf37f85c6f3077f5

Request headers

Referer: https://filecr.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:29 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://filecr.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 306
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 283 B
1 KB 164ms
44ms XHR
application/json 2602:803:c003:200::31
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=386922&zone_id=2155654&size_id=2&rp_schain=1.0,1!buysellads.com,13694,1,,,&rf=https%3A%2F%2Ffilecr.com%2Fen%2F%3Fid%3D94759749504&tk_flint=pbjs_lite_v4.43.0&x_source.tid=f3809174-b92f-42ec-baf9-af01f7d5ee3f&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.5951118288175201
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 2602:803:c003:200::31 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 7f8ef8b11b9cf225d61fdfb1bb4e31a9802f4fd2b6f5b176a2bb8b63044a0376

Request headers

Referer: https://filecr.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:29 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://filecr.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 283
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 283 B
1 KB 179ms
49ms XHR
application/json 2602:803:c003:200::31
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=386922&zone_id=2155656&size_id=2&rp_schain=1.0,1!buysellads.com,13694,1,,,&rf=https%3A%2F%2Ffilecr.com%2Fen%2F%3Fid%3D94759749504&tk_flint=pbjs_lite_v4.43.0&x_source.tid=0cf43544-60b2-47ca-8a91-5e75026f4f9a&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.42332797237449316
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 2602:803:c003:200::31 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 7b00eda5a4c41263d33878837115c98e3118cf60dce4e3152e9ef4c25e55ddb1

Request headers

Referer: https://filecr.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:29 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://filecr.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 283
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 283 B
1 KB 186ms
56ms XHR
application/json 2602:803:c003:200::31
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=386922&zone_id=2155656&size_id=2&rp_schain=1.0,1!buysellads.com,13694,1,,,&rf=https%3A%2F%2Ffilecr.com%2Fen%2F%3Fid%3D94759749504&tk_flint=pbjs_lite_v4.43.0&x_source.tid=ad365d45-7b7d-49c9-ae5a-6a2599085307&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.16539369445172802
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 2602:803:c003:200::31 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 585d5cadf99c6b0b5100f4985dbd1d9f8d240728357b21b324548231401cfe39

Request headers

Referer: https://filecr.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:29 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://filecr.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 283
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 adagio.js Show response
script.4dex.io/ 71 KB
23 KB 83ms
40ms Fetch
application/javascript 2606:4700:20::681a:8a9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:8a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eb04b94656de1350a1fe252e640d692b44f9501188d48c01884d6962bea38913

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:29 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1385463
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-request-id: txe7f2956f45d14dab907c2-0061d6cd26
x-amz-id-2: txe7f2956f45d14dab907c2-0061d6cd26
last-modified: Mon, 06 Dec 2021 11:00:35 GMT
server: cloudflare
etag: W/"d56fadf5a52703aee9982c415a17065a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fE%2F88k%2BUzX%2B2mlheAzcwwaNMhsT6aTgSnfy%2BdXZx%2BVd%2B0yfwQMjO7c85zpHt4gPpjsPYxOEjYujJ7uZ7%2FA35eA2lqEWnJr3VpemTfAWRL7CCD%2FxC1wCnkdrm5BOdLvzTfYfHe%2BqunbxYYsll"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=1800
access-control-allow-credentials: true
x-amz-version-id: 1638788435319991
cf-ray: 6d189ae5da3df92f-MXP
access-control-allow-headers: Authorization

GET
H3 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202201120101/ 149 KB
53 KB 64ms
58ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202201120101/reactive_library_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

07d707076d2cbf14640db4a3445b25f59073e56883eccb358980c7d582c9a328

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54133
x-xss-protection: 0
server: cafe
etag: 8861924386423220664
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sat, 22 Jan 2022 11:57:30 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 63ms
58ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=rasra::pm&rt=8&c=ca-pub-3553508983172692&eid=31063752%2C44750774%2C44753740%2C31064124%2C31063221%2C31063246

Requested by

Host: filecr.com
URL: https://filecr.com/en/?id=94759749504

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame AB4A 6 KB
1 KB 98ms
36ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3553508983172692&output=html&h=280&slotname=6956700837&adk=1140498346&adf=3690141461&pi=t.ma~as.6956700837&w=1158&fwrn=4&fwrnh=100&lmt=1642852649&rafmt=1&psa=0&format=1158x280&url=https%3A%2F%2Ffilecr.com%2Fen%2F%3Fid%3D94759749504&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642852649305&bpp=2&bdt=449&idt=167&shv=r20220119&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=7232286050971&frm=20&pv=1&ga_vid=317101765.1642852649&ga_sid=1642852649&ga_hid=1620821296&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=221&ady=111&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063752%2C44750774%2C44753740%2C31064124%2C31063221%2C31063246&oid=2&pvsid=588111893478375&pem=904&tmod=124202828&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=KrIebJ77Qa&p=https%3A//filecr.com&dtd=172

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2cef3a9d0606aecfe2476867e61f76535b9bb5b8e9d31957cc9504cdd1e69396

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 22 Jan 2022 10:34:48 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Sat, 22 Jan 2022 11:57:30 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 22 Jan 2022 11:57:30 GMT

GET
H2 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/ Frame AB4A 1 KB
954 B 93ms
31ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fd11fa353cc6a8560f4c35e67c6fb8a3a4061ed3de4309cdf83fca65f8319bb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:54:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 172
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 848
x-xss-protection: 0
server: cafe
etag: 2277666839114365613
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 05 Feb 2022 11:54:38 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220119/r20110914/ Frame AB4A 19 KB
8 KB 81ms
24ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220119/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2039446f8956518da2c2d70116d18c92fac3b04110942de074748aa4041067fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 24
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7881
x-xss-protection: 0
server: cafe
etag: 7605774008668088057
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 05 Feb 2022 11:57:06 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/ Frame AB4A 2 KB
1 KB 88ms
32ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:54:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 199
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 05 Feb 2022 11:54:11 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame AB4A 122 KB
37 KB 144ms
108ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

425f48a06ab0e9a4a4d792a6677189720f377ec09a073ecdae6232a89cc221f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38060
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1642595990432946"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 22 Jan 2022 11:57:30 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/ Frame AB4A 15 KB
6 KB 84ms
28ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:56:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 88
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 05 Feb 2022 11:56:02 GMT

GET
H2 200 fccbdb50d0e11463e1edb3d8fcf7c364.js Show response
www.gstatic.com/mysidia/ Frame AB4A 27 KB
12 KB 84ms
24ms Script
text/javascript 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/fccbdb50d0e11463e1edb3d8fcf7c364.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f1b3a51250ea5d2b293615f08241269ed8277b95654cddafbc0f5df8d61e6cc1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 19:13:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 146618
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11411
x-xss-protection: 0
last-modified: Thu, 20 Jan 2022 13:53:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 20 Apr 2022 19:13:52 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame AB4A 0
0 73ms
72ms Fetch
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CeM5mKfHrYffKH9LB-gbW_KOwCqLE3fdngLu05ccPsJAfEAEg1cKUdWD9gpGE6BGgAbymlOwDyAEJqAMByAPLBKoE6wFP0DXmDmmM-qmpSm-CDiht4NB6z5eCb7Q5XGHGHSS6HGK1gKf9emnyUDFwnJiYZEJ_HS8L72HH5MCQyXtcA8NCZ-Yd8aCYBzkhCm-g0vqjIHnrKOHq9x9Jdpyf30FQCEb4YDmlm4y9L5Nmk2C-rax_bhSR-ZTWF5cbbbjxQswKsFhUKp-vkPF45RPzwfLleMEAKnCqBADNqd6sn0tWbGrPsLmA03NW1zCzRiZ7BEfITshlzCt6TVqAh1Fs26gEVBCj8L5lZDBi8A8srjua2dcl-PE92ya-QcHITvGk7_6_mTlZAb3CFyFFznnawAT-gOnH-wOSBQQIBBgBkgUECAUYBKAGLoAHrNnrE6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcA8gcEELy8JdIICQiA4YAQEAEYH4AKAcgLAdgTDYgUAdAVAZgWAYAXAbIXHAoaCAASFHB1Yi0zNTUzNTA4OTgzMTcyNjkyGAA&sigh=Brg2-8_K0qM&uach_m=[UACH]&template_id=484

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3553508983172692&output=html&h=280&slotname=6956700837&adk=1140498346&adf=3690141461&pi=t.ma~as.6956700837&w=1158&fwrn=4&fwrnh=100&lmt=1642852649&rafmt=1&psa=0&format=1158x280&url=https%3A%2F%2Ffilecr.com%2Fen%2F%3Fid%3D94759749504&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642852649305&bpp=2&bdt=449&idt=167&shv=r20220119&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=7232286050971&frm=20&pv=1&ga_vid=317101765.1642852649&ga_sid=1642852649&ga_hid=1620821296&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=221&ady=111&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063752%2C44750774%2C44753740%2C31064124%2C31063221%2C31063246&oid=2&pvsid=588111893478375&pem=904&tmod=124202828&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=KrIebJ77Qa&p=https%3A//filecr.com&dtd=172
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sat, 22 Jan 2022 11:57:30 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sat, 22 Jan 2022 11:57:30 GMT

GET
H2 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/13391341759553254873/ Frame AB4A 19 KB
19 KB 101ms
47ms Image
image/png 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13391341759553254873/downsize_200k_v1?w=400&h=209

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e90e985fbd8994c8386b413deff94b4717ba010ca6f4249d0007a91b67c15f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 18 Jan 2022 21:24:40 GMT
x-content-type-options: nosniff
age: 311570
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19487
x-xss-protection: 0
last-modified: Mon, 10 Jan 2022 17:52:37 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 18 Jan 2023 21:24:40 GMT

GET
H2 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/13804463627378609599/ Frame AB4A 4 KB
4 KB 87ms
33ms Image
image/png 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13804463627378609599/downsize_200k_v1?w=100&h=100

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

515f7f7cbe2423de310055274f8de146246aad6b6767a57dda551616d56c8d5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 18 Jan 2022 18:48:14 GMT
x-content-type-options: nosniff
age: 320956
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4092
x-xss-protection: 0
last-modified: Mon, 10 Jan 2022 17:52:37 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 18 Jan 2023 18:48:14 GMT

GET
H3 200 integrator.js Show response
adservice.google.it/adsid/ 107 B
122 B 78ms
42ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.it/adsid/integrator.js?domain=filecr.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011408.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 22 Jan 2022 11:57:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 70ms
36ms Script
application/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=filecr.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011408.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 22 Jan 2022 11:57:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 107 KB
29 KB 479ms
440ms XHR
text/plain 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=588111893478375&correlator=1607806204918083&output=ldjh&impl=fifs&eid=31063246&vrg=2022011408&ptt=17&sc=1&sfv=1-0-38&ecs=20220122&iu_parts=8691100%2CFileCR_S2S_Leaderboard_ROS_ATF%2CFileCR_S2S_Sidebar_Right_ROS_Pos1%2CFileCR_S2S_InContent_ROS_Pos1%2CFileCR_S2S_InContent_ROS_Pos2%2CFileCR_S2S_InContent_ROS_Pos3&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5&prev_iu_szs=728x90%7C970x90%7C970x250%2C300x250%7C300x600%7C160x600%2C728x90%2C728x90%2C728x90&prev_scp=optimize_refresh_int%3D0%26optimize_ad_unit_id%3Dbsa-zone_1627508894724-7_123456%26optimize_inview%3Dfalse%7Coptimize_refresh_int%3D0%26optimize_ad_unit_id%3Dbsa-zone_1627508935810-9_123456%26optimize_inview%3Dfalse%7Coptimize_refresh_int%3D0%26optimize_ad_unit_id%3Dbsa-zone_1629214863639-0_123456%26optimize_inview%3Dfalse%7Coptimize_refresh_int%3D0%26optimize_ad_unit_id%3Dbsa-zone_1629215045012-3_123456%26optimize_inview%3Dfalse%7Coptimize_refresh_int%3D0%26optimize_ad_unit_id%3Dbsa-zone_1629215230348-3_123456%26optimize_inview%3Dfalse&eri=1&cust_params=optimize_refreshed%3Dfalse%26optimize_acceptable%3Dfalse%26optimize_adl_debug%3Dfalse%26optimize_ctv_debug%3Dfalse%26optimize_debug%3Dfalse%26optimize%3Dtrue%26optimize_adl_id%3D%26optimize_amp%3Dfalse%26optimize_audience%3Dlifestyle%26optimize_env%3Dprod%26optimize_pub%3Dfilecr&cookie=ID%3D013bc20d5b808baa-228c6e8827cd0012%3AT%3D1642852649%3ART%3D1642852649%3AS%3DALNI_MbXh0kHQJi1JiFl_4Ni3wgtOsU8Pg&bc=31&abxe=1&dt=1642852650141&lmt=1642852650&dlt=1642852648856&idt=880&frm=20&biw=1600&bih=1200&oid=2&adxs=436%2C1073%2C200%2C200%2C200&adys=3100%2C453%2C522%2C1540%2C2558&adks=1202396793%2C1436553605%2C1058625133%2C1413693914%2C3977682169&ucis=1%7C2%7C3%7C4%7C5&ifi=4&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&dmc=8&url=https%3A%2F%2Ffilecr.com%2Fen%2F%3Fid%3D94759749504&vis=1&scr_x=0&scr_y=0&psz=728x0%7C296x0%7C811x0%7C811x0%7C811x0&msz=728x0%7C296x0%7C811x0%7C811x0%7C811x0&ga_vid=317101765.1642852649&ga_sid=1642852649&ga_hid=1620821296&ga_fc=true&fws=0%2C0%2C0%2C0%2C0&ohw=0%2C0%2C0%2C0%2C0&btvi=1%7C0%7C0%7C2%7C3&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011408.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

pr-postprod-ing.pbp.vip.ir2.yahoo.com

Software

cafe /

Resource Hash

74d7d50a53d9ffde9fd1960bd58b62b72de54016b1e667ba5d94f4a057259af1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:30 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: 208055,208055,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29622
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,-1,5320060794
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -1,-1,-1,-1,138305491700
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://filecr.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 6974 6 KB
4 KB 199ms
61ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011408.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Sat, 22 Jan 2022 11:57:30 GMT
expires: Sun, 22 Jan 2023 11:57:30 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 58ms
58ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=rasra::pr&rt=8&c=ca-pub-3553508983172692&eid=31063752%2C44750774%2C44753740%2C31064124%2C31063221%2C31063246

Requested by

Host: filecr.com
URL: https://filecr.com/en/?id=94759749504

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220119/r20110914/ Frame 7E14 11 KB
5 KB 31ms
28ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220119/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

425b48211e0ebe795b6ead9ec2f1bcd9e04e9930a7dd30e08cdb2fef0bcb834c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4885
x-xss-protection: 0
date: Fri, 21 Jan 2022 16:02:39 GMT
expires: Fri, 04 Feb 2022 16:02:39 GMT
cache-control: public, max-age=1209600
age: 71691
etag: 13671712056976469594
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 css2
fonts.googleapis.com/ Frame 7E14 4 KB
634 B 78ms
34ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220119/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 22 Jan 2022 11:15:13 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Sat, 22 Jan 2022 11:57:30 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 22 Jan 2022 11:57:30 GMT

GET
H3 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 7E14 205 B
229 B 70ms
26ms Image
image/png 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220119/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 21 Jan 2022 07:54:40 GMT
x-content-type-options: nosniff
age: 100970
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sat, 21 Jan 2023 07:54:40 GMT

GET
H3 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 7E14 604 B
628 B 66ms
27ms Image
image/png 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220119/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 21 Jan 2022 13:56:18 GMT
x-content-type-options: nosniff
age: 79272
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sat, 21 Jan 2023 13:56:18 GMT

GET
H3 200 interstitial_ad_frame_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220119/r20110914/elements/html/ Frame 7E14 18 KB
8 KB 67ms
26ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220119/r20110914/elements/html/interstitial_ad_frame_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220119/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b277171297bfc840b62b9f160060bf8fc630389b0dee3aadcbb0e855ac7ecbc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:46:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 672
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8104
x-xss-protection: 0
server: cafe
etag: 11153116566150069083
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 05 Feb 2022 11:46:18 GMT

GET
DATA 200
OK truncated
/ Frame AB4A 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 90da55f73f6d3d75eb4d3b8902f11be3977e1ad04863846a54efc232c0c3d2cd

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame AB4A 15 KB
16 KB 104ms
26ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:22:37 GMT
x-content-type-options: nosniff
age: 261293
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15732
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:20 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 19 Jan 2023 11:22:37 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame AB4A 15 KB
16 KB 107ms
35ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 18 Jan 2022 20:07:55 GMT
x-content-type-options: nosniff
age: 316175
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 18 Jan 2023 20:07:55 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ Frame AB4A 15 KB
15 KB 124ms
55ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 01:54:06 GMT
x-content-type-options: nosniff
age: 295404
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 19 Jan 2023 01:54:06 GMT

GET
H3 200 17188323514121951012
tpc.googlesyndication.com/simgad/ Frame 878C 39 KB
39 KB 34ms
32ms Image
image/gif 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/17188323514121951012

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3553508983172692&output=html&h=600&slotname=7034607982&adk=97701817&adf=403192329&pi=t.ma~as.7034607982&w=296&fwrn=4&fwrnh=100&lmt=1642852649&rafmt=1&psa=0&format=296x600&url=https%3A%2F%2Ffilecr.com%2Fen%2F%3Fid%3D94759749504&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642852649307&bpp=1&bdt=452&idt=184&shv=r20220119&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1158x280&nras=1&correlator=7232286050971&frm=20&pv=1&ga_vid=317101765.1642852649&ga_sid=1642852649&ga_hid=1620821296&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1073&ady=521&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063752%2C44750774%2C44753740%2C31064124%2C31063221%2C31063246&oid=2&pvsid=588111893478375&pem=904&tmod=124202828&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=uC7h7jAprH&p=https%3A//filecr.com&dtd=187

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8ebc3af428b1e039d880aa6705b18e6450350acfad46a1832c3ff57d63f691dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 15:04:47 GMT
x-content-type-options: nosniff
age: 420763
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39800
x-xss-protection: 0
last-modified: Mon, 20 Dec 2021 14:01:14 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 17 Jan 2023 15:04:47 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220119/r20110914/ Frame 878C 19 KB
8 KB 32ms
31ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220119/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2039446f8956518da2c2d70116d18c92fac3b04110942de074748aa4041067fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 24
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7881
x-xss-protection: 0
server: cafe
etag: 7605774008668088057
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 05 Feb 2022 11:57:06 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/ Frame 878C 2 KB
1 KB 43ms
42ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:54:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 199
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 05 Feb 2022 11:54:11 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/ Frame 878C 15 KB
6 KB 28ms
27ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:56:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 88
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 05 Feb 2022 11:56:02 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 878C 122 KB
37 KB 60ms
59ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

425f48a06ab0e9a4a4d792a6677189720f377ec09a073ecdae6232a89cc221f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38060
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1642595990432946"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 22 Jan 2022 11:57:30 GMT

GET
H3 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/ Frame 878C 27 KB
11 KB 43ms
42ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ea6883243d3b8bc4d5890f404e6aacd73e92f75ff9e5d1031ba35d355877dfa5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 21 Jan 2022 16:03:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71616
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11395
x-xss-protection: 0
server: cafe
etag: 13428216562775282503
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 04 Feb 2022 16:03:54 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 878C 0
0 118ms
118ms Fetch
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CIOljKfHrYdXFIcup7AOO9KvACJSl9u5n0c3Ln6QPh8vw57YqEAEg1cKUdWD9gpGE6BGgAZTHm70DyAEDqAMByAPJBKoE7wFP0Gnk9-lya8yhLOgMLBMjxcT5gIIv2iq4cN3CrHuNVLhRKbOWOzTsliLgSGsQvLeN2RbLUF-1awNK6B7QhyPiyVz2O2TTDLLhtJupuEIRyd74sMHSQjfJWp6VaWkJcsi3E5StTvwgkVaL5UJ-I3xE-2QaAlbvdW-v__uF6Bk7GZanQnaMKdbHEUFaoYkL2lCrjuEWsdILgEwxSMkWIWQVbzRRkfo0Giv8x6XKqSYzANFyvplXgPrCT0WDQpqCGPhtaCB_BJZ7cn6NF6iXQEFpwqQ5ap8lcLIARTFFAoYh24TxyGIhU7o1jo3gBjOiocAExPLq0PwDkgUECAQYAZIFBAgFGASgBgOAB52747oCqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwHyBwQQyIMG0ggJCIDhgBAQARgfgAoByAsB2BMN0BUBgBcBshccChoIABIUcHViLTM1NTM1MDg5ODMxNzI2OTIYAA&sigh=Gi4fQ2Df3CI&uach_m=[UACH]

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3553508983172692&output=html&h=600&slotname=7034607982&adk=97701817&adf=403192329&pi=t.ma~as.7034607982&w=296&fwrn=4&fwrnh=100&lmt=1642852649&rafmt=1&psa=0&format=296x600&url=https%3A%2F%2Ffilecr.com%2Fen%2F%3Fid%3D94759749504&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642852649307&bpp=1&bdt=452&idt=184&shv=r20220119&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1158x280&nras=1&correlator=7232286050971&frm=20&pv=1&ga_vid=317101765.1642852649&ga_sid=1642852649&ga_hid=1620821296&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1073&ady=521&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063752%2C44750774%2C44753740%2C31064124%2C31063221%2C31063246&oid=2&pvsid=588111893478375&pem=904&tmod=124202828&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=uC7h7jAprH&p=https%3A//filecr.com&dtd=187
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sat, 22 Jan 2022 11:57:30 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 css
fonts.googleapis.com/ Frame 0708 8 KB
888 B 36ms
33ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220119/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f93d0298dd39f7dff18566a5b2754067e26c0182b469fd6b24e5d63429fef88b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 22 Jan 2022 11:06:18 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Sat, 22 Jan 2022 11:57:30 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 22 Jan 2022 11:57:30 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/ Frame 0708 1 KB
875 B 30ms
28ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220119/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fd11fa353cc6a8560f4c35e67c6fb8a3a4061ed3de4309cdf83fca65f8319bb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:54:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 172
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 848
x-xss-protection: 0
server: cafe
etag: 2277666839114365613
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 05 Feb 2022 11:54:38 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220119/r20110914/ Frame 0708 19 KB
8 KB 30ms
29ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220119/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220119/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2039446f8956518da2c2d70116d18c92fac3b04110942de074748aa4041067fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 24
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7881
x-xss-protection: 0
server: cafe
etag: 7605774008668088057
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 05 Feb 2022 11:57:06 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/ Frame 0708 2 KB
1 KB 35ms
34ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220119/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:54:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 199
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 05 Feb 2022 11:54:11 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0708 122 KB
37 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220119/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

425f48a06ab0e9a4a4d792a6677189720f377ec09a073ecdae6232a89cc221f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38060
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1642595990432946"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 22 Jan 2022 11:57:30 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/ Frame 0708 15 KB
6 KB 32ms
31ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220119/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:56:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 88
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 05 Feb 2022 11:56:02 GMT

GET
H3 200 fccbdb50d0e11463e1edb3d8fcf7c364.js Show response
www.gstatic.com/mysidia/ Frame 0708 27 KB
11 KB 28ms
27ms Script
text/javascript 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/fccbdb50d0e11463e1edb3d8fcf7c364.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220119/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f1b3a51250ea5d2b293615f08241269ed8277b95654cddafbc0f5df8d61e6cc1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 19:13:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 146618
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11411
x-xss-protection: 0
last-modified: Thu, 20 Jan 2022 13:53:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 20 Apr 2022 19:13:52 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 56B9 143 B
163 B 34ms
29ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3553508983172692&output=html&h=600&slotname=7034607982&adk=97701817&adf=403192329&pi=t.ma~as.7034607982&w=296&fwrn=4&fwrnh=100&lmt=1642852649&rafmt=1&psa=0&format=296x600&url=https%3A%2F%2Ffilecr.com%2Fen%2F%3Fid%3D94759749504&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642852649307&bpp=1&bdt=452&idt=184&shv=r20220119&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1158x280&nras=1&correlator=7232286050971&frm=20&pv=1&ga_vid=317101765.1642852649&ga_sid=1642852649&ga_hid=1620821296&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1073&ady=521&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063752%2C44750774%2C44753740%2C31064124%2C31063221%2C31063246&oid=2&pvsid=588111893478375&pem=904&tmod=124202828&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=uC7h7jAprH&p=https%3A//filecr.com&dtd=187

Response headers

x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 145
x-xss-protection: 0
date: Sat, 22 Jan 2022 11:02:43 GMT
cache-control: public, max-age=3600
content-type: text/html; charset=UTF-8
age: 3287
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 878C 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 260bf977a68250c4e997eacb40bd3ee9ad802d4ddf4973257fe4e051de76340c

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame EECA 143 B
163 B 28ms
28ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220119/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20220119/r20110914/zrt_lookup.html?fsb=1

Response headers

x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 145
x-xss-protection: 0
date: Sat, 22 Jan 2022 11:02:43 GMT
cache-control: public, max-age=3600
content-type: text/html; charset=UTF-8
age: 3287
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 RSjKnk5gG5e-YnqyaokaGBofRBYcmQ35b5mWA3AF7Xg.js Show response
pagead2.googlesyndication.com/bg/ Frame 81F3 35 KB
13 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/RSjKnk5gG5e-YnqyaokaGBofRBYcmQ35b5mWA3AF7Xg.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4528ca9e4e601b97be627ab26a891a181a1f44161c990df96f9996037005ed78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 21 Jan 2022 07:15:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 103337
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13497
x-xss-protection: 0
last-modified: Wed, 12 Jan 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 21 Jan 2023 07:15:13 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 56B9
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

106ms
105ms

Document
text/html

2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sat, 22 Jan 2022 11:57:30 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 22 Jan 2022 11:57:30 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sat, 22 Jan 2022 11:57:30 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 RSjKnk5gG5e-YnqyaokaGBofRBYcmQ35b5mWA3AF7Xg.js Show response
pagead2.googlesyndication.com/bg/ Frame F0FC 35 KB
13 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/RSjKnk5gG5e-YnqyaokaGBofRBYcmQ35b5mWA3AF7Xg.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4528ca9e4e601b97be627ab26a891a181a1f44161c990df96f9996037005ed78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 21 Jan 2022 07:15:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 103337
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13497
x-xss-protection: 0
last-modified: Wed, 12 Jan 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 21 Jan 2023 07:15:13 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame EECA
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

80ms
79ms

Document
text/html

2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220119/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sat, 22 Jan 2022 11:57:30 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 22 Jan 2022 11:57:30 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sat, 22 Jan 2022 11:57:30 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 RSjKnk5gG5e-YnqyaokaGBofRBYcmQ35b5mWA3AF7Xg.js Show response
pagead2.googlesyndication.com/bg/ Frame A5F2 35 KB
13 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/RSjKnk5gG5e-YnqyaokaGBofRBYcmQ35b5mWA3AF7Xg.js

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4528ca9e4e601b97be627ab26a891a181a1f44161c990df96f9996037005ed78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 21 Jan 2022 07:15:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 103337
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13497
x-xss-protection: 0
last-modified: Wed, 12 Jan 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 21 Jan 2023 07:15:13 GMT

GET
H3 200 container.html Show response
1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 6661 6 KB
3 KB 64ms
30ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011408.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 22 Jan 2022 11:57:30 GMT
expires: Sun, 22 Jan 2023 11:57:30 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 container.html Show response
1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 3BC3 6 KB
3 KB 50ms
26ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011408.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 22 Jan 2022 11:57:30 GMT
expires: Sun, 22 Jan 2023 11:57:30 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 container.html Show response
1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame BE70 6 KB
3 KB 47ms
29ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011408.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 22 Jan 2022 11:57:30 GMT
expires: Sun, 22 Jan 2023 11:57:30 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 container.html Show response
1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame FF2C 6 KB
3 KB 29ms
29ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011408.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 22 Jan 2022 11:57:30 GMT
expires: Sun, 22 Jan 2023 11:57:30 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 container.html Show response
tpc.googlesyndication.com/safeframe/1-0-38/html/ Frame 09C1 6 KB
3 KB 27ms
26ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011408.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 15 Jan 2022 14:52:28 GMT
expires: Sun, 15 Jan 2023 14:52:28 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 594302
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 87 KB
28 KB 126ms
45ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

90c9017a8a6447588520f38cd94ba14cdb9839c92626aa06bb8a4a1052c2ab7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:30 GMT
content-encoding: gzip
last-modified: Wed, 29 Dec 2021 12:30:43 GMT
server: nginx
etag: W/"61cc54f3-15c19"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jan 2022 11:57:30 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 87E7 624 B
297 B 40ms
39ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN8DEOzLTxid4IC_ATAB&v=APEucNUiKEPDr4iilJUkGrMb-qxWSkAL5KkDsRDU2xp4UmhjdPTRORic7H05ZtbbcKnvdMY1KsD70NcuB1b8G0y8kv9cox9JDItpGk4FI_3Ye_aacxJ0k_c

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sat, 22 Jan 2022 11:57:30 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 3BC3 55 KB
27 KB 71ms
71ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AWUr6dYLt-sIsgxzFTpE-Y_ceSHKLEQYs3YmY_jmmw6Qkmamar-gt_eOoaPNRq4isxG1nrSkvp0--Z3zS1w01veGVJLeAWIuZd1pIpxYljxzLacyBhqCkz41CYapc2XnSMtJDPCTavvm3cCiHlNcdAl94ChQ&dbm_d=AKAmf-DhtWXj7b2dOzxFUgYcjEHbQ4wpI53F118VgreDkgTwCGm5tJzHGGfMKHm86hAVim3ZimrDaDIDmsP6VlkrKTiu-zCnxcK6hcGvDJ1ks346_tbiYpX2KMknChYGAkubCurC7IjCbpLjzNlun3LFFF6mVwfuKcuV5tq3vpBj1HBubmBubarOtsw2OSrwFpO__qnKrSVyk8DYNeXjk6AnT7v-rKMfeVkp4L26E3oG8abkfe-h1qhaAwyN2zWJE0U7y-OFB-ToLAutBE9QCsHtVeWLIZkjpZDVdEW-9LLU97U8qftsJqpnYRXoeeHmTPc3XQnaT_80_tvtr8eFTTjtGZguDXwskYnBxJzs8FFFqO3h__4_21dOwyd8bVxw7v3Fye2o8QdsJEL0IyXdVRyI-DmuZqNnL5cycGT14llKdgAkYwdfPHA3FdxN-FjQ62jDFkolo2K1KxsdCLq7HkHKjfg7j4VoJduUOcZR7mfP4wycOZ2L1bTkK14tnE_SP0pkg-0HKaBjeft-YY7SdMkh_Ogb62sv3E5zKd3r9CRA3u1kWwwSiyTg8aAjcRJwQbaOfOWCRqm-dR-XyZvAq_1Lwf8kgFboD9XpyWa1reBL_fbhKQDwrJB8ZKq71pZ1Sg4KDXx8MlqdqUGP0KcQVQNoKaU2wdr4mn0EBdnSns1NFwQMI7sSZkre0A0-MCBDJjnglmC9yBpcum5COZjEIXOgZZLxnwhdvoKgDZw6gI0AGrMwHtoxB0fIJOG4luHQA2_CT-juGbcv2FumGdkV8NBhbP4aaFv3V1WREEVFAUobDMGOMSgz40SouL1Dv4LB0H7qBO7G1_0qZCsXym2semH4FYeG290ZolZg5i8AWSwKJFyT89T1gbkQS4cYg7vrzBMX0SOqYbWDqu-M-PzNPmxFOlB4TcFIAgt1L-PdbvC8hK3vRaUP9z9wTNWRVgapUlC-pv-HfHhAdgjPWKehu3E7gj6X9PDELVn2jZBWRk-hDG3r-LR1yNSR7ouWygxegV8S8oB4d89gWlKiVymmmcLiCIupBeiKaImgR99vdX_SGsu3rl1nyU1ZWlwc99GmoaP9yxsjkOpPsMVUoqhGbgz5SsW-GbzT9z6gwz7OrvuqfNqPRlC-J2Y9l7y-BxlrkaPg8XsXrGdkd8fqmeHjwQtVou1B58ZIjXg-QEE6ga0nVLf7yVdrS2biZm9SO76OcZIkX30uCIp2OBRcEz2VeJaf32QF6MqwEhHr9AjxWibhbhxWo2gHO2dQNDnJXoTrR1njI4WN7SA-mMNRg6JQsOsjmqEf9iIm0neOnvw9Us62KBuBAU71S3CM4kLlMB6glfEN0_XC1X9X71FJhGvqpzUt2jzJrnRET1plWxhnUaNB6iUgqf6DjRciIpe20e4Q7VSqXXt07i1Vk2tPxdugWYE94sz_NBqaYRpk5xayzb61C9lXgTedYnnDLWu8gJAf6K4jIdYiO1kl5gVzVIEk9NkoGSY_newNsoQGP3Pi5IQFiyx4L6aLcoEkH-eKFB3zg-LCNIhU6t8cw0JcRfNahbEw7QaV8bgyBikqFYon1xpvRX8evO6_UCo9qGk6sfxxA3L_fzdTYVQfPr9CAvbJ8-FrQ1DAd-mBAP7R4zPbzESNixbCyUlXG4bStG1iZ6WGdPOEAwqfpc4hPank6gPoaIbw2RLMK9OXKNHtxb6zsEr2I9PSZ3myfd8_KNStt0yY5vAI8Rh3HY9nld1CX0_CgWwh_PLmBkMHuJ433Z4xnpP4Qactd3bJTSmMAhLhwR8m57utwnWR0pQzr0n8iaL5LnsPycqgkkDL_KOt8BTIXx_pV2WvFg8V_Rp1_wgyYLZCxQOwNSiMBFrbOzs1vBh6LBDXhaEgkdfR_Vu6BEDlXIxQ9aZFxHGK9XFWBqZv9z8DOxQ0zfoVqxI31x3zUMD7lVDo4DHgEPrWYYXSPbqxoxDUwmCZd7u5UwWTdF5Z5F6IIuDtpj6OrCXc0HRkYZ6wiPtnKaD2_sfJr3Oz7eH-ocTNUXVv5zaDytaWch7wKN7ZVaX3j3GChkR7Cwrn-Y6YDrG_ZPTVijudulpiC0L-QbCP6duXUrgz4z9G1hR_hZscjXiX-SgeACrLGv9lozjCfPQNen7xfssQSf2cB5g36NzNZMYDLDnn2t9NCMzg7SmrO7Kn7OEvUVSvge6XsI_WFEiKU6EPw3nge2Jm1PSigIyZOnfHRESCL3A7WzxXOdUAJ8VBQeOcOyk63_Yvgf0EeD9hFUiqV1-3HxMQjvPLExuSJhObrEr0hp4_D-YBRNyN9RDG_bf1r7jXpJomUGOeVTOsWgD0HUbq_Rpj073_Ptk_2jI6VU_mUO5s9vEie4Imq1XTppRewW4N5rkEt7zKwIdt2wSB9KG4cC45p4dHl0KPvM_Jy2Ov9EutbhvBEUzTcnV8HX6KGtuJgOLHdmL6DkIhV1kVaM0aD1dNbUfmyy_j98jKihzGVTqFoWbQ0Ykl2vD3-B4rt5F2qCJezNCw-6ZndgS-E0zgFQC1crr3fep6ZRccEfVIwvTK1I-m9eLapr7gkQdbbZ61Je19P3ec17ZcvLX16UV2LPz2M7H30Gg93az2Ikmtkj15bqV3kkNf-YkPP1UznEw2YAkMdwsbYKRPo3NKy0lhQsU9tDHQbQLUL-nDcqCRPJtckQjI5Enq1uJTMHSiTxqZM62pWdVhbyPwve-zpFPvt0c-o1vHm8xtb7PuNn5mpJn4oY0b_C3qa9ndCR8HKpMCsbFkRMVRfylnj72m7qTvR4qd9WDxDqPrVbD3vVMJHFLXlYY-l3OWdXNcFS7qE8itWigBkHXKWrcW-cAn4ghFRTuaE-trRJeMeex0Lhuq-GR6I0o84H0MnteSVd4s6ArDO31HxPJUWdJNqwuiBcYfRJrgQCgmQP6UH7nGRO-1E9i-naWART4KrnnVvyEYgkzznqXS0UXsbifOUGf0Er97AL45vXQ62Oz--2wxuTkudnhRavi45Z5ekrNV8VxYFYBq&cid=CAASEuRoFDJYlWKpO2IC3uJoofdFsg&rfl=1%2Chttps%253A%252F%252Ffilecr.com%252F%240

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bb66b22249ef74ed86e2133c32652277ec74b660320db46ee1b8bbbee362d799

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:30 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27975
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3BC3 42 B
63 B 57ms
57ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BokzhtlhhQBjuS5uroVyZSHTN11CBPwBut9dD4Hj3SiBWgqddRoNUzo2Yl-QBeK76mZ97X_-OGeLLf3h1uLhvn5-i_lbFhaLMlPHuw3y9rm0g83aU

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/ Frame 3BC3 2 KB
1 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/window_focus_fy2019.js

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:54:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 199
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 05 Feb 2022 11:54:11 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3BC3 122 KB
37 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

425f48a06ab0e9a4a4d792a6677189720f377ec09a073ecdae6232a89cc221f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38060
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1642595990432946"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 22 Jan 2022 11:57:30 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/ Frame 3BC3 15 KB
6 KB 27ms
26ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:56:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 88
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 05 Feb 2022 11:56:02 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 3BC3 0
0 70ms
35ms Image
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRUQ2uZxhOReD3yWSoIAlA_OVmPdcWEbw4wfCTzIK1w1elZrRQe3BU4gZ-HkDe6p65viyuu6uURWM_jhwY9I19oKLuJKA
Requested by: Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 0A23 491 B
329 B 41ms
39ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN8DEOzLTxj43YC_ATAB&v=APEucNXmlkTthWzk2VwB2PRI-W0mB-EiPDD_hJnILW8eO1xvDKiv_V_igG41WgxFm5gJ164PZh96PduwcvWcMokx11BhuTZpRCWbTqJuM8AltGu5SlXhoCU

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9c7f834e42777c25fb6b348a3286ec5d676cdaee610543617c4a9714fcf7dd15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sat, 22 Jan 2022 11:57:30 GMT
server: cafe
cache-control: private
content-length: 308
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame BE70 55 KB
27 KB 77ms
76ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BMRmFO5UaAHLmxiquB1Jm0dA2QrPMdJr5XFMshPvM6ysJIud1SuKGsyIChJn9pI2JjkKSS4ZrPR4ErUqOXMucjxQKTDArJrJih_nz9LsB2n4d7KTYCU6qeWSU8Mt9Fa_yxpqlBzpoDys2p3hvHT2I4nNZ2ow&dbm_d=AKAmf-CExd-plTgaKCrlSjdSypH2FduDz_XaLFohdsInE0bEFxTJwVGUFi6HnYR4DNzMGJrjTuWkSC5ZlUiK2q8g1fK9Coh8FYsoOGC4GwfwpnV3CJ9uaffgs7IjLrghoESsp4KH6R_v2S4itKSwBtSNhYLgDT9h6vkIVXnkH2JpJN_qwGDn16_zNPOvTRjggcOtDNTItI9ut8dS_Rsx_hroVrvKgueU2GF2AelRwsMQ8UIIJ9WZPq_ISDDVxHr95y_a6q2tgYIt-52IroEmTDQlK0OYoYo--JHlvbn7fQM4jiOcJ03x7WbbfzaXhrD1aa9i8M2AU8gkqdoeESK520DezHzx7NJQNfHh9cekuVqsD0jvKg6d9i-3m6wviDqZztcRx2Ky64YyLeDc5BYqWJhBvYBc9oUr2pmObzjNkqkS3RBDgpjRFFm8ZqlCKywGMr7ywXeHfSJK-3lDJIJ4SxIYmyWPfABKzsDrMTjG1cbybI6rw6dJqI597RSFfv45HsY4Gi_iLMiHTAsczCo_mm-7JmCwSwfYqM1QX6xFS4hX25Vkd1p_RrO4J1ipLPQ77XNK0QSbkhtMx7DTlNU5f0kS1e9yfcZ1xKerg-tnVmpK19sBz45BzYNQI7qGMJ5Bq-NuddmeT5EaqjCt1T7eHbiQQ8FfIP2ZARj_N60mFt9oIgA7o9TTDqBQEYZb57LtR49VVtZ6681KYXfQ0oapk9QMK2AY0h41v_4pLyC21ey7cGR8s1HxoRBRdEfLJGgtEBiYvplOD7ixD6ib2crXN3fwEW83dBTgX2ohyPGjWfkfhqDixrt_Ul2YUh4xAnuvFoxwtaWhIx8BjQ7zhAJ9DNfoa4mUnTjJli4tht_txIkEzxwP6tYlbUAsN9ZZTeGmUBjmHIvlI_x_DLnM4EpG3wofiAE2e0ytcuLouBOWiYgJvzM14ZGQu1aAAd4BqP87AWtw7uzAQECshGtjqqmkQUr4EQ8W4we_0h1VBrkZEaT3SkOFcrrnoHmp08I375bVGIGyQQdr6li-auuwoj3ayyK9R4616o8ri5P0Bxh7nqsHvKidmIqzM4LP6sN1c7obJQZis7ljxlDisZG_HhzPkFX5sb5J7vyw3yWCN22ZmL3WjSm2ec19hODSsJaanIUSagLnLDixdAfBClV_WM2y2-QHSELkUxL5flEICaANDQQEiVfEDDSyfPh017ZFZtSkWDH_DvuPFmr9H99ovCEXIvelirefSLZD0fld5r-LXzGkGkDBuQum1mSa0EHs1uYjm1eY7AyLMI7fN8umUdHD1e8iczrBoXGCHKJFxqu2ALmtv8-Frg6-kQhgPeHxW5bsNvHMbDjmwB6BQdRPYog5ug663-8B3gPCiHc9QP-5Zk3mLwh4c3tc6pacSlB21XYV9VH7p8cvIxZqVUo_T6PdMPLRyMiMCnerFCT87l2Il7pxPP4NdpT9b3JoBUU-XSFZoii-RtwvbLdPmoWk5wF7CD8Vx4KfngOcjoDr7qNOF7Kf9BUWap2x67QeoSqhvV23rKX3YptWIDce4nNTMT7qjbRdOei8zjE7Pg5nNOOntTNj8WSZR2R0WXQ8QGLDtt2ZpHggohybiC3FV1WS6h1akYa738W8WIdvK1lUWHQkacxjcNngRB6mHO1GDHC128FXhZubi9CgNd38iU8JDUbX-jS26eRe5YyEQ-j8-STBGrtDHmAl8fAXxyppWZFhqK0WxO6Junp7SUM1tCt_Rjmvca4L88zoi8oDfflHO85C2OlAxwLcCAns8MhE9lCLrQ6Bfq_xOOIeGjHtPeEhLRx1KAFYyqeKPVpuNAdOl_X8D7JLx6YzxV6y05m8xBopGK1tOaHVJrEleBnIvzY0RGXZOHhjr1Pu7p8_22aD_pWCmgxa69ssF2A111naZBrg9LLDxTX8dy1Q3M9EplMa-pRNaqCgBIAXSwOlSn2tTMQcGvcA2tcQMJosVgBlahl6M7IMFgQJTH3ojbRfQ4khl9T1VUMxlzhDBSXIXv93cmdWH9rGnPyjnL2TNihvLASVxSDaeiNMX2FdWrjDZfh5UdFV6qWsJTeJG966FKC66fOySpbuHByekok0azkewfBitRPt9WkN57y3-zXYT8UQNYN3eblJkWNjkyj4AlsYS4fhqXN1Krj80W9sKq-6bt1tCCd2m3GzK_bYhjZPwDb6DjCYVkTlVGtBPCiU0qiZrk4f9vwvqMTrCCznFrdifNLdqs2nZXWsqEhGKzga4BNPPzaJl8-J_wylM_amDRxGV5Ch1cjxAnVw0bABIlzOkiqGb4lXVPCUoLJIxj3oj4Kjv12_y3f2fZ3EieaGfTWwryhcQ2gLlOPnN70ARO2JAZ9OSLACTiWjwAXGpalKqn4VlBqY_Ulumwwcr0AOoxLbqEkREUDPYlKx7gdZnVSjkCGxxVYH1mMRJ2quC9RjKWxSOrfvbF9xlYBdfV9-wr40HvTdCcCoIDZwiLC0tCTCP9ZgPgKzLz_hdoYNPECfxm50CHLKMNk7udR6bHvUi9pa4qaCYkKcdVLm-XHN3S0EiI-b1xLJZHEAVMLho0cb6uhXlPA5R8qGsyIJwtwyjsCaJcgSJkWRyNBxbyrjgFyhwcHpygKR0znjhioR49P285OEFfK2BxM_aAgCUpExiDslk0H8b5Wye5FEi2Y08kCB41ZNzlVopCyWTcpiq40N7IO62HICaVB-_Vv6azB3kuSyxZEfLF-GE-6pAB00-_q0aMtriFColgObjbH3uy_psVuoQQ3pUq1XDp2MJvn-sgf2W_hU0FUdDIl3ef7bXK-QCk-sS9PWzZWkh8S_8hqgKh-XMXM1i824qkFR_-IEs70y8rD-YipTTB2MI1-61TplsCWAjB2ojFEfSy46j-mmSD7GLEfR5wdFhrpBT-rnNHR4Br-8lNevX2FdbOQOB7pLXawHZ-VfMdnfAOtqdgSJ3MmB6-q70okDZ6qpiSOW2W03Bi77fb6TYwljm7KZzY0zd2C28YPjW8FN5qSAnFEa&cid=CAASEuRobWT78qkS64Hx7zsb2aeWdQ&rfl=1%2Chttps%253A%252F%252Ffilecr.com%252F%240

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8b53bb192a1aae1b8b008ad7a10412c1cc359809bc47e821bbee710dd35db7a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:30 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27982
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame BE70 42 B
63 B 58ms
57ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-B3ZQrIMsr6XbVWo73PTEtx6togqxhKoUG3Y3Ifrh6wxvt79ie8E4EG4LbV_bEapsMNS6xMQJ8kYdAfWCAAQgxmZG7qbAxGUAsic1cI_h9evv3nwMU

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/ Frame BE70 2 KB
1 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/window_focus_fy2019.js

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:54:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 199
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 05 Feb 2022 11:54:11 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame BE70 122 KB
37 KB 97ms
96ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

425f48a06ab0e9a4a4d792a6677189720f377ec09a073ecdae6232a89cc221f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38060
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1642595990432946"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 22 Jan 2022 11:57:30 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/ Frame BE70 15 KB
6 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:56:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 88
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 05 Feb 2022 11:56:02 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame BE70 0
0 64ms
34ms Image
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQlkDJ52ij3L0MNva0ejrAYalTra6kzLJQ-SDW_Hx7KvEBAnJq0SGL_TH0qjn39djxCWDQQ2729Rnj3oDWtQKNK494HBQ
Requested by: Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 6661 0
0 123ms
121ms Fetch
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=Cp4HGKvHrYYreD5HKgAehsZm4CLiZ86Jc6bXuu_oCwI23ARABIABg_YKRhOgRggEXY2EtcHViLTIwNDk5NDgxODAwNzkyNjTIAQngAgCoAwGqBJkCT9Alg7xWqAjmuvj-X8hLlDRo_enu8imhyc0czTAuYKi1GXSOqQQlwTBkglHkCj1UY1YJjwl9igsFo6Na-oZKjjPThmYhu1_kpgnh9PShp4DdBHiX3ZHY58Pl6kRfZLegFa1Ua3AA0NAv-J_BrohL7VRdadm6rWmVm22O-1kM-fi5Y9FZgdaMQO3YdRmi2sTTDL6YqXbeShVb-FCKnuhRxhP-Smugm41BRGKezCliEL9_0sPIjjaGcFeu8MidvMZAjpdHYiRUtwvL84rhpndg2drAaMHixN41Nw8NbmRtvegC5RjzNypiaVB4F_IBjxsABdHtXGn-3dAQ1T0piFmdlqzhs6iFiEwPiGP6lGUlGkhPXqgCTUgh3MXgBAGABqP18q-fsIyeZ6AGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBABgAoD-gsCCAGADAHQFQGAFwGyFxwKGhIUcHViLTIwNDk5NDgxODAwNzkyNjQYnJMP&sigh=Fnv73X_ljZE&uach_m=[UACH]&cid=CAQSOwCNIrLMynqRsMI2pDhpJFIjasZKIphVuIc7Fb_JcwZN7Kkk1hc7cNm88tRV2U06vteHWEiGaZ28_R8oGAE&tpd=AGWhJmtuH4LjDE6KJ59IwNH-nXeP7BP-pBaM9mFH_Ku4UzuOnAz4Ih-dFPCG9ChRHFT6THPIyyo26EudU430XM_ZLdxyPBx-aC4ePeIebF-Sui1pQ0h6Dj4k6-PSYuprtWj1R9yW_CZVbunHyfu-EdQmyzM-uLr75_jhyeHttuDLK_jCav10np3mP-mNnDoe5dUjq7qcLoK2bWgbZPoOQKPRUS0KQG7vFFmVBIV8JRv2kzVyL3SlVNUljoETKWGstBdaQV7KWd5qNKpIrhEMcuLd-q0v5SU9jiB-R8-YLll5H9mqZwCZCxK5mD3K7YevNhEXHq3EwM2KZ6LHdmj0rMqmegyejENG-7sEjzpM7e8P3O0_vPx8kyBaKUvZ_CpTzqYP-KShPAyS96Mt3NFsyj6iPw6fetBjb40cY04NNyi7TOoY9yuBPjllhz3vegWHh7BEIYPM9Ewx-GqyxiXYhyNgdMENBCU9a8_OKYZUEGM3QvmR0rcmIfvpmZENNgEODn9VaBNIyXlR51JfMXAs7FcpXbTFciRkufALbAiaHzKyXar_1MJsrD6tROGqRmTrF0o_EQTcNfkfDGXcFmuEXQqocx1lvMQGuZg2qojHBGYCHrftVzuo8xFw3z8daQ0MzdJVk5Fjx0-CtMtkNM-W6RjCVmyfAP2YRBRKem3KRoY5CnUxLkgdfliIZeJi-yn0i1xvD407zUUTZlEdXW3-VCJnKjvW-3hpAb1jFvqK4_C3ftnK5tZlVq18P__VPd31ycrK6gqrqBpSq5tOaEV9REwfMLGIl1pi2JDfo1emV_WT6JPtS3B2mNXWHTOl05P_nsuV_SPbN9DIa8WnDvRPKZXtYkfiIyAg3I8ru8-3Cap64gqS24iLxjZDt6Vfz2_MPYEe3mzY4n-oL0XLdlsqn48EQmWYhy44Gr7EIw4uJZvckCU0SwE38ul0vtV2Ycbnb0nXNXpM0bQDhrDlW9vX1FyBC3t3i450JVRwx8lGgdYnmn7LcnuONBGiKp5c9stcOZI4lx-07n-qGLfvmtH04kc95yifNx5deSIjv15_FjPGEI4p4A4icBxtENMntztPNDMitUvZDOw3NrO7VV_Bp-ZpEf6D3_UWpFKPp8YutRrW6Vp2e7ddOIyLoa4dtMr8BOn1JySFj4B033iPxKmB12Z3UkeEoGNO7hI38L1X3zJB6kRymUtwhs7grgmVnGr3344jbDxHKiL_1Buz69IbYT3zSHNmC9tZu8xmJSAnmscdt46-7DGJbLhR_Hzd8SJ-mvpTcrn5n_pxdR51QpnghukIQfy3WODdAYGM2NKXLdfXOp9gib6-OxwxRGN7UKd06L6R7DP5NG5pOIr-BH0NynO6M2aaa0NG9iJsOoY1RXWTo_oGqMYoKm8dh7jXsRQmOqhZ32RDz4ZAJ4vkOGW8oK30oqR8wWpakRwlcr9lPGMUhMbm3g-_Ct2zxz747Sj_4wNInjjnqkCOBIxoJ3Hi82UVYzWnCsi0bxkj6oJD5ew1QGt2rq4rYyrjm-0oeM9tT98
Requested by: Host: filecr.com
URL: https://filecr.com/en/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.185.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s52-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H2 200 AdDisplayTrackerServlet Show response
pr.ybp.yahoo.com/ab/secure/true/imp/Ale26L6pvdHnTwBdGXzYpScE8tEWXaL6r2ggWE0PVk2rnbpEcjf8iN1uyVlx831-fWYsNgDKr3W0ZelYTkfVb6VqZvRheXtNywI4eNcE1FU3cHRk197fFhRw0jNKeWtzLT8uFdJ4kUrB_oLdIp9QcXUYiYf89S536... Frame 6661 4 KB
4 KB 145ms
66ms Script
text/javascript 2a00:1288:80:800::7001
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://pr.ybp.yahoo.com/ab/secure/true/imp/Ale26L6pvdHnTwBdGXzYpScE8tEWXaL6r2ggWE0PVk2rnbpEcjf8iN1uyVlx831-fWYsNgDKr3W0ZelYTkfVb6VqZvRheXtNywI4eNcE1FU3cHRk197fFhRw0jNKeWtzLT8uFdJ4kUrB_oLdIp9QcXUYiYf89S5369u-puBJAygu1I16rMD4HplXHAsJRy9PvCHYd9jo00JsttyrhnZFJ4Mqs05jL3obMKFZwuK_Q25Xq3L_AoLsDSBVGW08-acjsJlNTFo6XDTemqWnkEVGsTCcMCqKoQuC-TjAYCV2szHQ6Yl513ceALuAJ9ONNQs-VhFDjAmPELXFpZKzCu8dECMYL67pLi8JzNXWzEXQyI-OH4uZJRCdjaPtsWNhPUbPh5d68vGCDH9h297azWS2IW7vRm2wC2YLWPqE4JknlJv4GQ71BVSVcLX61t3KXEE_pv5CgFHPtq6nDRfep8WmJ4IIZXLt976N9HsozSTS57NvQsSkhr7K5b6PeMV9yyxFHMcadvTMGiwQ6NfQcHlqyYIQ35_Ej3hmNWQJxDWDZlGjD505enQjtqTyOAmwhuX7t8_Lx8KiIyS8cdI3az9HfAggcckDI9zR_jQNXq-HqHLFj5L24U120RvL0LTKZ4GUB6FGI377Kw48zg0-77bLWLgNL2mvaxo_yhFj9qcopTAYwpITL2iv5Mn1bPdbqMzPi_VunEtD3eMlVO9rDTehZ5sZPzVhmGYfcZY-t8_6rZun3Gn9Xbr8Bxhtu2iW6nfop4xGgnFGCsAnKLHYjFiSa_qoXKYiLycZ3P0GDG8tUR0QEKica6MIX3TVWZjl_CG0XgNt7bNkL4Bw3d5WPlhiCVDsESYo3hhoHw0HK-bSzmgtLco17KhQh7tvRFAiik4YBWCToNgPu3HZftDlf0-ED37Hy6588TxCevJhLUApKwBxX84A7BDG-khQ0eOnESEbN90QE02jDHx4qin0xWf1PFJnD2YvdgmwZLhVBAl03EKwMkYzwcoGpBz_RnVy1P6Xf9aDktUcC9-rbtneGhcqlmt6r08HVSEWZ55FzvmwDyUWSvN-xTvYKxKhaesJo5rckiMOHb-irDDUyrbbEOnm6tzb7Q_J6rf2QzHyjlqMjUb900zZrY_8DWfBPz6nKBUHLjkqb0FpGplpTjcP0XxEI4vYWRul9PGlIqFChMAbw82_vedU1HbdgqH7_CjaDOWBpckyEkdGOjbPCk6tdU6DSNHDong43F1g5E-2QcmeHZXgOQPWT9HkOhY9TNJVZxD832ULQUJEDdmzS4pV-Fwfi_kRKfpPpWfZ1-33w0KEXnjXueRUMB5Avgdum171YTPAKZ-A2o8VrnVfmq7t-tCYszL4D_tSNwnxuP84imnS0Ub0EgBqImdjS2pp5tFR3RotGIxJbov8Ro0/wp/0.100881/pclick/https://clicktrack.pubmatic.com/AdServer/AdDisplayTrackerServlet?clickData=JnB1YklkPTE1OTg1NSZzaXRlSWQ9NzUwNTI5JmFkSWQ9MzEzNTA3MyZrYWRzaXplaWQ9MzImdGxkSWQ9NjUzNTU3NTImY2FtcGFpZ25JZD0yMzAyNiZjcmVhdGl2ZUlkPTAmdWNyaWQ9MTcxNjc0NDA0NDc3ODE5MDQ3ODQmYWRTZXJ2ZXJJZD0yNDMmaW1waWQ9NDI4RTcwNkMtRTg2MS00MDRFLTkzRjEtRDU4MzAzNzREMjcxJnBhc3NiYWNrPTA=_url=

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7001 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

1eecba0a4d15f565ae689286ba8fbd3bfec5079ee4b52b018736a597a786348b

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:30 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
cache-control: no-store, no-cache, must-revalidate, private, max-age=0
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: text/javascript
x-xss-protection: 1; mode=block
expiry: Thu, 01 Jan 1970 00:00:00 GMT
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
strict-transport-security: max-age=15552000
content-length: 3736
x-content-type-options: nosniff

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/ Frame 6661 2 KB
1 KB 29ms
26ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/window_focus_fy2019.js

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:54:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 199
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 05 Feb 2022 11:54:11 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6661 122 KB
37 KB 93ms
91ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

425f48a06ab0e9a4a4d792a6677189720f377ec09a073ecdae6232a89cc221f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38060
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1642595990432946"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 22 Jan 2022 11:57:30 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/ Frame 6661 15 KB
6 KB 28ms
26ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:56:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 88
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 05 Feb 2022 11:56:02 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 6661 0
0 58ms
33ms Image
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTEOllJ4gf-DlgerZlCdjQCL4xYZ5H2nGE854yYYzk3ztwEmhnT9udu2sRymTQeVJrzcwVRQCXPJEO6qf97utq8ssU-DQ
Requested by: Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame 6661 22 KB
7 KB 30ms
28ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 21 Jan 2022 11:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 88313
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 21 Jan 2023 11:25:37 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame FF2C 0
0 123ms
123ms Fetch
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=Cx8jxKvHrYY3eD5HKgAehsZm4CLiZ86Jc6bXuu_oCwI23ARABIABg_YKRhOgRggEXY2EtcHViLTIwNDk5NDgxODAwNzkyNjTIAQngAgCoAwGqBJcCT9CdlWbZP5jFcTDaBM0RGN5FNg2evh001eLeKOh4tPLrPnuyzzQN8Gaz-yivUtmg_kM0rQNpJoxqtwGoUqY4FjcVzN5ICCJxIOF5SVtrCuMAOXj5_97AzVni8Xk8e9dT6p_LELiTs766o5H_Sd3Amqxy7vflHaegV30a-oFyJH4LHXEbFuQ3lmDrvAEkIyIrSrMJEALtfqWOiwA0q6ts0vB_Nsf55HP9cOkQtHvo9dMw0vtrSp_4-ALP9Za4fmmwqyhVY8UuN1gnTGb8GV2_S8Si8nQQDPrQjYydcVFf4YuleP7jJMcwYxsVgzzElZAWX-ny_GhQAEtSxV7aFBToXfSs8EZm7_yiRoeykAcdONKYJMYdaWKz4AQBgAbc84rU1PncpIsBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAGACgP6CwIIAYAMAdAVAYAXAbIXHAoaEhRwdWItMjA0OTk0ODE4MDA3OTI2NBickw8&sigh=konKx3QiAo4&uach_m=[UACH]&cid=CAQSOwCNIrLMynqRsMI2pDhpJFIjasZKIphVuIc7Fb_JcwZN7Kkk1hc7cNm88tRV2U06vteHWEiGaZ28_R8oGAE&tpd=AGWhJmu6Zv7XnhzSNpWC8rJXeeDxFUPioyAMC3fRz8WZkGAnOCG2C-WWqA8cRlrNnvGzDpnnN2nASOAbWAPM7-_7W2-_E-EDqfGV7D9GLZOKhbV8HEqp1yiTf-xtFlvj3uYudFX71tOxRULu9_Sjy55BWMZlyMJ2sJ4ZeBEnDwoEzr4gb5RXx6rmYtD4DEmzmAGobH7VQD9KOZjWashAW2ED5PisL72xjbPNVuEjlyZC07clOkvl6nlPCyelc4BfPegs9TPGvw-092l258dSk1Bpz7uKX5bMxShgGb-lWSq8-p6c6Szm0PUD2g1eVY4U_VeuxiNnS4Jw6WzQGErFgoU6NjdWetX0JNYVx7Tv07SIztnJSvMSeN7kdfOTAEpzyAWXNQwdpNvKzd9CG24QFLTKYTaiWU0b32tzgytDdUq64Qczu5X-k2D5h9MpkI9hzxE6k10Acn5oh3CJ4QqNVOoGTZa8FbjsgLX-co8SwmJkYYgMZyhFo0s6SZYSqX5nODeV5Mhq__34trxE1VTlOkf0z-8V4bMX8RXXQtdme4ShLoQD4LwC6QnGXsNK-ahiNEDXqwo7lE1Gj1SVitg_oZ_9gHbQn708fh8xAdeJ0I0ns0OOARW8_JP5T1SsgCiBDia3WH7lwPsxBeMm3-TQpBXgqyVu8h2aB4sOxDbEPHk6pjn4X_rru4no77vSb6bAc4_jdsT1uDNJXYoMtGjGf9DnnTaFVKA_33kArXLV47hovn3ba6jx_Z0wxIYxvvxQEUmafd2oz15rGpHcNiZtperASu2uwaQ1kLBsG7fsBVt1SzoVq_hDmpIS9p4r7pATETNaQrn7q3iSl9Rn8_IdIumpB0K1z2j00gVYSoxtfIu-mu00lLOrnl5FsojwW-SozfdbLQpWusIxw83H6qTqK7PFjjRE91wvXcsPavLLvw4KmV7sUlexMUegN2R60_FzVbpHiT17qUETf6zwuOT5QRiAsneptyxqCEjDpQMnJQYEZW9b3T8nTrmiSLY3Hf93eq2enBVa2L7LOczJi7re6x7ToZ5UhQk2EOzNlF2PbinBM1e2jQPltF-XthI8BYrHKQrnpzk5bU_s2FqNNVJ12y9Ql7o4l4h_mTCNpLxchIVBoJDM1lpQOv3CxAuJjisQLsvMoNcRV-WAjtKVhB0zEkdDvYM8eW8gtnodfc7NQVoi9KnpV0PQKPsZS0Pm160CovKuQ6HMb-pvk3gVahddIl8a7LtThXGWNzoH7x6vHCiIV2cJVml35KOOTPJamNdtXSaKj-EVaDoBXd0VX2kOUdkC-UnB9Uowyy4NPAsjYcpApJxbe4kjEkNCkYnQyxmPPxIIWsTSsGdEblo1m0NTCD8bjRdSucs8cyi5o2kFbdPWxj14a7oJ4YIVHX6oCJL5_tLT5CWtHJxv7bz0Xq6B0ATP1i2bhPhSaf2biOWqs7zqFsAzgVigYM4fHbqkWvz91QVZZIXhEX0km_Q6Q4YNf2KaUOngKU-uUasBkAgOcyJSjdyxZrinOkTbgmwDkJgr
Requested by: Host: filecr.com
URL: https://filecr.com/en/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.185.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s52-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H2 200 AdDisplayTrackerServlet Show response
pr-preprod-2.ybp.yahoo.com/ab/secure/true/imp/uDxMKLKfPYJ89ZaENpup0LsafrCDLQVs2SNV08ohPpyFh9lg6YP2LulmvRdd-vMHsguORn0-c1eoqdwSM0ZsYwB9Qf7HGJyCaPOAFnlATHKoANRS2xE-if9185a_sBVmyRRPQBq4HwZOhkjNeHQSakf... Frame FF2C 4 KB
4 KB 304ms
58ms Script
text/javascript 212.82.100.179
YAHOO-IRD

General

Check archive.org

Show headers Download Go to

Full URL

https://pr-preprod-2.ybp.yahoo.com/ab/secure/true/imp/uDxMKLKfPYJ89ZaENpup0LsafrCDLQVs2SNV08ohPpyFh9lg6YP2LulmvRdd-vMHsguORn0-c1eoqdwSM0ZsYwB9Qf7HGJyCaPOAFnlATHKoANRS2xE-if9185a_sBVmyRRPQBq4HwZOhkjNeHQSakfBmMrn-2zGWyxrSQUbRrFp8Qz90foKjc3wxrOx1EUNJ7Z8Epf3TMHBYxC3IEPWifO5yJ6vdwyyYU8wTRnJbdtL2PSSoWJqTq-g0X0MXai2Tc7BIvHhYyvxD47AqL51sWo1t0w7Ic2gQ51J4I6YGtVBxfThDXtY4VNFkU7ypg8NEeoBcLx6F1-fgde04SM_dFd_aDcsYBgyEILxU01T7QoLetRZBygvuHTG5CwiLu7FD7ysChWNr3I44lpT7S1R7s4eHJYZlEhJh70IOgCwwXwrg8nGRM2w1p3SwdJ30RJ7nxI0je2_9oZBRfUdyvOF4hj_Z4lNbAeobhJmhyVnNMLaZFWiVojNvdLPM61NdKZYtyWPLoyRgblyo4Q0TjyN_2JbxRfjprqQWbvgyHPTPqj0Ef99Bdmn0MiZjQWqNSLxYUp9RTrIebsz1WUq4lRULSe8OwPN7iA7HpIOL2j_G__KIFSLUOYrTWK_zxZlTlm4G2VRo-RyN71nZGPprTp_rDLzN9xo8g9ZV8xODGyu832_I7YftE7NHOe51Qmo3wmlNrevO7-_n9AvBiqgQysd4sgT2DTosSsPSTslrYXlUAdQq4oXbqmSEBd6zOjYl5pK7tBzX-DR6RJaYuz6ubDTUFOTw_uahDqPV3fzwUU8OSYlZ6xHg4_2AtNFWjFXP41_TdPBrid6gwmnJ39xD6_WRbeOdc2qa3C8UDbYXqICfstOVYSOXibOIC1WyGhFSvhL6ly2GBNjqJM8iLZ6KsLTkBOk2zyulQwVuLmwimV0UYfxfpxHyRwvtx8TSskhgXi3M0szlFVbT_WMqW26sERv2LdsQYmPdi2FkDRS1d2oySJnsRmSvh8ynNLE7xNegOLBPRSIu_h7Mpu0ziW139xk_t7zqCgqMYH6EDjKlx_rKmCpQuHf55BQ7ZFCgHbpD6IoPKuXaCsWpDAd9s4T5GRQ44gL4EN7Ozh-eqQtgv7VYJkh5zZPtxFn8Pc3oboieFLoIM4fhgteHO1gAGQXJZnOfyN8-g9JR1vRbjuiL5JXZifA1O9n3dJxI3tYBVvBGM6u4cFIVL7g64Cy6WC01_SMV13I8eXoyVujp_G1rtaFnyYCJf-HKLYfxL7cd8Cu_Enky1UuFTUvnzhWw_DkfbDM3d5plBhOqa52UJVKCzlR35GY2oOeTAfR2rH62JNpXW7M91bfUbVdbdw5HD5JeRTdRogb73vbJr3BbOgiMQLlxRbv9boPmlYgEoo4iEqxEEI3fdKAXaHGSPb-1wp70O4Hiw/wp/0.075000/pclick/https://clicktrack.pubmatic.com/AdServer/AdDisplayTrackerServlet?clickData=JnB1YklkPTE1OTg1NSZzaXRlSWQ9NzUwNTI5JmFkSWQ9MzEzNTA3MyZrYWRzaXplaWQ9NyZ0bGRJZD02NTM1NTc1MiZjYW1wYWlnbklkPTIzMDI2JmNyZWF0aXZlSWQ9MCZ1Y3JpZD0xMDk0NzY0MjQ0NTIwNDA3MTQyMiZhZFNlcnZlcklkPTI0MyZpbXBpZD01QzcwMTIwMi1GQTY5LTQxRDctQkJFQS0zQzAyREZCMjZDOUImcGFzc2JhY2s9MA==_url=

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.179 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

799f177263a481b39f87847459b46d188a6754bc5309ba956b0f892e4d9899f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
x-content-type-options: nosniff
server: ATS
cache-control: no-store, no-cache, must-revalidate, private, max-age=0
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: text/javascript
expiry: Thu, 01 Jan 1970 00:00:00 GMT
content-length: 3745
x-xss-protection: 1; mode=block
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/ Frame FF2C 2 KB
1 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/window_focus_fy2019.js

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:54:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 199
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 05 Feb 2022 11:54:11 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame FF2C 122 KB
37 KB 97ms
97ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

425f48a06ab0e9a4a4d792a6677189720f377ec09a073ecdae6232a89cc221f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38060
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1642595990432946"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 22 Jan 2022 11:57:30 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/ Frame FF2C 15 KB
6 KB 29ms
28ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220119/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:56:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 88
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 05 Feb 2022 11:56:02 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame FF2C 0
0 55ms
34ms Image
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRTvaOrcz7FJsX71WXIuh81r5jR3-Q8GO2-QgW0ozK-323CZ-nc3gjwucTv2gyBeuBKTi7OTmbLZ4SkZDpO75wMruttlw
Requested by: Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame FF2C 22 KB
7 KB 29ms
28ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 21 Jan 2022 11:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 88313
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 21 Jan 2023 11:25:37 GMT

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame 09C1 22 KB
7 KB 28ms
27ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/safeframe/1-0-38/html/container.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 21 Jan 2022 11:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 88313
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 21 Jan 2023 11:25:37 GMT

GET
H/1.1 200
OK ttj Show response
secure.adnxs.com/ Frame 09C1 8 KB
4 KB 361ms
293ms Script
application/javascript 185.33.221.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?id=18678115&size=728x90&cb=1098125677&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjsslU80VlFR-XZ0g_CDpnFF03ea2qkWBR9THJGCI36mQM3x0DwOeTyD1z1s2DSJ3vuIN2v03FIOJG3zZXiThQ4lOw_ViZgo7f9ax5-ALOubjSvO2PLXIzRsUPfSxLED-fSbD9CTAIZMPhYh0yCaOgtOwk5NDMU3L5dfya93AyHyJabTvhA3UQoIMIZJs5GQsluP9ECPyC39vquL7MFkOJ2pOONtBaW1hMcEVv2I3iZonC6Edh_IzZRdDbhLZUCnVbMIhegIK9yBBRiY2BnNiwqdplSVttUok5ChcVWcXQs4ldq-GZNXQ0RN58r3ZRsjm7M8%2526sig%253DCg0ArKJSzGn5c4Ir3gpJEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.90 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

a1068c80c482b73263556078ce822e96618174af3c1e5eb63aa9a3c6597fcd6a

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Sat, 22 Jan 2022 11:57:31 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 192.145.127.216; 192.145.127.216; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 7e0443b6-c92e-4887-a086-949d6db7cab8
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 09C1 122 KB
37 KB 110ms
110ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

425f48a06ab0e9a4a4d792a6677189720f377ec09a073ecdae6232a89cc221f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38060
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1642595990432946"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 22 Jan 2022 11:57:30 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 87E7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGY6L_dcsaz2nMLpW4P1kfU&google_cver=1

43 B
1013 B

81ms
47ms

Image
image/gif

92.122.147.230
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGY6L_dcsaz2nMLpW4P1kfU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN8DEOzLTxid4IC_ATAB&v=APEucNUiKEPDr4iilJUkGrMb-qxWSkAL5KkDsRDU2xp4UmhjdPTRORic7H05ZtbbcKnvdMY1KsD70NcuB1b8G0y8kv9cox9JDItpGk4FI_3Ye_aacxJ0k_c
Protocol: HTTP/1.1
Server: 92.122.147.230 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-147-230.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:31 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sat, 22 Jan 2022 11:57:31 GMT

Redirect headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:30 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGY6L_dcsaz2nMLpW4P1kfU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 87E7
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YevxKnyJKLqIfUTBWDuIGgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGY6L_dcsaz2nMLpW4P1kfU&google_cver=1

43 B
893 B

48ms
47ms

Image
image/gif

92.122.147.230
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGY6L_dcsaz2nMLpW4P1kfU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN8DEOzLTxid4IC_ATAB&v=APEucNUiKEPDr4iilJUkGrMb-qxWSkAL5KkDsRDU2xp4UmhjdPTRORic7H05ZtbbcKnvdMY1KsD70NcuB1b8G0y8kv9cox9JDItpGk4FI_3Ye_aacxJ0k_c
Protocol: HTTP/1.1
Server: 92.122.147.230 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-147-230.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:31 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sat, 22 Jan 2022 11:57:31 GMT

Redirect headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGY6L_dcsaz2nMLpW4P1kfU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 87E7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESENcHABC-8FVSSRP3Xb-4Nkc&google_cver=1

43 B
1008 B

72ms
67ms

Image
image/gif

185.33.221.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESENcHABC-8FVSSRP3Xb-4Nkc&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN8DEOzLTxid4IC_ATAB&v=APEucNUiKEPDr4iilJUkGrMb-qxWSkAL5KkDsRDU2xp4UmhjdPTRORic7H05ZtbbcKnvdMY1KsD70NcuB1b8G0y8kv9cox9JDItpGk4FI_3Ye_aacxJ0k_c

Protocol

HTTP/1.1

Server

185.33.221.90 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:31 GMT
X-Proxy-Origin: 192.145.127.216; 192.145.127.216; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 480ad5df-b648-4e23-b1fe-df56d12e3c67
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:30 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESENcHABC-8FVSSRP3Xb-4Nkc&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 87E7
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA0NzI5NzgxMDI2NDA0ODEwMg%3D%3D

170 B
243 B

77ms
36ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA0NzI5NzgxMDI2NDA0ODEwMg%3D%3D

Requested by

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:30 GMT
X-Proxy-Origin: 192.145.127.216; 192.145.127.216; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: d4cc9f34-7c76-4997-88d7-075346498ec6
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA0NzI5NzgxMDI2NDA0ODEwMg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 0A23
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEKMXYOOfWLc01TrzmRp0nXQ&google_cver=1

43 B
61 B

56ms
35ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEKMXYOOfWLc01TrzmRp0nXQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN8DEOzLTxj43YC_ATAB&v=APEucNXmlkTthWzk2VwB2PRI-W0mB-EiPDD_hJnILW8eO1xvDKiv_V_igG41WgxFm5gJ164PZh96PduwcvWcMokx11BhuTZpRCWbTqJuM8AltGu5SlXhoCU
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
via: 1.1 google
server: OXGW/17.1.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:30 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEKMXYOOfWLc01TrzmRp0nXQ&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 0A23 43 B
305 B 81ms
34ms Image
image/gif 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN8DEOzLTxj43YC_ATAB&v=APEucNXmlkTthWzk2VwB2PRI-W0mB-EiPDD_hJnILW8eO1xvDKiv_V_igG41WgxFm5gJ164PZh96PduwcvWcMokx11BhuTZpRCWbTqJuM8AltGu5SlXhoCU
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:30 GMT
content-encoding: gzip
server: OXGW/17.1.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
via: 1.1 google
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 204 v1
ads.yahoo.com/cms/ Frame 0A23 0
298 B 462ms
34ms Image
text/plain 2a00:1288:80:800::7001
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?esig=1~b04e41039133c73fafd60e0ed8cb49a70ecfb061&nwid=10000483131&sigv=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN8DEOzLTxj43YC_ATAB&v=APEucNXmlkTthWzk2VwB2PRI-W0mB-EiPDD_hJnILW8eO1xvDKiv_V_igG41WgxFm5gJ164PZh96PduwcvWcMokx11BhuTZpRCWbTqJuM8AltGu5SlXhoCU

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7001 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:31 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 09C1 0
0 72ms
72ms Fetch
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuzj4b5L9XU15_eu6j7sehv4OgQFFDRIuELuFLXsDpB76-jEI_wAO33M_u44Kt83LD7ufASiL2m2thmhby_7wYbyZ4tui23QOxTHe5GdlgUCgbBLPbE8g6CU72E4yUMfFD7vzF4cYSmiiviFo0nikxkLGjHjsi8988q-e2XSp-dyPiikd_FVB7IgEBH8zmyn4sfzk3YhYPyDnXfiuM9dRIK2516jeuTXQT0mpIlhJG7pezTyIaj_AlXboyHLphRwDNGoZKVO7YY9QogqkxECq0Ye0HDKfUgHihV8wnC3mZAvU4WsOuSqd5Vu4-5e3OqVJrJTRM&sig=Cg0ArKJSzL5YNQlHBlv7EAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 22 Jan 2022 11:57:30 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220119/r20110914/ Frame 3BC3 24 KB
9 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220119/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AWUr6dYLt-sIsgxzFTpE-Y_ceSHKLEQYs3YmY_jmmw6Qkmamar-gt_eOoaPNRq4isxG1nrSkvp0--Z3zS1w01veGVJLeAWIuZd1pIpxYljxzLacyBhqCkz41CYapc2XnSMtJDPCTavvm3cCiHlNcdAl94ChQ&dbm_d=AKAmf-DhtWXj7b2dOzxFUgYcjEHbQ4wpI53F118VgreDkgTwCGm5tJzHGGfMKHm86hAVim3ZimrDaDIDmsP6VlkrKTiu-zCnxcK6hcGvDJ1ks346_tbiYpX2KMknChYGAkubCurC7IjCbpLjzNlun3LFFF6mVwfuKcuV5tq3vpBj1HBubmBubarOtsw2OSrwFpO__qnKrSVyk8DYNeXjk6AnT7v-rKMfeVkp4L26E3oG8abkfe-h1qhaAwyN2zWJE0U7y-OFB-ToLAutBE9QCsHtVeWLIZkjpZDVdEW-9LLU97U8qftsJqpnYRXoeeHmTPc3XQnaT_80_tvtr8eFTTjtGZguDXwskYnBxJzs8FFFqO3h__4_21dOwyd8bVxw7v3Fye2o8QdsJEL0IyXdVRyI-DmuZqNnL5cycGT14llKdgAkYwdfPHA3FdxN-FjQ62jDFkolo2K1KxsdCLq7HkHKjfg7j4VoJduUOcZR7mfP4wycOZ2L1bTkK14tnE_SP0pkg-0HKaBjeft-YY7SdMkh_Ogb62sv3E5zKd3r9CRA3u1kWwwSiyTg8aAjcRJwQbaOfOWCRqm-dR-XyZvAq_1Lwf8kgFboD9XpyWa1reBL_fbhKQDwrJB8ZKq71pZ1Sg4KDXx8MlqdqUGP0KcQVQNoKaU2wdr4mn0EBdnSns1NFwQMI7sSZkre0A0-MCBDJjnglmC9yBpcum5COZjEIXOgZZLxnwhdvoKgDZw6gI0AGrMwHtoxB0fIJOG4luHQA2_CT-juGbcv2FumGdkV8NBhbP4aaFv3V1WREEVFAUobDMGOMSgz40SouL1Dv4LB0H7qBO7G1_0qZCsXym2semH4FYeG290ZolZg5i8AWSwKJFyT89T1gbkQS4cYg7vrzBMX0SOqYbWDqu-M-PzNPmxFOlB4TcFIAgt1L-PdbvC8hK3vRaUP9z9wTNWRVgapUlC-pv-HfHhAdgjPWKehu3E7gj6X9PDELVn2jZBWRk-hDG3r-LR1yNSR7ouWygxegV8S8oB4d89gWlKiVymmmcLiCIupBeiKaImgR99vdX_SGsu3rl1nyU1ZWlwc99GmoaP9yxsjkOpPsMVUoqhGbgz5SsW-GbzT9z6gwz7OrvuqfNqPRlC-J2Y9l7y-BxlrkaPg8XsXrGdkd8fqmeHjwQtVou1B58ZIjXg-QEE6ga0nVLf7yVdrS2biZm9SO76OcZIkX30uCIp2OBRcEz2VeJaf32QF6MqwEhHr9AjxWibhbhxWo2gHO2dQNDnJXoTrR1njI4WN7SA-mMNRg6JQsOsjmqEf9iIm0neOnvw9Us62KBuBAU71S3CM4kLlMB6glfEN0_XC1X9X71FJhGvqpzUt2jzJrnRET1plWxhnUaNB6iUgqf6DjRciIpe20e4Q7VSqXXt07i1Vk2tPxdugWYE94sz_NBqaYRpk5xayzb61C9lXgTedYnnDLWu8gJAf6K4jIdYiO1kl5gVzVIEk9NkoGSY_newNsoQGP3Pi5IQFiyx4L6aLcoEkH-eKFB3zg-LCNIhU6t8cw0JcRfNahbEw7QaV8bgyBikqFYon1xpvRX8evO6_UCo9qGk6sfxxA3L_fzdTYVQfPr9CAvbJ8-FrQ1DAd-mBAP7R4zPbzESNixbCyUlXG4bStG1iZ6WGdPOEAwqfpc4hPank6gPoaIbw2RLMK9OXKNHtxb6zsEr2I9PSZ3myfd8_KNStt0yY5vAI8Rh3HY9nld1CX0_CgWwh_PLmBkMHuJ433Z4xnpP4Qactd3bJTSmMAhLhwR8m57utwnWR0pQzr0n8iaL5LnsPycqgkkDL_KOt8BTIXx_pV2WvFg8V_Rp1_wgyYLZCxQOwNSiMBFrbOzs1vBh6LBDXhaEgkdfR_Vu6BEDlXIxQ9aZFxHGK9XFWBqZv9z8DOxQ0zfoVqxI31x3zUMD7lVDo4DHgEPrWYYXSPbqxoxDUwmCZd7u5UwWTdF5Z5F6IIuDtpj6OrCXc0HRkYZ6wiPtnKaD2_sfJr3Oz7eH-ocTNUXVv5zaDytaWch7wKN7ZVaX3j3GChkR7Cwrn-Y6YDrG_ZPTVijudulpiC0L-QbCP6duXUrgz4z9G1hR_hZscjXiX-SgeACrLGv9lozjCfPQNen7xfssQSf2cB5g36NzNZMYDLDnn2t9NCMzg7SmrO7Kn7OEvUVSvge6XsI_WFEiKU6EPw3nge2Jm1PSigIyZOnfHRESCL3A7WzxXOdUAJ8VBQeOcOyk63_Yvgf0EeD9hFUiqV1-3HxMQjvPLExuSJhObrEr0hp4_D-YBRNyN9RDG_bf1r7jXpJomUGOeVTOsWgD0HUbq_Rpj073_Ptk_2jI6VU_mUO5s9vEie4Imq1XTppRewW4N5rkEt7zKwIdt2wSB9KG4cC45p4dHl0KPvM_Jy2Ov9EutbhvBEUzTcnV8HX6KGtuJgOLHdmL6DkIhV1kVaM0aD1dNbUfmyy_j98jKihzGVTqFoWbQ0Ykl2vD3-B4rt5F2qCJezNCw-6ZndgS-E0zgFQC1crr3fep6ZRccEfVIwvTK1I-m9eLapr7gkQdbbZ61Je19P3ec17ZcvLX16UV2LPz2M7H30Gg93az2Ikmtkj15bqV3kkNf-YkPP1UznEw2YAkMdwsbYKRPo3NKy0lhQsU9tDHQbQLUL-nDcqCRPJtckQjI5Enq1uJTMHSiTxqZM62pWdVhbyPwve-zpFPvt0c-o1vHm8xtb7PuNn5mpJn4oY0b_C3qa9ndCR8HKpMCsbFkRMVRfylnj72m7qTvR4qd9WDxDqPrVbD3vVMJHFLXlYY-l3OWdXNcFS7qE8itWigBkHXKWrcW-cAn4ghFRTuaE-trRJeMeex0Lhuq-GR6I0o84H0MnteSVd4s6ArDO31HxPJUWdJNqwuiBcYfRJrgQCgmQP6UH7nGRO-1E9i-naWART4KrnnVvyEYgkzznqXS0UXsbifOUGf0Er97AL45vXQ62Oz--2wxuTkudnhRavi45Z5ekrNV8VxYFYBq&cid=CAASEuRoFDJYlWKpO2IC3uJoofdFsg&rfl=1%2Chttps%253A%252F%252Ffilecr.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b7c55617f84818daf4c70cc10ada26ddd5b582b1d1c2c2829b3220487a6db477

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:53:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 236
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9544
x-xss-protection: 0
server: cafe
etag: 6261108306223674270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 05 Feb 2022 11:53:34 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220119/r20110914/elements/html/ Frame 3BC3 8 KB
3 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220119/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:51:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 378
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 05 Feb 2022 11:51:12 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 3BC3 0
571 B 161ms
72ms Ping
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstPXrDov0GbHLXolJE1Coq9REfQ4OYdSmNQkU4AxkEdbmp7z2ZsWKB9WtILCc_VAs4RXynY4aZUGdBTLUK68wUIt-g-DaSQFPXyrts6ipBYjVzl1pwXMDAlBz7n8IW8IfFIHFaFtPG22-QA8yEhvmtpec4ZiUtsfc8SoT6DNPD2Wse7rzCY3kI1MkQMeGVO-sthYr4eIpzGwtIOeNLIJBCWaMS_h95wWpJwxqxafHuWT7ffkQNOF_PJ_6EiUFYjXgW72aSG_XjtVS9XYSh11G_al4nl9WTGuXt9pGrZ_7WG5fob5YmaNk8m2debjlyTDl5PJf1NSPGZWTI0HGJRO9pXthCUSgIw5qidYF4jl0iJuagjn_s2979HLy1wXY3AEnWyU_cFR9gOPdx1cEWaZUdjKzNA4rV8d04g2vDzTD1eC5akICosyS_lHVbe-PWYU8nvESotdwZHzjkUEeu_cEY4ZDHubvwSvEuLUj-fVe20trXx0ipsWPAVm7Fjhzx8MaK0MlGEIbFADt296b-B1bykBABn5Wgaq_ksCETXGZ094eEvFiBB0_KrN39vJs0qNSKhVP5ABeyg68F-BMybYVaizxfdID2m_fuASU8tNcANNJgVD5s829lHzMbG5Sl_oxBypz7CGS6gMqzgqn2tycHUdPX4DxVVd2t0AbCIBlBDysWV_8QGchlvrXVl_vSr3mZu5qBFdFZnYUEXLEp9G4XyMMkQ4xJTuzOXTRQKq6DT61MlxScIkIsgsBSOwSkUJ16j5iuo71V5YjYqeRoTntOVHx6baJbYZDZg91y-gkrqjbwSf7mlYA_PzMqasAz4HZMHc0E1k86TVwkWfUD1gRfP1vP9tUezkthbzy86_1cw0MEr_IBeIeqVD50mxeJP7zGEOZoimGtd0mAPNk3FNVdJHh7qD0iNxL_QL0x2_H8l2oS4OQlIIApVZIw6j2ibkJ3VKx6Hx-XsATPKlUyAVZx8b4daKNBBRzAaVDE2dlnNu7tXDXzXsFETaX9J2Apsjipwgkw1TDm2_KAZms0f9gfC86UyrK8EC71pux78YFr4SHjNNriKx5IrzkGhWO6crazi8zhI2uZegg91jHrPOhcEqXI3H5IycPKRJZj95g9i_NKekZdEE_YePxtbS53sXhGWClPP-HURHYOyANboYlw-13UnQedofXSID79pKmsi1ATicPADXos1rx6F58mzYN3KRVzcJ2Y&sai=AMfl-YTpPDpSh8286Uwu6iY5al7YUvq6IrATy1j7iTeSAc1WB0KMPobQuyVcYWZAFTCNVmecE2vIJUv1lfplj-IHRiGSfSSHkFy-Xmq4gkKKDSoghnkuxYUH1KrfeYaqmIjIlS9ngqo2Eqhxy5hKSxbkTZ-fNJLKWg&sig=Cg0ArKJSzP8B1JliD3aEEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20220119.71748&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Sat, 22 Jan 2022 11:57:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 3BC3 41 KB
15 KB 29ms
28ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 15:54:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 245008
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Jan 2023 15:54:02 GMT

GET
H2 200 11541819902754084790
s0.2mdn.net/simgad/ Frame 3BC3 133 KB
134 KB 126ms
60ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/11541819902754084790

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

91c87dbbca860c3c6912a014c98e2a50d119de4d85c80228d1e55f27f9bed4e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 18:04:10 GMT
x-content-type-options: nosniff
age: 410000
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 136703
x-xss-protection: 0
last-modified: Thu, 06 Jan 2022 13:22:28 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 17 Jan 2023 18:04:10 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220119/r20110914/ Frame BE70 24 KB
9 KB 32ms
27ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220119/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BMRmFO5UaAHLmxiquB1Jm0dA2QrPMdJr5XFMshPvM6ysJIud1SuKGsyIChJn9pI2JjkKSS4ZrPR4ErUqOXMucjxQKTDArJrJih_nz9LsB2n4d7KTYCU6qeWSU8Mt9Fa_yxpqlBzpoDys2p3hvHT2I4nNZ2ow&dbm_d=AKAmf-CExd-plTgaKCrlSjdSypH2FduDz_XaLFohdsInE0bEFxTJwVGUFi6HnYR4DNzMGJrjTuWkSC5ZlUiK2q8g1fK9Coh8FYsoOGC4GwfwpnV3CJ9uaffgs7IjLrghoESsp4KH6R_v2S4itKSwBtSNhYLgDT9h6vkIVXnkH2JpJN_qwGDn16_zNPOvTRjggcOtDNTItI9ut8dS_Rsx_hroVrvKgueU2GF2AelRwsMQ8UIIJ9WZPq_ISDDVxHr95y_a6q2tgYIt-52IroEmTDQlK0OYoYo--JHlvbn7fQM4jiOcJ03x7WbbfzaXhrD1aa9i8M2AU8gkqdoeESK520DezHzx7NJQNfHh9cekuVqsD0jvKg6d9i-3m6wviDqZztcRx2Ky64YyLeDc5BYqWJhBvYBc9oUr2pmObzjNkqkS3RBDgpjRFFm8ZqlCKywGMr7ywXeHfSJK-3lDJIJ4SxIYmyWPfABKzsDrMTjG1cbybI6rw6dJqI597RSFfv45HsY4Gi_iLMiHTAsczCo_mm-7JmCwSwfYqM1QX6xFS4hX25Vkd1p_RrO4J1ipLPQ77XNK0QSbkhtMx7DTlNU5f0kS1e9yfcZ1xKerg-tnVmpK19sBz45BzYNQI7qGMJ5Bq-NuddmeT5EaqjCt1T7eHbiQQ8FfIP2ZARj_N60mFt9oIgA7o9TTDqBQEYZb57LtR49VVtZ6681KYXfQ0oapk9QMK2AY0h41v_4pLyC21ey7cGR8s1HxoRBRdEfLJGgtEBiYvplOD7ixD6ib2crXN3fwEW83dBTgX2ohyPGjWfkfhqDixrt_Ul2YUh4xAnuvFoxwtaWhIx8BjQ7zhAJ9DNfoa4mUnTjJli4tht_txIkEzxwP6tYlbUAsN9ZZTeGmUBjmHIvlI_x_DLnM4EpG3wofiAE2e0ytcuLouBOWiYgJvzM14ZGQu1aAAd4BqP87AWtw7uzAQECshGtjqqmkQUr4EQ8W4we_0h1VBrkZEaT3SkOFcrrnoHmp08I375bVGIGyQQdr6li-auuwoj3ayyK9R4616o8ri5P0Bxh7nqsHvKidmIqzM4LP6sN1c7obJQZis7ljxlDisZG_HhzPkFX5sb5J7vyw3yWCN22ZmL3WjSm2ec19hODSsJaanIUSagLnLDixdAfBClV_WM2y2-QHSELkUxL5flEICaANDQQEiVfEDDSyfPh017ZFZtSkWDH_DvuPFmr9H99ovCEXIvelirefSLZD0fld5r-LXzGkGkDBuQum1mSa0EHs1uYjm1eY7AyLMI7fN8umUdHD1e8iczrBoXGCHKJFxqu2ALmtv8-Frg6-kQhgPeHxW5bsNvHMbDjmwB6BQdRPYog5ug663-8B3gPCiHc9QP-5Zk3mLwh4c3tc6pacSlB21XYV9VH7p8cvIxZqVUo_T6PdMPLRyMiMCnerFCT87l2Il7pxPP4NdpT9b3JoBUU-XSFZoii-RtwvbLdPmoWk5wF7CD8Vx4KfngOcjoDr7qNOF7Kf9BUWap2x67QeoSqhvV23rKX3YptWIDce4nNTMT7qjbRdOei8zjE7Pg5nNOOntTNj8WSZR2R0WXQ8QGLDtt2ZpHggohybiC3FV1WS6h1akYa738W8WIdvK1lUWHQkacxjcNngRB6mHO1GDHC128FXhZubi9CgNd38iU8JDUbX-jS26eRe5YyEQ-j8-STBGrtDHmAl8fAXxyppWZFhqK0WxO6Junp7SUM1tCt_Rjmvca4L88zoi8oDfflHO85C2OlAxwLcCAns8MhE9lCLrQ6Bfq_xOOIeGjHtPeEhLRx1KAFYyqeKPVpuNAdOl_X8D7JLx6YzxV6y05m8xBopGK1tOaHVJrEleBnIvzY0RGXZOHhjr1Pu7p8_22aD_pWCmgxa69ssF2A111naZBrg9LLDxTX8dy1Q3M9EplMa-pRNaqCgBIAXSwOlSn2tTMQcGvcA2tcQMJosVgBlahl6M7IMFgQJTH3ojbRfQ4khl9T1VUMxlzhDBSXIXv93cmdWH9rGnPyjnL2TNihvLASVxSDaeiNMX2FdWrjDZfh5UdFV6qWsJTeJG966FKC66fOySpbuHByekok0azkewfBitRPt9WkN57y3-zXYT8UQNYN3eblJkWNjkyj4AlsYS4fhqXN1Krj80W9sKq-6bt1tCCd2m3GzK_bYhjZPwDb6DjCYVkTlVGtBPCiU0qiZrk4f9vwvqMTrCCznFrdifNLdqs2nZXWsqEhGKzga4BNPPzaJl8-J_wylM_amDRxGV5Ch1cjxAnVw0bABIlzOkiqGb4lXVPCUoLJIxj3oj4Kjv12_y3f2fZ3EieaGfTWwryhcQ2gLlOPnN70ARO2JAZ9OSLACTiWjwAXGpalKqn4VlBqY_Ulumwwcr0AOoxLbqEkREUDPYlKx7gdZnVSjkCGxxVYH1mMRJ2quC9RjKWxSOrfvbF9xlYBdfV9-wr40HvTdCcCoIDZwiLC0tCTCP9ZgPgKzLz_hdoYNPECfxm50CHLKMNk7udR6bHvUi9pa4qaCYkKcdVLm-XHN3S0EiI-b1xLJZHEAVMLho0cb6uhXlPA5R8qGsyIJwtwyjsCaJcgSJkWRyNBxbyrjgFyhwcHpygKR0znjhioR49P285OEFfK2BxM_aAgCUpExiDslk0H8b5Wye5FEi2Y08kCB41ZNzlVopCyWTcpiq40N7IO62HICaVB-_Vv6azB3kuSyxZEfLF-GE-6pAB00-_q0aMtriFColgObjbH3uy_psVuoQQ3pUq1XDp2MJvn-sgf2W_hU0FUdDIl3ef7bXK-QCk-sS9PWzZWkh8S_8hqgKh-XMXM1i824qkFR_-IEs70y8rD-YipTTB2MI1-61TplsCWAjB2ojFEfSy46j-mmSD7GLEfR5wdFhrpBT-rnNHR4Br-8lNevX2FdbOQOB7pLXawHZ-VfMdnfAOtqdgSJ3MmB6-q70okDZ6qpiSOW2W03Bi77fb6TYwljm7KZzY0zd2C28YPjW8FN5qSAnFEa&cid=CAASEuRobWT78qkS64Hx7zsb2aeWdQ&rfl=1%2Chttps%253A%252F%252Ffilecr.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b7c55617f84818daf4c70cc10ada26ddd5b582b1d1c2c2829b3220487a6db477

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:53:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 236
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9544
x-xss-protection: 0
server: cafe
etag: 6261108306223674270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 05 Feb 2022 11:53:34 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220119/r20110914/elements/html/ Frame BE70 8 KB
3 KB 30ms
27ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220119/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:51:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 378
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 05 Feb 2022 11:51:12 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame BE70 0
61 B 148ms
73ms Ping
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvlPQEFwjWfb97ImWK38Jdph2ImAKKENqmNUrTJsotV3ksEDvahsRQGYEpye-VjmP408CaTkDoLJFUrZKva-pSp-DZggLUjkwYU4D-Ck47EJk34wV4aSjU0b5LXJcT_ylCT3sGfkrbOD76ZbilUjIcu3elYtBnhEY-bTIKPWgYo54lvIwCAuG4kMiSqgNNyXXpqL8NEqKfTJ9LPKthY7b0dSp2NJamBdfXxHTqdTJC_ViwlZ6MtkSakHa9A5YP03pnn5DRnG9ZYUwf7WEeIWOEGTEsbvmmKYYXp9tdJSwtM8XjL9rJdjeBZwul1b-iKYczfOu4a0AxkJzk6Q0SVK9yAYQvBwuQdQRIZr4umYoHQaDHyac0Ed4PUaUj9PkyQ0DTEk6hhOeIgKK5dQb5iUum3HHknON9gl4CyerSAuGYnwS_GEeC4dsUh-RVZG5_QOY88EQuYaA44iTEqxtNUE8Sxr8KKD2Kb-yL3VGdOLkNIUS8kHJj6mAL3mM4m_aKOuDDgDFfmC1HoNsr5bIKRZVsYYj5nGEawP1LSgHkCFdX0ZpBPK6571z87Qocmey56q-OTykOh4e1JIFz4Dnzx_riJDFLKkFyKD1xu0SvypdZzaqWRzhgAp1ibHongT4FWMU0hHEYhTQfewhPRaWYz9vmfmizK143F-wC5w6zCy6YYfVgHQJbgXrafAo4LPDo2dZ1J4Dfh5zMSgZJAUCvcXIjmIImJlUW_ggJxTpriTFF598nrxlTIouIXwIJ_xY77sCaCIwhz-6aB7pISV_0P-qv8CY6xARKgsuXwyJjWnd1qle_yoGibKrupuhc_3yDRMm-tAzZHrHDDNhdACKBrt8NBlBfYYXkCZiJ9UdoeT6-ZUMFCIUgTiup_FLHBtzpUgLNiP44hWCmIENfV8uOw__W2Y9lR2X9Tf3oJNPleEyS0DrUI7LGpjOjsyzBHXVgryDjjOvpnBZUbrsCg06_9ze8xTvZYdgZ9rHYGUQcejUaKMEK75tZsIdFCKIJZiJjCyRF5hEMT5IjFNuY-_ybUADCt8Md80SIhcaVpJfPs6QTY3UI1AAova6HLZaNAb177cOgv6b2g6V6VyMUgK2-jzLi2_UEnJ5z7sxcqi3BAxxNOoVYdHQKxSwpH51VmcEEmrbzj-_N6j9ilcQ1wggsDwD8XpXMlzctLiAzmTPUhiPLVXGJFVCjqZer1oXK2gj9S-QJcRlqrvw&sai=AMfl-YQ-plI73N0w6ojzgDbUks0IixPvygdSSPDs8akEQeMnW46rSW1BTSraZRkLrpRHIyZppWwBNhGSdPiq0RnP2caF38zH86dSeB7oKSIjfz4r3u-HJLecf_I9jn7Zj4Wtd3PZ4IyTXfnNRUYtjZXDwgQ6oFYURQ&sig=Cg0ArKJSzD0VWwiOYHB8EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20220119.22392&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Sat, 22 Jan 2022 11:57:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame BE70 41 KB
15 KB 31ms
30ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 15:54:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 245008
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Jan 2023 15:54:02 GMT

GET
H2 200 4258695223351877611
s0.2mdn.net/simgad/ Frame BE70 41 KB
42 KB 83ms
26ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/4258695223351877611

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d21907dc8a345eaf69eda7f482d866ba733f856affda4798ee6dfa694619d6e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 07:11:33 GMT
x-content-type-options: nosniff
age: 449157
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42354
x-xss-protection: 0
last-modified: Thu, 06 Jan 2022 13:23:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 17 Jan 2023 07:11:33 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame B3C8 1 KB
749 B 27ms
24ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Fri, 21 Jan 2022 13:26:12 GMT
expires: Sat, 22 Jan 2022 13:26:12 GMT
cache-control: public, max-age=86400
age: 81078
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 3BC3 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 625692a5cf29446fdf405e50a01e9d38bacfdb49b84765f13d8305ec971863cf

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame C591 22 KB
8 KB 29ms
28ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 19 Jan 2022 10:49:42 GMT
expires: Thu, 19 Jan 2023 10:49:42 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 263268
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 0B3B 22 KB
8 KB 28ms
27ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 19 Jan 2022 10:49:42 GMT
expires: Thu, 19 Jan 2023 10:49:42 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 263268
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 6BD6 1 KB
749 B 27ms
26ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Fri, 21 Jan 2022 13:26:12 GMT
expires: Sat, 22 Jan 2022 13:26:12 GMT
cache-control: public, max-age=86400
age: 81078
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame BE70 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 46d980d2ca518d0fa850120af6b5ec6ac9ee8c34eaa831c53bafcfb55dbfd218

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame 6661 9 KB
4 KB 30ms
26ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: pr.ybp.yahoo.com
URL: https://pr.ybp.yahoo.com/ab/secure/true/imp/Ale26L6pvdHnTwBdGXzYpScE8tEWXaL6r2ggWE0PVk2rnbpEcjf8iN1uyVlx831-fWYsNgDKr3W0ZelYTkfVb6VqZvRheXtNywI4eNcE1FU3cHRk197fFhRw0jNKeWtzLT8uFdJ4kUrB_oLdIp9QcXUYiYf89S5369u-puBJAygu1I16rMD4HplXHAsJRy9PvCHYd9jo00JsttyrhnZFJ4Mqs05jL3obMKFZwuK_Q25Xq3L_AoLsDSBVGW08-acjsJlNTFo6XDTemqWnkEVGsTCcMCqKoQuC-TjAYCV2szHQ6Yl513ceALuAJ9ONNQs-VhFDjAmPELXFpZKzCu8dECMYL67pLi8JzNXWzEXQyI-OH4uZJRCdjaPtsWNhPUbPh5d68vGCDH9h297azWS2IW7vRm2wC2YLWPqE4JknlJv4GQ71BVSVcLX61t3KXEE_pv5CgFHPtq6nDRfep8WmJ4IIZXLt976N9HsozSTS57NvQsSkhr7K5b6PeMV9yyxFHMcadvTMGiwQ6NfQcHlqyYIQ35_Ej3hmNWQJxDWDZlGjD505enQjtqTyOAmwhuX7t8_Lx8KiIyS8cdI3az9HfAggcckDI9zR_jQNXq-HqHLFj5L24U120RvL0LTKZ4GUB6FGI377Kw48zg0-77bLWLgNL2mvaxo_yhFj9qcopTAYwpITL2iv5Mn1bPdbqMzPi_VunEtD3eMlVO9rDTehZ5sZPzVhmGYfcZY-t8_6rZun3Gn9Xbr8Bxhtu2iW6nfop4xGgnFGCsAnKLHYjFiSa_qoXKYiLycZ3P0GDG8tUR0QEKica6MIX3TVWZjl_CG0XgNt7bNkL4Bw3d5WPlhiCVDsESYo3hhoHw0HK-bSzmgtLco17KhQh7tvRFAiik4YBWCToNgPu3HZftDlf0-ED37Hy6588TxCevJhLUApKwBxX84A7BDG-khQ0eOnESEbN90QE02jDHx4qin0xWf1PFJnD2YvdgmwZLhVBAl03EKwMkYzwcoGpBz_RnVy1P6Xf9aDktUcC9-rbtneGhcqlmt6r08HVSEWZ55FzvmwDyUWSvN-xTvYKxKhaesJo5rckiMOHb-irDDUyrbbEOnm6tzb7Q_J6rf2QzHyjlqMjUb900zZrY_8DWfBPz6nKBUHLjkqb0FpGplpTjcP0XxEI4vYWRul9PGlIqFChMAbw82_vedU1HbdgqH7_CjaDOWBpckyEkdGOjbPCk6tdU6DSNHDong43F1g5E-2QcmeHZXgOQPWT9HkOhY9TNJVZxD832ULQUJEDdmzS4pV-Fwfi_kRKfpPpWfZ1-33w0KEXnjXueRUMB5Avgdum171YTPAKZ-A2o8VrnVfmq7t-tCYszL4D_tSNwnxuP84imnS0Ub0EgBqImdjS2pp5tFR3RotGIxJbov8Ro0/wp/0.100881/pclick/https://clicktrack.pubmatic.com/AdServer/AdDisplayTrackerServlet?clickData=JnB1YklkPTE1OTg1NSZzaXRlSWQ9NzUwNTI5JmFkSWQ9MzEzNTA3MyZrYWRzaXplaWQ9MzImdGxkSWQ9NjUzNTU3NTImY2FtcGFpZ25JZD0yMzAyNiZjcmVhdGl2ZUlkPTAmdWNyaWQ9MTcxNjc0NDA0NDc3ODE5MDQ3ODQmYWRTZXJ2ZXJJZD0yNDMmaW1waWQ9NDI4RTcwNkMtRTg2MS00MDRFLTkzRjEtRDU4MzAzNzREMjcxJnBhc3NiYWNrPTA=_url=

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7759e82036d42a08c8938fa81425a445b4662f4b5b9733cd047667e0feedcae5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:41:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 963
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4397
x-xss-protection: 0
last-modified: Thu, 20 Jan 2022 18:02:26 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Sat, 22 Jan 2022 12:41:27 GMT

GET
H2 200 skeleton.js Show response
pixel.adsafeprotected.com/rjss/st/490395/58820823/ Frame 6661 46 KB
12 KB 154ms
51ms Script
application/javascript 54.76.247.168
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/rjss/st/490395/58820823/skeleton.js?ias_dspID=30&ias_campId=277442&ias_pubId=159855&ias_chanId=6&ias_placementId=1837526&bidurl=filecr.com
Requested by: Host: pr.ybp.yahoo.com
URL: https://pr.ybp.yahoo.com/ab/secure/true/imp/Ale26L6pvdHnTwBdGXzYpScE8tEWXaL6r2ggWE0PVk2rnbpEcjf8iN1uyVlx831-fWYsNgDKr3W0ZelYTkfVb6VqZvRheXtNywI4eNcE1FU3cHRk197fFhRw0jNKeWtzLT8uFdJ4kUrB_oLdIp9QcXUYiYf89S5369u-puBJAygu1I16rMD4HplXHAsJRy9PvCHYd9jo00JsttyrhnZFJ4Mqs05jL3obMKFZwuK_Q25Xq3L_AoLsDSBVGW08-acjsJlNTFo6XDTemqWnkEVGsTCcMCqKoQuC-TjAYCV2szHQ6Yl513ceALuAJ9ONNQs-VhFDjAmPELXFpZKzCu8dECMYL67pLi8JzNXWzEXQyI-OH4uZJRCdjaPtsWNhPUbPh5d68vGCDH9h297azWS2IW7vRm2wC2YLWPqE4JknlJv4GQ71BVSVcLX61t3KXEE_pv5CgFHPtq6nDRfep8WmJ4IIZXLt976N9HsozSTS57NvQsSkhr7K5b6PeMV9yyxFHMcadvTMGiwQ6NfQcHlqyYIQ35_Ej3hmNWQJxDWDZlGjD505enQjtqTyOAmwhuX7t8_Lx8KiIyS8cdI3az9HfAggcckDI9zR_jQNXq-HqHLFj5L24U120RvL0LTKZ4GUB6FGI377Kw48zg0-77bLWLgNL2mvaxo_yhFj9qcopTAYwpITL2iv5Mn1bPdbqMzPi_VunEtD3eMlVO9rDTehZ5sZPzVhmGYfcZY-t8_6rZun3Gn9Xbr8Bxhtu2iW6nfop4xGgnFGCsAnKLHYjFiSa_qoXKYiLycZ3P0GDG8tUR0QEKica6MIX3TVWZjl_CG0XgNt7bNkL4Bw3d5WPlhiCVDsESYo3hhoHw0HK-bSzmgtLco17KhQh7tvRFAiik4YBWCToNgPu3HZftDlf0-ED37Hy6588TxCevJhLUApKwBxX84A7BDG-khQ0eOnESEbN90QE02jDHx4qin0xWf1PFJnD2YvdgmwZLhVBAl03EKwMkYzwcoGpBz_RnVy1P6Xf9aDktUcC9-rbtneGhcqlmt6r08HVSEWZ55FzvmwDyUWSvN-xTvYKxKhaesJo5rckiMOHb-irDDUyrbbEOnm6tzb7Q_J6rf2QzHyjlqMjUb900zZrY_8DWfBPz6nKBUHLjkqb0FpGplpTjcP0XxEI4vYWRul9PGlIqFChMAbw82_vedU1HbdgqH7_CjaDOWBpckyEkdGOjbPCk6tdU6DSNHDong43F1g5E-2QcmeHZXgOQPWT9HkOhY9TNJVZxD832ULQUJEDdmzS4pV-Fwfi_kRKfpPpWfZ1-33w0KEXnjXueRUMB5Avgdum171YTPAKZ-A2o8VrnVfmq7t-tCYszL4D_tSNwnxuP84imnS0Ub0EgBqImdjS2pp5tFR3RotGIxJbov8Ro0/wp/0.100881/pclick/https://clicktrack.pubmatic.com/AdServer/AdDisplayTrackerServlet?clickData=JnB1YklkPTE1OTg1NSZzaXRlSWQ9NzUwNTI5JmFkSWQ9MzEzNTA3MyZrYWRzaXplaWQ9MzImdGxkSWQ9NjUzNTU3NTImY2FtcGFpZ25JZD0yMzAyNiZjcmVhdGl2ZUlkPTAmdWNyaWQ9MTcxNjc0NDA0NDc3ODE5MDQ3ODQmYWRTZXJ2ZXJJZD0yNDMmaW1waWQ9NDI4RTcwNkMtRTg2MS00MDRFLTkzRjEtRDU4MzAzNzREMjcxJnBhc3NiYWNrPTA=_url=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.76.247.168 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-247-168.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: a43c7674917a5ebea7fde1cc60f8526cf256e4180211dc413298940de5cd228a

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
content-encoding: gzip
x-f1: 1
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: pixel.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 inside.js Show response
cdn.js7k.com/rq/iv/ Frame 6661 43 KB
14 KB 44ms
37ms Script
application/javascript 2a00:1288:80:800::7001
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.js7k.com/rq/iv/inside.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7001 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

1b3f1a6337f21366cf59487bb664dd0983c245ccf100be143f4366a07e005d09

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:20:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2200
x-amz-server-side-encryption: AES256
vary: Origin, Accept-Encoding
content-length: 14353
x-amz-id-2: qFtB4FFaVJDKlmU1kcFJNu0hWXcg9zFyd96IsxEqTsCeg39uOvd8KkmMyEaErn3eks2JVLsbXmo=
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 09 Sep 2021 15:05:50 GMT
server: ATS
etag: "8ceeaab271ed688991789ed1090cb398-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: PX8BEVDNVXWQ1JVQ
x-xss-protection: 1; mode=block
cache-control: public,max-age=14400
accept-ranges: bytes
content-type: application/javascript; charset=utf-8

GET
H2 200 dds
rtb.openx.net/sync/ Frame B3C8 43 B
351 B 95ms
50ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEJ7fcDOsXbNic79NfBEKwyE&google_cver=1&google_push=AYg5qPLE3DdATa5j30WJtXyNojsObSLl7tkCfdMd-kWq0xRINjosHwb4cTU3CC93h7fKpo6cw48-WIG2D7qICR8gxH-BJrjSxA
Requested by: Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:30 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: orlpvmv1m2h7g13e2kmapl678mf3rjki

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B3C8
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=DTlEaS5QS6OC5Fg6wOVrsg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

45ms
44ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=DTlEaS5QS6OC5Fg6wOVrsg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKSKUw8mH9lBUdXKXy7Z7DogZ66q3kTJhYM5f74jVhKSAsRqp4RY0mNE3SG4DwBoM1gMxCGV4968rwOO_f_to2O8K93X5k

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=DTlEaS5QS6OC5Fg6wOVrsg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKSKUw8mH9lBUdXKXy7Z7DogZ66q3kTJhYM5f74jVhKSAsRqp4RY0mNE3SG4DwBoM1gMxCGV4968rwOO_f_to2O8K93X5k
date: Sat, 22 Jan 2022 11:57:30 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B3C8
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESENSoWu-JlM5I8gqmKvIGGPQ&google_cver=1&google_push=AYg5qPJxS_NktDk9xyjFFgAyDzmVyo9kXCWOleyLIRQQfc4VxNwoQWfF0GsbFL4STxqJg8aAKqq...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1lQUzFUSk4tVC1KWVNJ&google_push=AYg5qPJxS_NktDk9xyjFFgAyDzmVyo9kXCWOleyLIRQQfc4VxNwoQWfF0GsbFL4STxqJg8aAKqqN6RKetttscMbvs87ndIVIM24

170 B
188 B

71ms
71ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1lQUzFUSk4tVC1KWVNJ&google_push=AYg5qPJxS_NktDk9xyjFFgAyDzmVyo9kXCWOleyLIRQQfc4VxNwoQWfF0GsbFL4STxqJg8aAKqqN6RKetttscMbvs87ndIVIM24

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1lQUzFUSk4tVC1KWVNJ&google_push=AYg5qPJxS_NktDk9xyjFFgAyDzmVyo9kXCWOleyLIRQQfc4VxNwoQWfF0GsbFL4STxqJg8aAKqqN6RKetttscMbvs87ndIVIM24
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 37b22a0c36bd84993dd2cda4a5e04b1d
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame B3C8
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEB--ML_x_MUOZ4ZQo1040FI&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_gid=CAESEB--ML_x_MUOZ4ZQo1040FI&google_push=AYg5qPJ-wqTHIBDvpyoIETBq0Fkf8PfzGTMWi...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_gid=CAESEB--ML_x_MUOZ4ZQo1040FI&google_push=AYg5qPJ-wqTHIBDvpyoIETBq0Fkf8PfzGTMWi...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_gid=CAESEB--ML_x_MUOZ4ZQo1040FI&google_push=AYg5qPJ-wqTHIBDvpyoIETBq0Fkf8PfzGTMWi...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_gid=CAESEB--ML_x_MUOZ4ZQo1040FI&google_push=AYg5qPJ-wqTHIBDvpyoIETBq0Fkf8PfzGTMWi...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_gid=CAESEB--ML_x_MUOZ4ZQo1040FI&google_push=AYg5qPJ-wqTHIBDvpyoIETBq0Fkf8PfzGTMWi...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_gid=CAESEB--ML_x_MUOZ4ZQo1040FI&google_push=AYg5qPJ-wqTHIBDvpyoIETBq0Fkf8PfzGTMWi...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_gid=CAESEB--ML_x_MUOZ4ZQo1040FI&google_push=AYg5qPJ-wqTHIBDvpyoIETBq0Fkf8PfzGTMWi...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_gid=CAESEB--ML_x_MUOZ4ZQo1040FI&google_push=AYg5qPJ-wqTHIBDvpyoIETBq0Fkf8PfzGTMWi...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_gid=CAESEB--ML_x_MUOZ4ZQo1040FI&google_push=AYg5qPJ-wqTHIBDvpyoIETBq0Fkf8PfzGTMWi...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_gid=CAESEB--ML_x_MUOZ4ZQo1040FI&google_push=AYg5qPJ-wqTHIBDvpyoIETBq0Fkf8PfzGTMWi...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_gid=CAESEB--ML_x_MUOZ4ZQo1040FI&google_push=AYg5qPJ-wqTHIBDvpyoIETBq0Fkf8PfzGTMWi...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_gid=CAESEB--ML_x_MUOZ4ZQo1040FI&google_push=AYg5qPJ-wqTHIBDvpyoIETBq0Fkf8PfzGTMWi...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_gid=CAESEB--ML_x_MUOZ4ZQo1040FI&google_push=AYg5qPJ-wqTHIBDvpyoIETBq0Fkf8PfzGTMWi...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_gid=CAESEB--ML_x_MUOZ4ZQo1040FI&google_push=AYg5qPJ-wqTHIBDvpyoIETBq0Fkf8PfzGTMWi...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_gid=CAESEB--ML_x_MUOZ4ZQo1040FI&google_push=AYg5qPJ-wqTHIBDvpyoIETBq0Fkf8PfzGTMWi...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_gid=CAESEB--ML_x_MUOZ4ZQo1040FI&google_push=AYg5qPJ-wqTHIBDvpyoIETBq0Fkf8PfzGTMWi...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_gid=CAESEB--ML_x_MUOZ4ZQo1040FI&google_push=AYg5qPJ-wqTHIBDvpyoIETBq0Fkf8PfzGTMWi...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_gid=CAESEB--ML_x_MUOZ4ZQo1040FI&google_push=AYg5qPJ-wqTHIBDvpyoIETBq0Fkf8PfzGTMWi...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_gid=CAESEB--ML_x_MUOZ4ZQo1040FI&google_push=AYg5qPJ-wqTHIBDvpyoIETBq0Fkf8PfzGTMWi...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_gid=CAESEB--ML_x_MUOZ4ZQo1040FI&google_push=AYg5qPJ-wqTHIBDvpyoIETBq0Fkf8PfzGTMWi...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B3C8
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEKh6gruQJNAwKzg9a3vyu7U&google_cver=1&google_push=AYg5qPJIeR4oGnk1xNMxlBIAhQqyhvJRZjvRyDhKtvYnHAMTUcBZyoH0IfjChFCmkJ9SnI2ObdGrkx0uRdQ9giRZm...
https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEKh6gruQJNAwKzg9a3vyu7U&google_cver=1&google_push=AYg5qPJIeR4oGnk1xNMxlBIAhQqyhvJRZjvRyDhKtvYnHAMTUcBZyoH0IfjChFCmkJ9SnI2ObdGrkx0uRdQ9giRZm...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPJIeR4oGnk1xNMxlBIAhQqyhvJRZjvRyDhKtvYnHAMTUcBZyoH0IfjChFCmkJ9SnI2ObdGrkx0uRdQ9giRZmv5-2xw85EQ&google_hm=4d30eaf5a62744b37f571bd4

170 B
188 B

40ms
40ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPJIeR4oGnk1xNMxlBIAhQqyhvJRZjvRyDhKtvYnHAMTUcBZyoH0IfjChFCmkJ9SnI2ObdGrkx0uRdQ9giRZmv5-2xw85EQ&google_hm=4d30eaf5a62744b37f571bd4

Requested by

Host: filecr.com
URL: https://filecr.com/en/?id=94759749504

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Sat, 22 Jan 2022 11:57:31 GMT
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPJIeR4oGnk1xNMxlBIAhQqyhvJRZjvRyDhKtvYnHAMTUcBZyoH0IfjChFCmkJ9SnI2ObdGrkx0uRdQ9giRZmv5-2xw85EQ&google_hm=4d30eaf5a62744b37f571bd4
Access-Control-Allow-Credentials: true
Connection: close
X-Sovrn-Pod: ad_ap6ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B3C8
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEL6LY65S73EucupCEA01qn8&google_cver=1&google_push=AYg5qPJcY6R9j36oclfy4UpaWrDb5JfyuoqRbJpw_MYdKVw21qhPOwXUtMWPkbIqSrIkpwE-pTmxOlb8N9OdY5pHpVZ6ITH8FOM
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&cmp_cs=&us_privacy=&sync=1&google_push=AYg5qPJcY6R9j36oclfy4UpaWrDb5JfyuoqRbJpw_MYdKVw21qhPOwXUtMWPkbIqSrIkpwE-pTmxOlb8N9OdY5pHpVZ6ITH8FOM&googl...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTM3NDE3NTM0NzEyNDMwODg5MDQ%3D&google_push=AYg5qPJcY6R9j36oclfy4UpaWrDb5JfyuoqRbJpw_MYdKVw21qhPOwXUtMWPkb...

170 B
188 B

43ms
41ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTM3NDE3NTM0NzEyNDMwODg5MDQ%3D&google_push=AYg5qPJcY6R9j36oclfy4UpaWrDb5JfyuoqRbJpw_MYdKVw21qhPOwXUtMWPkbIqSrIkpwE-pTmxOlb8N9OdY5pHpVZ6ITH8FOM

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTM3NDE3NTM0NzEyNDMwODg5MDQ%3D&google_push=AYg5qPJcY6R9j36oclfy4UpaWrDb5JfyuoqRbJpw_MYdKVw21qhPOwXUtMWPkbIqSrIkpwE-pTmxOlb8N9OdY5pHpVZ6ITH8FOM
date: Sat, 22 Jan 2022 11:57:31 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B3C8
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEB7QP4qszOB-oALY7JNTft0&google_cver=1&google_push=AYg5qPIJN3zDc-0hVE2xwVDQje-VZFq_8RKSeSsHKii22P4s5dBj_K0VsK5bEPs1XDy_KWBUr_...
https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEB7QP4qszOB-oALY7JNTft0&google_cver=1&google_push=AYg5qPIJN3zDc-0hVE2xwVDQje-VZFq_8RKSeSsHKii22P4s5dBj_K0VsK5bEPs1XDy_KWBUr_...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1fRHFzLkx0RTJ1Rmw0SUFURmNOU05EZXpiNnR2WWZWZX5B&google_push=AYg5qPIJN3zDc-0hVE2xwVDQje-VZFq_8RKSeSsHKii22P4s5dBj_K0Vs...

170 B
188 B

42ms
42ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1fRHFzLkx0RTJ1Rmw0SUFURmNOU05EZXpiNnR2WWZWZX5B&google_push=AYg5qPIJN3zDc-0hVE2xwVDQje-VZFq_8RKSeSsHKii22P4s5dBj_K0VsK5bEPs1XDy_KWBUr_8nkCCZ0PHQbkDCBENvbiE72nHA

Requested by

Host: filecr.com
URL: https://filecr.com/en/?id=94759749504

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1fRHFzLkx0RTJ1Rmw0SUFURmNOU05EZXpiNnR2WWZWZX5B&google_push=AYg5qPIJN3zDc-0hVE2xwVDQje-VZFq_8RKSeSsHKii22P4s5dBj_K0VsK5bEPs1XDy_KWBUr_8nkCCZ0PHQbkDCBENvbiE72nHA
date: Sat, 22 Jan 2022 11:57:31 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame B3C8 0
12 B 80ms
39ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KjrQt50dvV1ezEkaiPDU8xosPnVGmKJ_ugrRlDgmSU3d1wY-do0B3kZeHUv9LlO65EcF3nMA

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:31 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 adchoicesblue.png
s.yimg.com/ch/icons/adchoices/ Frame 6661 565 B
853 B 39ms
38ms Image
image/png 2a00:1288:80:800::7001
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.yimg.com/ch/icons/adchoices/adchoicesblue.png

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7001 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

b8954ed878ae615531f62b8d9a95a79d9a86a84f4af1504bcbec32d8e62d7ebd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Wed, 05 Jan 2022 12:41:48 GMT
x-content-type-options: nosniff
age: 1466143
x-amz-server-side-encryption: AES256
vary: Origin
content-length: 565
x-amz-id-2: 6R7HJktLX6mTOyhMRrUZP+19gk7H2l6CSdyhll+EH4Y1SxG2UHE8cXwY42osOOChV8+2Btmqv6A=
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 22 Jul 2020 18:15:42 GMT
server: ATS
etag: "349bad1100a940608cb9109eb2b166a2"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: MM73SBDVFF9734CR
x-xss-protection: 1; mode=block
cache-control: max-age=15552000, public
x-amz-version-id: null
accept-ranges: bytes
content-type: image/png

GET
H3 200 impl_v83.js Show response
www.googletagservices.com/dcm/ Frame 6661 41 KB
17 KB 27ms
25ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v83.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

933e25b64ded3d3f6a346e3a9cf2611a7ce867985ee3b07089bdd7ffe33d64ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 18 Jan 2022 19:57:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 316801
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17213
x-xss-protection: 0
last-modified: Tue, 18 Jan 2022 19:47:28 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 18 Jan 2023 19:57:30 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6BD6
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESECtBAa_d75yzrlE_m_4zIlA&google_cver=1&google_push=AYg5qPJMudvanknDXb4-GN2gHsPnb_-bABU7rEkS_1o1dcRE7rNI1nOm7LZn2VTXyfYxh2OnEU4qxCGTh0lIXc8mRMWEatD...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJMudvanknDXb4-GN2gHsPnb_-bABU7rEkS_1o1dcRE7rNI1nOm7LZn2VTXyfYxh2OnEU4qxCGTh0lIXc8mRMWEatDij_mKuw&google_hm=NDM4MzA5NTAyOTMwMDkx...

170 B
188 B

41ms
41ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJMudvanknDXb4-GN2gHsPnb_-bABU7rEkS_1o1dcRE7rNI1nOm7LZn2VTXyfYxh2OnEU4qxCGTh0lIXc8mRMWEatDij_mKuw&google_hm=NDM4MzA5NTAyOTMwMDkxMTk0NA%3D%3D

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 22 Jan 2022 11:57:31 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJMudvanknDXb4-GN2gHsPnb_-bABU7rEkS_1o1dcRE7rNI1nOm7LZn2VTXyfYxh2OnEU4qxCGTh0lIXc8mRMWEatDij_mKuw&google_hm=NDM4MzA5NTAyOTMwMDkxMTk0NA%3D%3D
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6BD6
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=GsM5L93TTMST3ZdF1K8szA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

42ms
42ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=GsM5L93TTMST3ZdF1K8szA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPK-3MhLcyhFtbwXASvjz9DfVXIpWl8-aE1q4Orqo8dkkZC4NZnHL6sKYCJvyF-iyu-62UdKB5G9vesi9nQTRuocLIX14klLzQ

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=GsM5L93TTMST3ZdF1K8szA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPK-3MhLcyhFtbwXASvjz9DfVXIpWl8-aE1q4Orqo8dkkZC4NZnHL6sKYCJvyF-iyu-62UdKB5G9vesi9nQTRuocLIX14klLzQ
date: Sat, 22 Jan 2022 11:57:30 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6BD6
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESENSoWu-JlM5I8gqmKvIGGPQ&google_cver=1&google_push=AYg5qPIs6HWgE90EvWqvmPcz2H4qqq8mfuBA4nKbN4wbQi3tqo-t31Y0gM06GRTJnISHT2dTTrB...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1lQUzFUSk4tVC1KWVNJ&google_push=AYg5qPIs6HWgE90EvWqvmPcz2H4qqq8mfuBA4nKbN4wbQi3tqo-t31Y0gM06GRTJnISHT2dTTrBgAUA_1JAivfYkW9v6p8XtW00m2g

170 B
188 B

43ms
42ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1lQUzFUSk4tVC1KWVNJ&google_push=AYg5qPIs6HWgE90EvWqvmPcz2H4qqq8mfuBA4nKbN4wbQi3tqo-t31Y0gM06GRTJnISHT2dTTrBgAUA_1JAivfYkW9v6p8XtW00m2g

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1lQUzFUSk4tVC1KWVNJ&google_push=AYg5qPIs6HWgE90EvWqvmPcz2H4qqq8mfuBA4nKbN4wbQi3tqo-t31Y0gM06GRTJnISHT2dTTrBgAUA_1JAivfYkW9v6p8XtW00m2g
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 37b22a0c36bd84993dd2cda4a5e04b1d
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 6BD6
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEB--ML_x_MUOZ4ZQo1040FI&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_push=AYg5qPJGKJyGl6KJARUSRAufD10-nTK3CQOGLO_Y2zbc_zPVtWRyxGgftMCZZQyMhcsWQCYi6mmRwtD-C_eOKrDZYX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_push=AYg5qPJGKJyGl6KJARUSRAufD10-nTK3CQOGLO_Y2zbc_zPVtWRyxGgftMCZZQyMhcsWQCYi6mmRwtD-C_eOKrDZYX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_push=AYg5qPJGKJyGl6KJARUSRAufD10-nTK3CQOGLO_Y2zbc_zPVtWRyxGgftMCZZQyMhcsWQCYi6mmRwtD-C_eOKrDZYX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_push=AYg5qPJGKJyGl6KJARUSRAufD10-nTK3CQOGLO_Y2zbc_zPVtWRyxGgftMCZZQyMhcsWQCYi6mmRwtD-C_eOKrDZYX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_push=AYg5qPJGKJyGl6KJARUSRAufD10-nTK3CQOGLO_Y2zbc_zPVtWRyxGgftMCZZQyMhcsWQCYi6mmRwtD-C_eOKrDZYX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_push=AYg5qPJGKJyGl6KJARUSRAufD10-nTK3CQOGLO_Y2zbc_zPVtWRyxGgftMCZZQyMhcsWQCYi6mmRwtD-C_eOKrDZYX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_push=AYg5qPJGKJyGl6KJARUSRAufD10-nTK3CQOGLO_Y2zbc_zPVtWRyxGgftMCZZQyMhcsWQCYi6mmRwtD-C_eOKrDZYX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_push=AYg5qPJGKJyGl6KJARUSRAufD10-nTK3CQOGLO_Y2zbc_zPVtWRyxGgftMCZZQyMhcsWQCYi6mmRwtD-C_eOKrDZYX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_push=AYg5qPJGKJyGl6KJARUSRAufD10-nTK3CQOGLO_Y2zbc_zPVtWRyxGgftMCZZQyMhcsWQCYi6mmRwtD-C_eOKrDZYX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_push=AYg5qPJGKJyGl6KJARUSRAufD10-nTK3CQOGLO_Y2zbc_zPVtWRyxGgftMCZZQyMhcsWQCYi6mmRwtD-C_eOKrDZYX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_push=AYg5qPJGKJyGl6KJARUSRAufD10-nTK3CQOGLO_Y2zbc_zPVtWRyxGgftMCZZQyMhcsWQCYi6mmRwtD-C_eOKrDZYX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_push=AYg5qPJGKJyGl6KJARUSRAufD10-nTK3CQOGLO_Y2zbc_zPVtWRyxGgftMCZZQyMhcsWQCYi6mmRwtD-C_eOKrDZYX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_push=AYg5qPJGKJyGl6KJARUSRAufD10-nTK3CQOGLO_Y2zbc_zPVtWRyxGgftMCZZQyMhcsWQCYi6mmRwtD-C_eOKrDZYX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_push=AYg5qPJGKJyGl6KJARUSRAufD10-nTK3CQOGLO_Y2zbc_zPVtWRyxGgftMCZZQyMhcsWQCYi6mmRwtD-C_eOKrDZYX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_push=AYg5qPJGKJyGl6KJARUSRAufD10-nTK3CQOGLO_Y2zbc_zPVtWRyxGgftMCZZQyMhcsWQCYi6mmRwtD-C_eOKrDZYX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_push=AYg5qPJGKJyGl6KJARUSRAufD10-nTK3CQOGLO_Y2zbc_zPVtWRyxGgftMCZZQyMhcsWQCYi6mmRwtD-C_eOKrDZYX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_push=AYg5qPJGKJyGl6KJARUSRAufD10-nTK3CQOGLO_Y2zbc_zPVtWRyxGgftMCZZQyMhcsWQCYi6mmRwtD-C_eOKrDZYX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_push=AYg5qPJGKJyGl6KJARUSRAufD10-nTK3CQOGLO_Y2zbc_zPVtWRyxGgftMCZZQyMhcsWQCYi6mmRwtD-C_eOKrDZYX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_push=AYg5qPJGKJyGl6KJARUSRAufD10-nTK3CQOGLO_Y2zbc_zPVtWRyxGgftMCZZQyMhcsWQCYi6mmRwtD-C_eOKrDZYX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_push=AYg5qPJGKJyGl6KJARUSRAufD10-nTK3CQOGLO_Y2zbc_zPVtWRyxGgftMCZZQyMhcsWQCYi6mmRwtD-C_eOKrDZYX...

0
0

GET

pixel
cm.g.doubleclick.net/ Frame 6BD6
Redirect Chain

https://onetag-sys.com/sync/i,19/?google_gid=CAESEMlySgqBQ6ejCofqYqQWT1w&google_cver=1&google_push=AYg5qPI8eiAutosQWQ3rOLT-qlHdxMfSF7qQMdZ2IJ8Wp3vyOPiA71poS5377ZnDJ7ewrpl0miN6Q5eeAEFKgNl37Asq98R3RU...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI8eiAutosQWQ3rOLT-qlHdxMfSF7qQMdZ2IJ8Wp3vyOPiA71poS5377ZnDJ7ewrpl0miN6Q5eeAEFKgNl37Asq98R3RUJBKQ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI8eiAutosQWQ3rOLT-qlHdxMfSF7qQMdZ2IJ8Wp3vyOPiA71poS5377ZnDJ7ewrpl0miN6Q5eeAEFKgNl37Asq98R3RUJBKQ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI8eiAutosQWQ3rOLT-qlHdxMfSF7qQMdZ2IJ8Wp3vyOPiA71poS5377ZnDJ7ewrpl0miN6Q5eeAEFKgNl37Asq98R3RUJBKQ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI8eiAutosQWQ3rOLT-qlHdxMfSF7qQMdZ2IJ8Wp3vyOPiA71poS5377ZnDJ7ewrpl0miN6Q5eeAEFKgNl37Asq98R3RUJBKQ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI8eiAutosQWQ3rOLT-qlHdxMfSF7qQMdZ2IJ8Wp3vyOPiA71poS5377ZnDJ7ewrpl0miN6Q5eeAEFKgNl37Asq98R3RUJBKQ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI8eiAutosQWQ3rOLT-qlHdxMfSF7qQMdZ2IJ8Wp3vyOPiA71poS5377ZnDJ7ewrpl0miN6Q5eeAEFKgNl37Asq98R3RUJBKQ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI8eiAutosQWQ3rOLT-qlHdxMfSF7qQMdZ2IJ8Wp3vyOPiA71poS5377ZnDJ7ewrpl0miN6Q5eeAEFKgNl37Asq98R3RUJBKQ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI8eiAutosQWQ3rOLT-qlHdxMfSF7qQMdZ2IJ8Wp3vyOPiA71poS5377ZnDJ7ewrpl0miN6Q5eeAEFKgNl37Asq98R3RUJBKQ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI8eiAutosQWQ3rOLT-qlHdxMfSF7qQMdZ2IJ8Wp3vyOPiA71poS5377ZnDJ7ewrpl0miN6Q5eeAEFKgNl37Asq98R3RUJBKQ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI8eiAutosQWQ3rOLT-qlHdxMfSF7qQMdZ2IJ8Wp3vyOPiA71poS5377ZnDJ7ewrpl0miN6Q5eeAEFKgNl37Asq98R3RUJBKQ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI8eiAutosQWQ3rOLT-qlHdxMfSF7qQMdZ2IJ8Wp3vyOPiA71poS5377ZnDJ7ewrpl0miN6Q5eeAEFKgNl37Asq98R3RUJBKQ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI8eiAutosQWQ3rOLT-qlHdxMfSF7qQMdZ2IJ8Wp3vyOPiA71poS5377ZnDJ7ewrpl0miN6Q5eeAEFKgNl37Asq98R3RUJBKQ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI8eiAutosQWQ3rOLT-qlHdxMfSF7qQMdZ2IJ8Wp3vyOPiA71poS5377ZnDJ7ewrpl0miN6Q5eeAEFKgNl37Asq98R3RUJBKQ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI8eiAutosQWQ3rOLT-qlHdxMfSF7qQMdZ2IJ8Wp3vyOPiA71poS5377ZnDJ7ewrpl0miN6Q5eeAEFKgNl37Asq98R3RUJBKQ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI8eiAutosQWQ3rOLT-qlHdxMfSF7qQMdZ2IJ8Wp3vyOPiA71poS5377ZnDJ7ewrpl0miN6Q5eeAEFKgNl37Asq98R3RUJBKQ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI8eiAutosQWQ3rOLT-qlHdxMfSF7qQMdZ2IJ8Wp3vyOPiA71poS5377ZnDJ7ewrpl0miN6Q5eeAEFKgNl37Asq98R3RUJBKQ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI8eiAutosQWQ3rOLT-qlHdxMfSF7qQMdZ2IJ8Wp3vyOPiA71poS5377ZnDJ7ewrpl0miN6Q5eeAEFKgNl37Asq98R3RUJBKQ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI8eiAutosQWQ3rOLT-qlHdxMfSF7qQMdZ2IJ8Wp3vyOPiA71poS5377ZnDJ7ewrpl0miN6Q5eeAEFKgNl37Asq98R3RUJBKQ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI8eiAutosQWQ3rOLT-qlHdxMfSF7qQMdZ2IJ8Wp3vyOPiA71poS5377ZnDJ7ewrpl0miN6Q5eeAEFKgNl37Asq98R3RUJBKQ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI8eiAutosQWQ3rOLT-qlHdxMfSF7qQMdZ2IJ8Wp3vyOPiA71poS5377ZnDJ7ewrpl0miN6Q5eeAEFKgNl37Asq98R3RUJBKQ

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6BD6
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEL6LY65S73EucupCEA01qn8&google_cver=1&google_push=AYg5qPJg-rG40yxRm-_jQNwJLHQvZrbqzGZ_i77NATZ9ALc3g9Bth9zmj7DWBrMEt2YKyUpsXWJAGDSNolUOuuVO5yMqnEson2...
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&cmp_cs=&us_privacy=&sync=1&google_push=AYg5qPJg-rG40yxRm-_jQNwJLHQvZrbqzGZ_i77NATZ9ALc3g9Bth9zmj7DWBrMEt2YKyUpsXWJAGDSNolUOuuVO5yMqnEson2XqFA&go...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTM3NDE3NTM0NzEyNDMwODg5MDQ%3D&google_push=AYg5qPJg-rG40yxRm-_jQNwJLHQvZrbqzGZ_i77NATZ9ALc3g9Bth9zmj7DWBr...

170 B
188 B

42ms
41ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTM3NDE3NTM0NzEyNDMwODg5MDQ%3D&google_push=AYg5qPJg-rG40yxRm-_jQNwJLHQvZrbqzGZ_i77NATZ9ALc3g9Bth9zmj7DWBrMEt2YKyUpsXWJAGDSNolUOuuVO5yMqnEson2XqFA

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTM3NDE3NTM0NzEyNDMwODg5MDQ%3D&google_push=AYg5qPJg-rG40yxRm-_jQNwJLHQvZrbqzGZ_i77NATZ9ALc3g9Bth9zmj7DWBrMEt2YKyUpsXWJAGDSNolUOuuVO5yMqnEson2XqFA
date: Sat, 22 Jan 2022 11:57:31 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6BD6
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEB7QP4qszOB-oALY7JNTft0&google_cver=1&google_push=AYg5qPI8ICD952ER1HHgURtAxcUZi6VpBU12xso4ilk_LTs3KGqkHoZGqpy3a7OaIO_h3quDqB...
https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEB7QP4qszOB-oALY7JNTft0&google_cver=1&google_push=AYg5qPI8ICD952ER1HHgURtAxcUZi6VpBU12xso4ilk_LTs3KGqkHoZGqpy3a7OaIO_h3quDqB...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1fRHFzLkx0RTJ1Rmw0SUFURmNOU05EZXpiNnR2WWZWZX5B&google_push=AYg5qPI8ICD952ER1HHgURtAxcUZi6VpBU12xso4ilk_LTs3KGqkHoZGq...

170 B
188 B

48ms
47ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1fRHFzLkx0RTJ1Rmw0SUFURmNOU05EZXpiNnR2WWZWZX5B&google_push=AYg5qPI8ICD952ER1HHgURtAxcUZi6VpBU12xso4ilk_LTs3KGqkHoZGqpy3a7OaIO_h3quDqBzBpRvFJ3RVRkEn5U3QgGBia0DQ_A

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1fRHFzLkx0RTJ1Rmw0SUFURmNOU05EZXpiNnR2WWZWZX5B&google_push=AYg5qPI8ICD952ER1HHgURtAxcUZi6VpBU12xso4ilk_LTs3KGqkHoZGqpy3a7OaIO_h3quDqBzBpRvFJ3RVRkEn5U3QgGBia0DQ_A
date: Sat, 22 Jan 2022 11:57:31 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 6BD6 0
12 B 39ms
38ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KbVh7aAVTNEYOkkQQLhd8__oGf_28RX0LZsMm8uHVRpG_H3myuaFQ6wsbO2mKlTRro6r8zOQ

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:31 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 RSjKnk5gG5e-YnqyaokaGBofRBYcmQ35b5mWA3AF7Xg.js Show response
pagead2.googlesyndication.com/bg/ Frame C591 35 KB
13 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/RSjKnk5gG5e-YnqyaokaGBofRBYcmQ35b5mWA3AF7Xg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4528ca9e4e601b97be627ab26a891a181a1f44161c990df96f9996037005ed78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 21 Jan 2022 07:15:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 103338
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13497
x-xss-protection: 0
last-modified: Wed, 12 Jan 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 21 Jan 2023 07:15:13 GMT

GET
H3 200 RSjKnk5gG5e-YnqyaokaGBofRBYcmQ35b5mWA3AF7Xg.js Show response
pagead2.googlesyndication.com/bg/ Frame 0B3B 35 KB
13 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/RSjKnk5gG5e-YnqyaokaGBofRBYcmQ35b5mWA3AF7Xg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4528ca9e4e601b97be627ab26a891a181a1f44161c990df96f9996037005ed78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 21 Jan 2022 07:15:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 103338
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13497
x-xss-protection: 0
last-modified: Wed, 12 Jan 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 21 Jan 2023 07:15:13 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame BE70 0
60 B 75ms
75ms Ping
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Sat, 22 Jan 2022 11:57:31 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 B25496923.322073568;dc_ver=83.241;sz=970x250;u_sd=1;gdpr=1;dc_adk=3496576533;ord=jh5h2e;click=https%3A%2F%2Fpr.ybp.yahoo.com%2Fcj%2Fcd%2FUo0tiJEAWhnby-FAiQacfxJ-FBux0mznrAmMxS5jOj8V435xGekC9GpuyecQ... Show response
ad.doubleclick.net/ddm/adj/N996173.4385VERIZON/ Frame 6661 58 KB
24 KB 141ms
59ms Script
text/javascript 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N996173.4385VERIZON/B25496923.322073568;dc_ver=83.241;sz=970x250;u_sd=1;gdpr=1;dc_adk=3496576533;ord=jh5h2e;click=https%3A%2F%2Fpr.ybp.yahoo.com%2Fcj%2Fcd%2FUo0tiJEAWhnby-FAiQacfxJ-FBux0mznrAmMxS5jOj8V435xGekC9GpuyecQgYfkLQ0M6Iup36LxY_3wSzt57dfJSfAcKdemIhysFfhGCQCG_W6AUog4ZCoReay5JFgDArYiP5myYRkkb9ETKACKCF-XHq5IQ6HENAL0ixpt4iWyxkD16M5LCoQqUxf6RJEPCX5cNmIZWSAyK863SJApO9HbqzZBueFUQytU_8XOaq5j_Z7sO2E35aaNfvS_BS6ykcdEFmld3jWklJGj536qvEipdWjsyXxT%2Frurl%2F;dcopt=rcl;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Ffilecr.com%2F$0;xdt=1;crlt=Zwkb9RaF0n;gcsr=m;sttr=38;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v83.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

c38b6549e10d63f54e2173a229177cba7d0d7f2a0f58f20aec5ce6131a91b560

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24402
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 3BC3 0
23 B 109ms
68ms Ping
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Sat, 22 Jan 2022 11:57:31 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame FF2C 9 KB
4 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: pr-preprod-2.ybp.yahoo.com
URL: https://pr-preprod-2.ybp.yahoo.com/ab/secure/true/imp/uDxMKLKfPYJ89ZaENpup0LsafrCDLQVs2SNV08ohPpyFh9lg6YP2LulmvRdd-vMHsguORn0-c1eoqdwSM0ZsYwB9Qf7HGJyCaPOAFnlATHKoANRS2xE-if9185a_sBVmyRRPQBq4HwZOhkjNeHQSakfBmMrn-2zGWyxrSQUbRrFp8Qz90foKjc3wxrOx1EUNJ7Z8Epf3TMHBYxC3IEPWifO5yJ6vdwyyYU8wTRnJbdtL2PSSoWJqTq-g0X0MXai2Tc7BIvHhYyvxD47AqL51sWo1t0w7Ic2gQ51J4I6YGtVBxfThDXtY4VNFkU7ypg8NEeoBcLx6F1-fgde04SM_dFd_aDcsYBgyEILxU01T7QoLetRZBygvuHTG5CwiLu7FD7ysChWNr3I44lpT7S1R7s4eHJYZlEhJh70IOgCwwXwrg8nGRM2w1p3SwdJ30RJ7nxI0je2_9oZBRfUdyvOF4hj_Z4lNbAeobhJmhyVnNMLaZFWiVojNvdLPM61NdKZYtyWPLoyRgblyo4Q0TjyN_2JbxRfjprqQWbvgyHPTPqj0Ef99Bdmn0MiZjQWqNSLxYUp9RTrIebsz1WUq4lRULSe8OwPN7iA7HpIOL2j_G__KIFSLUOYrTWK_zxZlTlm4G2VRo-RyN71nZGPprTp_rDLzN9xo8g9ZV8xODGyu832_I7YftE7NHOe51Qmo3wmlNrevO7-_n9AvBiqgQysd4sgT2DTosSsPSTslrYXlUAdQq4oXbqmSEBd6zOjYl5pK7tBzX-DR6RJaYuz6ubDTUFOTw_uahDqPV3fzwUU8OSYlZ6xHg4_2AtNFWjFXP41_TdPBrid6gwmnJ39xD6_WRbeOdc2qa3C8UDbYXqICfstOVYSOXibOIC1WyGhFSvhL6ly2GBNjqJM8iLZ6KsLTkBOk2zyulQwVuLmwimV0UYfxfpxHyRwvtx8TSskhgXi3M0szlFVbT_WMqW26sERv2LdsQYmPdi2FkDRS1d2oySJnsRmSvh8ynNLE7xNegOLBPRSIu_h7Mpu0ziW139xk_t7zqCgqMYH6EDjKlx_rKmCpQuHf55BQ7ZFCgHbpD6IoPKuXaCsWpDAd9s4T5GRQ44gL4EN7Ozh-eqQtgv7VYJkh5zZPtxFn8Pc3oboieFLoIM4fhgteHO1gAGQXJZnOfyN8-g9JR1vRbjuiL5JXZifA1O9n3dJxI3tYBVvBGM6u4cFIVL7g64Cy6WC01_SMV13I8eXoyVujp_G1rtaFnyYCJf-HKLYfxL7cd8Cu_Enky1UuFTUvnzhWw_DkfbDM3d5plBhOqa52UJVKCzlR35GY2oOeTAfR2rH62JNpXW7M91bfUbVdbdw5HD5JeRTdRogb73vbJr3BbOgiMQLlxRbv9boPmlYgEoo4iEqxEEI3fdKAXaHGSPb-1wp70O4Hiw/wp/0.075000/pclick/https://clicktrack.pubmatic.com/AdServer/AdDisplayTrackerServlet?clickData=JnB1YklkPTE1OTg1NSZzaXRlSWQ9NzUwNTI5JmFkSWQ9MzEzNTA3MyZrYWRzaXplaWQ9NyZ0bGRJZD02NTM1NTc1MiZjYW1wYWlnbklkPTIzMDI2JmNyZWF0aXZlSWQ9MCZ1Y3JpZD0xMDk0NzY0MjQ0NTIwNDA3MTQyMiZhZFNlcnZlcklkPTI0MyZpbXBpZD01QzcwMTIwMi1GQTY5LTQxRDctQkJFQS0zQzAyREZCMjZDOUImcGFzc2JhY2s9MA==_url=

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7759e82036d42a08c8938fa81425a445b4662f4b5b9733cd047667e0feedcae5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:41:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 964
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4397
x-xss-protection: 0
last-modified: Thu, 20 Jan 2022 18:02:26 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Sat, 22 Jan 2022 12:41:27 GMT

GET
H2 200 skeleton.js Show response
pixel.adsafeprotected.com/rjss/st/490395/58820829/ Frame FF2C 46 KB
13 KB 50ms
49ms Script
application/javascript 54.76.247.168
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/rjss/st/490395/58820829/skeleton.js?ias_dspID=30&ias_campId=277442&ias_pubId=159855&ias_chanId=6&ias_placementId=1837526&bidurl=filecr.com
Requested by: Host: pr-preprod-2.ybp.yahoo.com
URL: https://pr-preprod-2.ybp.yahoo.com/ab/secure/true/imp/uDxMKLKfPYJ89ZaENpup0LsafrCDLQVs2SNV08ohPpyFh9lg6YP2LulmvRdd-vMHsguORn0-c1eoqdwSM0ZsYwB9Qf7HGJyCaPOAFnlATHKoANRS2xE-if9185a_sBVmyRRPQBq4HwZOhkjNeHQSakfBmMrn-2zGWyxrSQUbRrFp8Qz90foKjc3wxrOx1EUNJ7Z8Epf3TMHBYxC3IEPWifO5yJ6vdwyyYU8wTRnJbdtL2PSSoWJqTq-g0X0MXai2Tc7BIvHhYyvxD47AqL51sWo1t0w7Ic2gQ51J4I6YGtVBxfThDXtY4VNFkU7ypg8NEeoBcLx6F1-fgde04SM_dFd_aDcsYBgyEILxU01T7QoLetRZBygvuHTG5CwiLu7FD7ysChWNr3I44lpT7S1R7s4eHJYZlEhJh70IOgCwwXwrg8nGRM2w1p3SwdJ30RJ7nxI0je2_9oZBRfUdyvOF4hj_Z4lNbAeobhJmhyVnNMLaZFWiVojNvdLPM61NdKZYtyWPLoyRgblyo4Q0TjyN_2JbxRfjprqQWbvgyHPTPqj0Ef99Bdmn0MiZjQWqNSLxYUp9RTrIebsz1WUq4lRULSe8OwPN7iA7HpIOL2j_G__KIFSLUOYrTWK_zxZlTlm4G2VRo-RyN71nZGPprTp_rDLzN9xo8g9ZV8xODGyu832_I7YftE7NHOe51Qmo3wmlNrevO7-_n9AvBiqgQysd4sgT2DTosSsPSTslrYXlUAdQq4oXbqmSEBd6zOjYl5pK7tBzX-DR6RJaYuz6ubDTUFOTw_uahDqPV3fzwUU8OSYlZ6xHg4_2AtNFWjFXP41_TdPBrid6gwmnJ39xD6_WRbeOdc2qa3C8UDbYXqICfstOVYSOXibOIC1WyGhFSvhL6ly2GBNjqJM8iLZ6KsLTkBOk2zyulQwVuLmwimV0UYfxfpxHyRwvtx8TSskhgXi3M0szlFVbT_WMqW26sERv2LdsQYmPdi2FkDRS1d2oySJnsRmSvh8ynNLE7xNegOLBPRSIu_h7Mpu0ziW139xk_t7zqCgqMYH6EDjKlx_rKmCpQuHf55BQ7ZFCgHbpD6IoPKuXaCsWpDAd9s4T5GRQ44gL4EN7Ozh-eqQtgv7VYJkh5zZPtxFn8Pc3oboieFLoIM4fhgteHO1gAGQXJZnOfyN8-g9JR1vRbjuiL5JXZifA1O9n3dJxI3tYBVvBGM6u4cFIVL7g64Cy6WC01_SMV13I8eXoyVujp_G1rtaFnyYCJf-HKLYfxL7cd8Cu_Enky1UuFTUvnzhWw_DkfbDM3d5plBhOqa52UJVKCzlR35GY2oOeTAfR2rH62JNpXW7M91bfUbVdbdw5HD5JeRTdRogb73vbJr3BbOgiMQLlxRbv9boPmlYgEoo4iEqxEEI3fdKAXaHGSPb-1wp70O4Hiw/wp/0.075000/pclick/https://clicktrack.pubmatic.com/AdServer/AdDisplayTrackerServlet?clickData=JnB1YklkPTE1OTg1NSZzaXRlSWQ9NzUwNTI5JmFkSWQ9MzEzNTA3MyZrYWRzaXplaWQ9NyZ0bGRJZD02NTM1NTc1MiZjYW1wYWlnbklkPTIzMDI2JmNyZWF0aXZlSWQ9MCZ1Y3JpZD0xMDk0NzY0MjQ0NTIwNDA3MTQyMiZhZFNlcnZlcklkPTI0MyZpbXBpZD01QzcwMTIwMi1GQTY5LTQxRDctQkJFQS0zQzAyREZCMjZDOUImcGFzc2JhY2s9MA==_url=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.76.247.168 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-247-168.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1827ad5c79d4b7218defbf02cdf927a88808bf77f4769486c4c4645262382667

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
content-encoding: gzip
x-server-name: app03.ie.303net.net
content-type: application/javascript;charset=utf-8
access-control-allow-origin: pixel.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 inside.js Show response
cdn.js7k.com/rq/iv/ Frame FF2C 43 KB
14 KB 37ms
36ms Script
application/javascript 2a00:1288:80:800::7001
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.js7k.com/rq/iv/inside.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7001 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

1b3f1a6337f21366cf59487bb664dd0983c245ccf100be143f4366a07e005d09

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:20:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2201
x-amz-server-side-encryption: AES256
vary: Origin, Accept-Encoding
content-length: 14353
x-amz-id-2: qFtB4FFaVJDKlmU1kcFJNu0hWXcg9zFyd96IsxEqTsCeg39uOvd8KkmMyEaErn3eks2JVLsbXmo=
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 09 Sep 2021 15:05:50 GMT
server: ATS
etag: "8ceeaab271ed688991789ed1090cb398-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: PX8BEVDNVXWQ1JVQ
x-xss-protection: 1; mode=block
cache-control: public,max-age=14400
accept-ranges: bytes
content-type: application/javascript; charset=utf-8

GET
H2 200 adchoicesblue.png
s.yimg.com/ch/icons/adchoices/ Frame FF2C 565 B
610 B 38ms
37ms Image
image/png 2a00:1288:80:800::7001
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.yimg.com/ch/icons/adchoices/adchoicesblue.png

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7001 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

b8954ed878ae615531f62b8d9a95a79d9a86a84f4af1504bcbec32d8e62d7ebd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Wed, 05 Jan 2022 12:41:48 GMT
x-content-type-options: nosniff
age: 1466144
x-amz-server-side-encryption: AES256
vary: Origin
content-length: 565
x-amz-id-2: 6R7HJktLX6mTOyhMRrUZP+19gk7H2l6CSdyhll+EH4Y1SxG2UHE8cXwY42osOOChV8+2Btmqv6A=
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 22 Jul 2020 18:15:42 GMT
server: ATS
etag: "349bad1100a940608cb9109eb2b166a2"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: MM73SBDVFF9734CR
x-xss-protection: 1; mode=block
cache-control: max-age=15552000, public
x-amz-version-id: null
accept-ranges: bytes
content-type: image/png

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 87 KB
28 KB 122ms
58ms XHR
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

90c9017a8a6447588520f38cd94ba14cdb9839c92626aa06bb8a4a1052c2ab7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:31 GMT
content-encoding: gzip
last-modified: Wed, 29 Dec 2021 12:30:43 GMT
server: nginx
etag: W/"61cc54f3-15c19"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jan 2022 11:57:31 GMT

GET
H2 200 sync Show response
gum.criteo.com/ Frame 09C1 51 B
376 B 131ms
38ms Script
text/javascript 2a02:2638:1::13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?c=30&r=2&j=cr_handle_data_a

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?id=18678115&size=728x90&cb=1098125677&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjsslU80VlFR-XZ0g_CDpnFF03ea2qkWBR9THJGCI36mQM3x0DwOeTyD1z1s2DSJ3vuIN2v03FIOJG3zZXiThQ4lOw_ViZgo7f9ax5-ALOubjSvO2PLXIzRsUPfSxLED-fSbD9CTAIZMPhYh0yCaOgtOwk5NDMU3L5dfya93AyHyJabTvhA3UQoIMIZJs5GQsluP9ECPyC39vquL7MFkOJ2pOONtBaW1hMcEVv2I3iZonC6Edh_IzZRdDbhLZUCnVbMIhegIK9yBBRiY2BnNiwqdplSVttUok5ChcVWcXQs4ldq-GZNXQ0RN58r3ZRsjm7M8%2526sig%253DCg0ArKJSzGn5c4Ir3gpJEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

acb5d519051cc13618e992a7df4bce6a980036dfbe2e17a970ec716194329f6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:30 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 1626
strict-transport-security: max-age=31536000; preload;
content-length: 169
expires: 60

GET
H/1.1 200
OK ttj Show response
secure.adnxs.com/ Frame 09C1 3 KB
3 KB 86ms
84ms Script
application/javascript 185.33.221.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?ttjb=1&bdc=1642852651&bdh=TUCvkTAhKI7Goq-klUCVrEDwWH4.&&bdref=https%3A%2F%2Ffilecr.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Ffilecr.com%2F,https%3A%2F%2Ftpc.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=728x90&cb=1098125677&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsslU80VlFR-XZ0g_CDpnFF03ea2qkWBR9THJGCI36mQM3x0DwOeTyD1z1s2DSJ3vuIN2v03FIOJG3zZXiThQ4lOw_ViZgo7f9ax5-ALOubjSvO2PLXIzRsUPfSxLED-fSbD9CTAIZMPhYh0yCaOgtOwk5NDMU3L5dfya93AyHyJabTvhA3UQoIMIZJs5GQsluP9ECPyC39vquL7MFkOJ2pOONtBaW1hMcEVv2I3iZonC6Edh_IzZRdDbhLZUCnVbMIhegIK9yBBRiY2BnNiwqdplSVttUok5ChcVWcXQs4ldq-GZNXQ0RN58r3ZRsjm7M8%2526sig%253DCg0ArKJSzGn5c4Ir3gpJEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.90 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4561751b4f9d4118d21e13c6e4de1298d244fc3613887b1b1914a55ef856ca26

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Sat, 22 Jan 2022 11:57:31 GMT
Content-Encoding: gzip
X-Creative-ID: 41873061
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 192.145.127.216; 192.145.127.216; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 961ffa2c-10c5-4a01-ae89-2aa0db5ff735
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 impl_v83.js Show response
www.googletagservices.com/dcm/ Frame FF2C 41 KB
17 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v83.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

933e25b64ded3d3f6a346e3a9cf2611a7ce867985ee3b07089bdd7ffe33d64ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 18 Jan 2022 19:57:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 316801
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17213
x-xss-protection: 0
last-modified: Tue, 18 Jan 2022 19:47:28 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 18 Jan 2023 19:57:30 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 6661 106 KB
37 KB 61ms
28ms Script
text/javascript 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
Origin: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 09:54:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7380
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 23 Jan 2022 09:54:31 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220119/r20110914/elements/html/ Frame 6661 8 KB
3 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220119/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N996173.4385VERIZON/B25496923.322073568;dc_ver=83.241;sz=970x250;u_sd=1;gdpr=1;dc_adk=3496576533;ord=jh5h2e;click=https%3A%2F%2Fpr.ybp.yahoo.com%2Fcj%2Fcd%2FUo0tiJEAWhnby-FAiQacfxJ-FBux0mznrAmMxS5jOj8V435xGekC9GpuyecQgYfkLQ0M6Iup36LxY_3wSzt57dfJSfAcKdemIhysFfhGCQCG_W6AUog4ZCoReay5JFgDArYiP5myYRkkb9ETKACKCF-XHq5IQ6HENAL0ixpt4iWyxkD16M5LCoQqUxf6RJEPCX5cNmIZWSAyK863SJApO9HbqzZBueFUQytU_8XOaq5j_Z7sO2E35aaNfvS_BS6ykcdEFmld3jWklJGj536qvEipdWjsyXxT%2Frurl%2F;dcopt=rcl;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Ffilecr.com%2F$0;xdt=1;crlt=Zwkb9RaF0n;gcsr=m;sttr=38;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:51:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 379
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 05 Feb 2022 11:51:12 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 6661 41 KB
15 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 15:54:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 245009
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Jan 2023 15:54:02 GMT

GET
H2 200 main.gr.19.8.280.js Show response
static.adsafeprotected.com/ Frame 6661 188 KB
60 KB 107ms
36ms Script
application/javascript 2600:9000:224a:4600:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.gr.19.8.280.js
Requested by: Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/rjss/st/490395/58820823/skeleton.js?ias_dspID=30&ias_campId=277442&ias_pubId=159855&ias_chanId=6&ias_placementId=1837526&bidurl=filecr.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:224a:4600:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3a2d9cbe8b064e127245b7b16fa32baf1b1512aa3a3c8bdb3e499a4af1eea2f4

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 11 Jan 2022 23:31:11 GMT
content-encoding: gzip
age: 908781
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 11 Jan 2022 23:16:08 GMT
server: AmazonS3
etag: W/"90392bea80ae4672c9e7068b39b989e3"
vary: Accept-Encoding
x-amz-version-id: yTEXMMT7bLWcsJAanoak73m.vg84ulfF
via: 1.1 cd8cc1ff175a63c59feeb56bb3687766.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: DUS51-P1
content-type: application/javascript
x-amz-cf-id: a_Wcmvnua306sSkBsedlq6qu6Bxonqvj1gImOVrwU3-_onqgua1gFw==

GET
H2 200 showad.js Show response
ads.pubmatic.com/AdServer/js/ Frame 32F2 38 KB
14 KB 62ms
18ms Document
text/html 92.122.147.28
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 92.122.147.28 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-147-28.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 877fa64eb78a65e1b23fef6c4acd56fd991c23f286250122e75c89b97e2cd405

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/

Response headers

last-modified: Tue, 11 Jan 2022 05:13:08 GMT
etag: "1302647-9687-5d547824a78f1"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 13928
content-type: text/html; charset=UTF-8
cache-control: public, max-age=131000
expires: Mon, 24 Jan 2022 00:20:51 GMT
date: Sat, 22 Jan 2022 11:57:31 GMT
vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 8B2D 1 KB
749 B 25ms
24ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Fri, 21 Jan 2022 13:26:12 GMT
expires: Sat, 22 Jan 2022 13:26:12 GMT
cache-control: public, max-age=86400
age: 81079
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 6661 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6c6c7d30c44c98deeb1dfe834ffebc59fe86f6e48f670d80a0121c1f61fb1df1

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 B25496923.322073577;dc_ver=83.241;sz=728x90;u_sd=1;gdpr=1;dc_adk=3281549113;ord=d99l06;click=https%3A%2F%2Fpr-preprod-2.ybp.yahoo.com%2Fcj%2Fcd%2FxJJ9IiwzE2-RobkFfbAKJTJCSey6mW6GABY1NFaqJ2mnQa6THoh... Show response
ad.doubleclick.net/ddm/adj/N996173.4385VERIZON/ Frame FF2C 58 KB
24 KB 109ms
69ms Script
text/javascript 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N996173.4385VERIZON/B25496923.322073577;dc_ver=83.241;sz=728x90;u_sd=1;gdpr=1;dc_adk=3281549113;ord=d99l06;click=https%3A%2F%2Fpr-preprod-2.ybp.yahoo.com%2Fcj%2Fcd%2FxJJ9IiwzE2-RobkFfbAKJTJCSey6mW6GABY1NFaqJ2mnQa6THohVeusJjOEnm1i0EaBqmChgB-ofk5kRns3b0E_b_8-Je_-p9uUsKBW6CoV4VCV9vE-8HwEsrYVnbtpqARBRX2Bik-ZcpJnl5Qr-V0h5rpIM-xn-MZGEE0XPQCI57lgpx3__-pH67anwQOUkqrtNd9DTlDwdkiVE33qB52G3t3zR0fu-mCuIknlNogPHMBu22_EwteQklmurwsOAKmnOTrfuGyOfEILBpgCOUdUoofLYxDhl%2Frurl%2F;dcopt=rcl;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Ffilecr.com%2F$0;xdt=1;crlt=Zwkb9RaF0n;gcsr=m;sttr=68;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v83.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

8c30b6acb2f965a09d6777cb25fd34d003f814fda129e96b781fcd12c7d48083

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24461
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 0117 22 KB
8 KB 26ms
25ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 19 Jan 2022 10:49:42 GMT
expires: Thu, 19 Jan 2023 10:49:42 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 263269
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK ttj Show response
ib.adnxs.com/ Frame 09C1 4 KB
3 KB 37ms
36ms Script
application/javascript 185.33.221.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ttj?id=6589257&psa=0&cb=754589590&gdpr=0&gdpr_consent=&loc=,&pubclick=https://ams1-ib.adnxs.com/click?AAAAAAAAAAAAAAAAAAAAAAAAACCF67E_AAAAAAAAAAAAAAAAAAAAAMLVrZNFFSYi5kEBOerjKjgr8ethAAAAAGMBHQHKIAAA5QAAAAIAAACl7n4CmKoUAAAAAAAAAAAAVVNEANgCWgBrrgAAAAABAgEAAAAAAMwAtxWkdQAAAAA./bcr=AAAAAAAAAAA=/bn=0/clickenc=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsslU80VlFR-XZ0g_CDpnFF03ea2qkWBR9THJGCI36mQM3x0DwOeTyD1z1s2DSJ3vuIN2v03FIOJG3zZXiThQ4lOw_ViZgo7f9ax5-ALOubjSvO2PLXIzRsUPfSxLED-fSbD9CTAIZMPhYh0yCaOgtOwk5NDMU3L5dfya93AyHyJabTvhA3UQoIMIZJs5GQsluP9ECPyC39vquL7MFkOJ2pOONtBaW1hMcEVv2I3iZonC6Edh_IzZRdDbhLZUCnVbMIhegIK9yBBRiY2BnNiwqdplSVttUok5ChcVWcXQs4ldq-GZNXQ0RN58r3ZRsjm7M8%2526sig%253DCg0ArKJSzGn5c4Ir3gpJEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1642852651&bdh=TUCvkTAhKI7Goq-klUCVrEDwWH4.&&bdref=https%3A%2F%2Ffilecr.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Ffilecr.com%2F,https%3A%2F%2Ftpc.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=728x90&cb=1098125677&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsslU80VlFR-XZ0g_CDpnFF03ea2qkWBR9THJGCI36mQM3x0DwOeTyD1z1s2DSJ3vuIN2v03FIOJG3zZXiThQ4lOw_ViZgo7f9ax5-ALOubjSvO2PLXIzRsUPfSxLED-fSbD9CTAIZMPhYh0yCaOgtOwk5NDMU3L5dfya93AyHyJabTvhA3UQoIMIZJs5GQsluP9ECPyC39vquL7MFkOJ2pOONtBaW1hMcEVv2I3iZonC6Edh_IzZRdDbhLZUCnVbMIhegIK9yBBRiY2BnNiwqdplSVttUok5ChcVWcXQs4ldq-GZNXQ0RN58r3ZRsjm7M8%2526sig%253DCg0ArKJSzGn5c4Ir3gpJEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.90 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

723.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

304be7da13ac561bc8f0470931bc45af260de7915cc044368e445875f9942ddc

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Sat, 22 Jan 2022 11:57:31 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 192.145.127.216; 192.145.127.216; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: f731e884-ed8b-41ef-b194-696f79218fc7
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK it
ams1-ib.adnxs.com/ Frame 09C1 0
807 B 147ms
46ms Image
text/html 185.33.221.87
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ams1-ib.adnxs.com/it?an_audit=0&e=wqT_3QLFB6DFAwAAAwDWAAUBCKvir48GEMKrt53ZqIWTIhjmg4XIo_24lTgqNgkAAAkCABEJBywAABkAAAAgheuxPyEREgApEQn0cQMxAAAAQOF6hD8w44L0CDjKQUDlAUgCUKXd-xNYmNVSYABo69yaAXgAgAEBigEAkgEDVVNEmAHYBaABWqgBAbABALgBAsABAcgBANABANgBAOABAOoB8wNodHRwcyUzQSUyRiUyRmFkY2xpY2suZy5kb3VibGVjbGljay5uZXQlMkZwY3MlMkZjbGljayUyNTNGeGFpJTI1M0RBS0FPanNzbFU4MFZsRlItWFowZ19DRHBuRkYwM2VhMnFrV0JSOVRISkdDSTM2bVFNM3gwRHdPZVR5RDF6MXMyRFNKM3Z1SU4ydjAzRklPSkczelpYaVRoUTRsT3dfVmlaZ283ZjlheDUtQUxPdWJqU3ZPMlBMWEl6UnNVUGZTeExFRC1mU2JEOUNUQUlaTVBoWWgweUNhT2d0T3drNU5ETVUzTDVkZnlhOTNBeUh5SmFiVHZoQTNVUW9JTUlaSnM1R1FzbHVQOUVDUHlDMzl2cXVMN01Ga09KMnBPT050QmFXMWhNY0VWdjJJM2lab25DNkVkaF9JelpSZERiaExaVUNuVmJNSWhlZ0lLOXlCQlJpWTJCbk5pd3FkcGxTVnR0VW9rNUNoY1ZXY1hRczRsZHEtR1pOWFEwUk41OHIzWlJzam03TTglMjUyNnNpZyUyNTNEQ2cwQXJLSlN6R241YzRJcjNncEpFQUUlMjUyNmZic19hZWlkJTI1M0QlMjU1Qmd3X2Zic2FlaWQlMjU1RCUyNTI2dXJsZml4JTI1M0QxJTI1MjZhZHVybCUyNTNE8AEA2AIA4AKf8D-AAwCIAwGQAwCYAxmgAwGqAwDAA6wCyAMA2APavbwB4AMA6AMA-AMAgAQAkgQEL3R0apgEAKIEDzE5Mi4xNDUuMTI3LjIxNqgEALIEDAgAEAAYACAAMAA4ALgEAMAEAMgEANoEAggA4AQA8ASl3fsTiAUBmAUAoAUAwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAPAFAPoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAAAA2gYWChAAAAAAAAAAAAAAAAAAAAAAEAAYAOAGAPIGAggAgAcBiAcAoAcAugcPCAAQABgAIAAwADiEJUAAyAcA0gcNCQAAAAAAAAAAEAAYANoHBggAEAAYAOAHAOoHAggA8AdHiggCEAA.&s=ef7fc325751101d8e02d56d81301935f7b08447c

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.87 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:31 GMT
X-Proxy-Origin: 192.145.127.216; 192.145.127.216; 723.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 314812b3-ee5a-40bb-bec8-44f21ae49bdf
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6661 122 KB
37 KB 110ms
110ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

425f48a06ab0e9a4a4d792a6677189720f377ec09a073ecdae6232a89cc221f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38060
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1642595990432946"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 22 Jan 2022 11:57:31 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/9057854/1638374452378/970x250/ Frame B5DC 6 KB
2 KB 69ms
30ms Document
text/html 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9057854/1638374452378/970x250/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f561ad170e9866f5dbb3e7a70163ed82fdaf329e07af259f8bafd59a1ea30c44

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-length: 2383
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 21 Jan 2022 13:11:04 GMT
expires: Sat, 22 Jan 2022 13:11:04 GMT
cache-control: public, max-age=86400
age: 81987
last-modified: Wed, 01 Dec 2021 16:00:52 GMT
content-type: text/html
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 6661 0
23 B 69ms
68ms Ping
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuVlkhNyx-X_JW444cKmGXyn0u6T6WJcr3340nVxetdEWp2KI0c5pviLFkxG8rTEzvhVOFRPmLD8KTwAnBS5d17WCoJpJPHPHc0IQQkw_pmJ_PEb5jOaDsO3hZDSDX8DSuHmk6i6sAZUWsYtYxN&sig=Cg0ArKJSzGSDuv3qcBdyEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=120&cbvp=1&cstd=118&cisv=r20220119.50183&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-52-211-244-253.eu-west-1.compute.amazonaws.com

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Sat, 22 Jan 2022 11:57:31 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1

200
OK

firstevent
enelspa.demdex.net/ Frame 6661
Redirect Chain

https://enelspa.demdex.net/event?d_event=imp&d_src=19902&d_campaign=display-verizon-fo_b2c_scegli_oggi_gas-performance-scegli_oggi_gas_3rdparty_mario_30&d_site=6534937&d_adsrc=514330643&d_bu=905785...
https://enelspa.demdex.net/firstevent?d_event=imp&d_src=19902&d_campaign=display-verizon-fo_b2c_scegli_oggi_gas-performance-scegli_oggi_gas_3rdparty_mario_30&d_site=6534937&d_adsrc=514330643&d_bu=9...

42 B
953 B

112ms
54ms

Image
image/gif

52.211.244.253
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://enelspa.demdex.net/firstevent?d_event=imp&d_src=19902&d_campaign=display-verizon-fo_b2c_scegli_oggi_gas-performance-scegli_oggi_gas_3rdparty_mario_30&d_site=6534937&d_adsrc=514330643&d_bu=9057854&d_creative=162561892

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Server

52.211.244.253 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v027-08f66671e.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: djpA3tPARPA=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-2-v027-0eab81db2.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: d8BdTFLkQVw=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://enelspa.demdex.net/firstevent?d_event=imp&d_src=19902&d_campaign=display-verizon-fo_b2c_scegli_oggi_gas-performance-scegli_oggi_gas_3rdparty_mario_30&d_site=6534937&d_adsrc=514330643&d_bu=9057854&d_creative=162561892
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H3 200 dds
rtb.openx.net/sync/ Frame 8B2D 43 B
64 B 54ms
35ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEJ7fcDOsXbNic79NfBEKwyE&google_cver=1&google_push=AYg5qPK-H8p9QqMIPAXUlA_futBZCUff1bAlHG4YpAJgctcycol3JipMF5JstxNmcKMu9N_AlO06MYx4R0fNigF8Y0LLXWrWmNnS1Q
Requested by: Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:30 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: u80k96m5uaumo2a2h5gdh6htccfa2tve

GET

pixel
cm.g.doubleclick.net/ Frame 8B2D
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEB--ML_x_MUOZ4ZQo1040FI&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_push=AYg5qPK6rrqNKLbcQDBCVGmYsAUdzFEW4QT9m_IirR8ayJoQdwCP85NmgqVfbmy9xaXcbSeUJVM7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_push=AYg5qPK6rrqNKLbcQDBCVGmYsAUdzFEW4QT9m_IirR8ayJoQdwCP85NmgqVfbmy9xaXcbSeUJVM7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_push=AYg5qPK6rrqNKLbcQDBCVGmYsAUdzFEW4QT9m_IirR8ayJoQdwCP85NmgqVfbmy9xaXcbSeUJVM7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_push=AYg5qPK6rrqNKLbcQDBCVGmYsAUdzFEW4QT9m_IirR8ayJoQdwCP85NmgqVfbmy9xaXcbSeUJVM7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_push=AYg5qPK6rrqNKLbcQDBCVGmYsAUdzFEW4QT9m_IirR8ayJoQdwCP85NmgqVfbmy9xaXcbSeUJVM7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_push=AYg5qPK6rrqNKLbcQDBCVGmYsAUdzFEW4QT9m_IirR8ayJoQdwCP85NmgqVfbmy9xaXcbSeUJVM7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_push=AYg5qPK6rrqNKLbcQDBCVGmYsAUdzFEW4QT9m_IirR8ayJoQdwCP85NmgqVfbmy9xaXcbSeUJVM7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_push=AYg5qPK6rrqNKLbcQDBCVGmYsAUdzFEW4QT9m_IirR8ayJoQdwCP85NmgqVfbmy9xaXcbSeUJVM7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_push=AYg5qPK6rrqNKLbcQDBCVGmYsAUdzFEW4QT9m_IirR8ayJoQdwCP85NmgqVfbmy9xaXcbSeUJVM7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_push=AYg5qPK6rrqNKLbcQDBCVGmYsAUdzFEW4QT9m_IirR8ayJoQdwCP85NmgqVfbmy9xaXcbSeUJVM7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_push=AYg5qPK6rrqNKLbcQDBCVGmYsAUdzFEW4QT9m_IirR8ayJoQdwCP85NmgqVfbmy9xaXcbSeUJVM7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_push=AYg5qPK6rrqNKLbcQDBCVGmYsAUdzFEW4QT9m_IirR8ayJoQdwCP85NmgqVfbmy9xaXcbSeUJVM7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_push=AYg5qPK6rrqNKLbcQDBCVGmYsAUdzFEW4QT9m_IirR8ayJoQdwCP85NmgqVfbmy9xaXcbSeUJVM7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_push=AYg5qPK6rrqNKLbcQDBCVGmYsAUdzFEW4QT9m_IirR8ayJoQdwCP85NmgqVfbmy9xaXcbSeUJVM7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_push=AYg5qPK6rrqNKLbcQDBCVGmYsAUdzFEW4QT9m_IirR8ayJoQdwCP85NmgqVfbmy9xaXcbSeUJVM7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_push=AYg5qPK6rrqNKLbcQDBCVGmYsAUdzFEW4QT9m_IirR8ayJoQdwCP85NmgqVfbmy9xaXcbSeUJVM7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_push=AYg5qPK6rrqNKLbcQDBCVGmYsAUdzFEW4QT9m_IirR8ayJoQdwCP85NmgqVfbmy9xaXcbSeUJVM7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_push=AYg5qPK6rrqNKLbcQDBCVGmYsAUdzFEW4QT9m_IirR8ayJoQdwCP85NmgqVfbmy9xaXcbSeUJVM7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_push=AYg5qPK6rrqNKLbcQDBCVGmYsAUdzFEW4QT9m_IirR8ayJoQdwCP85NmgqVfbmy9xaXcbSeUJVM7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&google_cver=1&google_push=AYg5qPK6rrqNKLbcQDBCVGmYsAUdzFEW4QT9m_IirR8ayJoQdwCP85NmgqVfbmy9xaXcbSeUJVM7...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8B2D
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEL6LY65S73EucupCEA01qn8&google_cver=1&google_push=AYg5qPJdgZNGhD85-8kEv4UBwqVVG6sSNrTzPTbjsWzO7amI1NIdTyhCsozioSOW9nBZQVVtfjetM-gA1LgZNUic8bXSvtKOB6...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTM3NDE3NTM0NzEyNDMwODg5MDQ%3D&google_push=AYg5qPJdgZNGhD85-8kEv4UBwqVVG6sSNrTzPTbjsWzO7amI1NIdTyhCsozioS...

170 B
188 B

60ms
59ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTM3NDE3NTM0NzEyNDMwODg5MDQ%3D&google_push=AYg5qPJdgZNGhD85-8kEv4UBwqVVG6sSNrTzPTbjsWzO7amI1NIdTyhCsozioSOW9nBZQVVtfjetM-gA1LgZNUic8bXSvtKOB6-8EQ

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTM3NDE3NTM0NzEyNDMwODg5MDQ%3D&google_push=AYg5qPJdgZNGhD85-8kEv4UBwqVVG6sSNrTzPTbjsWzO7amI1NIdTyhCsozioSOW9nBZQVVtfjetM-gA1LgZNUic8bXSvtKOB6-8EQ
date: Sat, 22 Jan 2022 11:57:31 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8B2D
Redirect Chain

https://cs.media.net/cksync?type=g&google_gid=CAESEM9jbs8gUUdfEyo2WGPHDH0&google_cver=1&google_push=AYg5qPJcN4YXT54xstw6XttiLe7170nO9pW9mNMZyRMqGYC9tj9WqXWfijPt3zULV3QdYdQIxGL9gypQtHyETVUB6lCBz3VKX...
https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=Mjg1ODU0MjUxNjA5MjAyMDAwMFYxMA%3d%3d&mn_hm=Mjg1ODU0MjUxNjA5MjAyMDAwMFYxMA%3d%3d&google_sc=1&google_push=AYg5qPJcN4YXT54xstw6XttiLe7170n...

170 B
188 B

42ms
42ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=Mjg1ODU0MjUxNjA5MjAyMDAwMFYxMA%3d%3d&mn_hm=Mjg1ODU0MjUxNjA5MjAyMDAwMFYxMA%3d%3d&google_sc=1&google_push=AYg5qPJcN4YXT54xstw6XttiLe7170nO9pW9mNMZyRMqGYC9tj9WqXWfijPt3zULV3QdYdQIxGL9gypQtHyETVUB6lCBz3VKXOP5OQ&gdpr=&gdpr_consent=

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:31 GMT
Server: Apache
P3P: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Location: https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=Mjg1ODU0MjUxNjA5MjAyMDAwMFYxMA%3d%3d&mn_hm=Mjg1ODU0MjUxNjA5MjAyMDAwMFYxMA%3d%3d&google_sc=1&google_push=AYg5qPJcN4YXT54xstw6XttiLe7170nO9pW9mNMZyRMqGYC9tj9WqXWfijPt3zULV3QdYdQIxGL9gypQtHyETVUB6lCBz3VKXOP5OQ&gdpr=&gdpr_consent=
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html
Content-Length: 154
X-MNET-HL2: E
Expires: Sat, 22 Jan 2022 11:57:31 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8B2D
Redirect Chain

https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEBuFLEHP0LDO1vlMqjKTD04&google_cver=1&google_push=AYg5qPITS1ZlHeYlxB96h39r032A5Q-g8-GY784oCRFpSMVUV9fLNFav...
https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEBuFLEHP0LDO1vlMqjKTD04&google_cver=1&google_push=AYg5qPITS1ZlHeYlxB96h39r032A5Q-g8-GY784oCRFpSMVUV9fLNFav...
https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEBuFLEHP0LDO1vlMqjKTD04&google_cver=1&google_push=AYg5qPITS1ZlHeYlxB96h39r032A5Q-g8-GY784oCRFpSMVUV9fLNF...
https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA3YWJiZmVlNS03YjdhLTExZWMtYTllMi0wNjJmMGIwY2JjMDQ%3D&google_push=AYg5qPITS1ZlHeYlxB96h39r032A5Q-g8-GY784oCRFpSMVUV9fLNFavMTNFwZ--h_...

170 B
188 B

45ms
44ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA3YWJiZmVlNS03YjdhLTExZWMtYTllMi0wNjJmMGIwY2JjMDQ%3D&google_push=AYg5qPITS1ZlHeYlxB96h39r032A5Q-g8-GY784oCRFpSMVUV9fLNFavMTNFwZ--h_5Ur_lsvmYTYe5XU0wLT-j0RC-OrOeHcJ4YmmY

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA3YWJiZmVlNS03YjdhLTExZWMtYTllMi0wNjJmMGIwY2JjMDQ%3D&google_push=AYg5qPITS1ZlHeYlxB96h39r032A5Q-g8-GY784oCRFpSMVUV9fLNFavMTNFwZ--h_5Ur_lsvmYTYe5XU0wLT-j0RC-OrOeHcJ4YmmY
date: Sat, 22 Jan 2022 11:57:31 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8B2D
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEB7QP4qszOB-oALY7JNTft0&google_cver=1&google_push=AYg5qPJF4ldti_eS6cnLPx7LyvwYPVwc5N8cU5UeGOU6CzBxsnOSBBNYsuMXCSa_6E7KtbMFaU...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1WT1hqUmhwRTJ1RjIweTFkWVlvR2NEVXRyeEhCOHFBYn5B&google_push=AYg5qPJF4ldti_eS6cnLPx7LyvwYPVwc5N8cU5UeGOU6CzBxsnOSBBNYs...

170 B
188 B

46ms
45ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1WT1hqUmhwRTJ1RjIweTFkWVlvR2NEVXRyeEhCOHFBYn5B&google_push=AYg5qPJF4ldti_eS6cnLPx7LyvwYPVwc5N8cU5UeGOU6CzBxsnOSBBNYsuMXCSa_6E7KtbMFaUxomJ0v4tQTYWB2v2xRrow5ynlBWo4

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1WT1hqUmhwRTJ1RjIweTFkWVlvR2NEVXRyeEhCOHFBYn5B&google_push=AYg5qPJF4ldti_eS6cnLPx7LyvwYPVwc5N8cU5UeGOU6CzBxsnOSBBNYsuMXCSa_6E7KtbMFaUxomJ0v4tQTYWB2v2xRrow5ynlBWo4
date: Sat, 22 Jan 2022 11:57:31 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8B2D
Redirect Chain

https://match.sharethrough.com/E4rooAtA/v1?google_gid=CAESEDtZeGrLLH-_ksklHipNZvY&google_cver=1&google_push=AYg5qPJGpv5O5BoKq9khJekNna3v-9mH4AOdVotsVJIB7fHFGm90iRioKYrGX_R5AZG1yfAQGYUODDVNGK1nDXZXT...
https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=NTRlNDBiYWQtYTNhYi00NjZhLWJhY2QtYzNlN2FkMTgzNzUy&google_push=AYg5qPJGpv5O5BoKq9khJekNna3v-9mH4AOdVotsVJIB7fHFGm90iRioKYrGX_R5...

170 B
188 B

42ms
41ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=NTRlNDBiYWQtYTNhYi00NjZhLWJhY2QtYzNlN2FkMTgzNzUy&google_push=AYg5qPJGpv5O5BoKq9khJekNna3v-9mH4AOdVotsVJIB7fHFGm90iRioKYrGX_R5AZG1yfAQGYUODDVNGK1nDXZXTZWCrkCjKzvfyQ

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=NTRlNDBiYWQtYTNhYi00NjZhLWJhY2QtYzNlN2FkMTgzNzUy&google_push=AYg5qPJGpv5O5BoKq9khJekNna3v-9mH4AOdVotsVJIB7fHFGm90iRioKYrGX_R5AZG1yfAQGYUODDVNGK1nDXZXTZWCrkCjKzvfyQ
date: Sat, 22 Jan 2022 11:57:31 GMT
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 8B2D 0
12 B 46ms
42ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LyNJ1g9tuM4hh9H6PwwFiD7WqgKeWQUzBDYzRoeWPKKthmmDlOTvD4jAAGKmJlPaC9qNSFRZH_

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:31 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 32F2 0
39 B 36ms
32ms Script
text/plain 198.47.127.19
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=47801480&p=159855&s=750529&a=0&ptask=DSP&np=0&fp=1&rp=0&mpc=10&spug=1&coppa=0&gdpr=1&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.47.127.19 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:30 GMT
content-length: 0

GET
H/1.1 200
OK ttj Show response
ib.adnxs.com/ Frame 09C1 0
807 B 66ms
64ms Script
text/html 185.33.221.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ttj?ttjb=1&bdc=1642852651&bdh=TUCvkTAhKI7Goq-klUCVrEDwWH4.&bdref=https%3A%2F%2Ffilecr.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Ffilecr.com%2F,https%3A%2F%2Ftpc.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=6589257&psa=0&cb=754589590&gdpr=0&gdpr_consent=&loc=%2C&pubclick=https%3A%2F%2Fams1-ib.adnxs.com%2Fclick%3FAAAAAAAAAAAAAAAAAAAAAAAAACCF67E_AAAAAAAAAAAAAAAAAAAAAMLVrZNFFSYi5kEBOerjKjgr8ethAAAAAGMBHQHKIAAA5QAAAAIAAACl7n4CmKoUAAAAAAAAAAAAVVNEANgCWgBrrgAAAAABAgEAAAAAAMwAtxWkdQAAAAA.%2Fbcr%3DAAAAAAAAAAA%3D%2Fbn%3D0%2Fclickenc%3Dhttps%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsslU80VlFR-XZ0g_CDpnFF03ea2qkWBR9THJGCI36mQM3x0DwOeTyD1z1s2DSJ3vuIN2v03FIOJG3zZXiThQ4lOw_ViZgo7f9ax5-ALOubjSvO2PLXIzRsUPfSxLED-fSbD9CTAIZMPhYh0yCaOgtOwk5NDMU3L5dfya93AyHyJabTvhA3UQoIMIZJs5GQsluP9ECPyC39vquL7MFkOJ2pOONtBaW1hMcEVv2I3iZonC6Edh_IzZRdDbhLZUCnVbMIhegIK9yBBRiY2BnNiwqdplSVttUok5ChcVWcXQs4ldq-GZNXQ0RN58r3ZRsjm7M8%2526sig%253DCg0ArKJSzGn5c4Ir3gpJEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Host: ib.adnxs.com
URL: https://ib.adnxs.com/ttj?id=6589257&psa=0&cb=754589590&gdpr=0&gdpr_consent=&loc=,&pubclick=https://ams1-ib.adnxs.com/click?AAAAAAAAAAAAAAAAAAAAAAAAACCF67E_AAAAAAAAAAAAAAAAAAAAAMLVrZNFFSYi5kEBOerjKjgr8ethAAAAAGMBHQHKIAAA5QAAAAIAAACl7n4CmKoUAAAAAAAAAAAAVVNEANgCWgBrrgAAAAABAgEAAAAAAMwAtxWkdQAAAAA./bcr=AAAAAAAAAAA=/bn=0/clickenc=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsslU80VlFR-XZ0g_CDpnFF03ea2qkWBR9THJGCI36mQM3x0DwOeTyD1z1s2DSJ3vuIN2v03FIOJG3zZXiThQ4lOw_ViZgo7f9ax5-ALOubjSvO2PLXIzRsUPfSxLED-fSbD9CTAIZMPhYh0yCaOgtOwk5NDMU3L5dfya93AyHyJabTvhA3UQoIMIZJs5GQsluP9ECPyC39vquL7MFkOJ2pOONtBaW1hMcEVv2I3iZonC6Edh_IzZRdDbhLZUCnVbMIhegIK9yBBRiY2BnNiwqdplSVttUok5ChcVWcXQs4ldq-GZNXQ0RN58r3ZRsjm7M8%2526sig%253DCg0ArKJSzGn5c4Ir3gpJEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.90 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:31 GMT
X-Proxy-Origin: 192.145.127.216; 192.145.127.216; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: dea9b341-dbb9-4120-94fe-7ec5c997c30f
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0B3B 0
20 B 61ms
60ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BgIIDKvHrYZrcMpjex_APkb2Q8AIAAAAAOAHgBAI&bg=!VValVhLNAAZ_DxPPfw87ACkAdvg8Wnx2VCWMUD-DbFX4zt6QJ9Yrm9JwHqt_wmBM26uG8p9mvuHjcAIAAADQUgAAAAhoAQeZAxAoaXUr7RShQUKxtarnYEkULDZNmmJfJ710Bz2Q05Vnp8RQLg8fbtyjetilyom4EUntythBriWxvbp3EOGBCJ3VGT8u5Hg6TWlFqpmmA9TOONYgWxNgx7QS8T9oTDknd3pUXjsQO2qidUQBM9SpgkhUTgG7h545o_-EK_-UuBaq4OqFKD5XLqFm4emI7Nv-giX3iASHWDgo72De5a-dxX2AHc1J_kgYHfTqL8HcOhSS5B141g-vtPFuCrEkZUwaZaGbvZSmQ30RbcBE7KqiQaAZh2XVQaTZNYtJesSiuXoSr5xI0BDHql_Oz_99gg7hTstCUFDoTf_xs3dtTlpAxjw5f4NgWxCjIQBOFmX695nh0G6D8b_XvaNsRhKAdmXu-gRfIr6heaRgFi2o4BZg3_PFhiBjsEDpVAsmZKtiAadeon5LualRFXsbNieMFgeu7yFbPZM2GtxlRHC7OSFEPoYsg0evKWUfCLURYv_qWD8kxcAArprBsGMblw7iHHETRgQPXP1aQL0zVoBh2oBllY_nbTTjUeoB6zwZmiCcWIDYKGQbpiMEpz0tQLcSWGHQqzMvTkIqIL74fKpTU0fNfGll_QPAHhJzCogLpMhPMxPTl90q2cLzgqGnByvanH8ms4GAkGr9l6aMVnWHYHaxkUQ-Lb3dFLDbs_qzr4DAEmSOY_xairxoA_lEnSHeSw5wlTiFJuJ81nQ6Nm0oen-a_t27ZlWE6OAPEtGVnHgkcU6dNwNL36Qc1h9-nFc6tERcFwkiRmijhQ1g8xGzeWky_-NhCMTH1Y2sA06zYk8rUpIVPw67bWPdKbdlkHWtoc2D6f-7JY2gSsZ2ed8njlbfaHM1a6SSPsdj6qMoh6nJIjTrYfSF1ko54YvnnxQGNyborIX1BsGvWo0Bz43k6De7-J8YyYpmMpA2-e1pN0W0gH_qjXa-3V0BT4CgSY9IwWGiFSv7wg2M2K73PNk8VOFRccm3SuMmBdj6XP3mhMYSe0nZGsImnqZGqlCNFO5po3Qec2xgpB7N6zqIyaLoZFQqkgPw

Requested by

Host: filecr.com
URL: https://filecr.com/en/?id=94759749504

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C591 0
20 B 60ms
60ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BrDGSKvHrYd6aMoql9u8P5aOXuAcAAAAAOAHgBAI&bg=!Q0ClQATNAAZ_DxPPfw87ACkAdvg8Wos_JZ_a3v1LwdzfUJm_y0lkMDoK5kGqbs1TLSsaaqjaEeIHsQIAAADyUgAAAAJoAQeZAwg3a7PUfFx2U6xsecAZZZ0UAS9nRsIBZBQggDPmrtXrliyMAqNbhiPsxdrgbZsf-Xawxz1UfdkiTUh71Vask40kr-c2anoaBM52u30vFi4o3tsYDDj9gqNpRL8PDeEnZVKb2AIGefUuGggOuKCtjrnn8ij_CEhgKDj8COOkb9z-QK2ngGZa526ihVNqPGIsa6rsi6GNLZuRrJjN-MDYbY_puKEiOkCK4gU3DEUltdVy1eNp9Qco1BiELxUpY6257NlgdwQqeGtKUwbwuO2cjMtNYtsjZqqcvJe_j70HHhUPLSb3cOHCnFMkvTtLhIxJrp5HewGkY9BiEahU-8BPfG1LMCVx4T-oeJdmyoJ_01oLrDbeLcr3Ry0Dh80fS3ZSf7vsDcijJXdMPjbWbK9TtgmEdakKhUwhvyj0plS9C1C-Pxtjk17GGncfACKSuXsaoxTELErgIiZ8ZFYNtSmeYyYFGmQZtZueTvoWNkg6HWuZN_eP7fGS352aaQfzFCP3cH9KKatAUKIMvF_iEj0HXZutAWFujAnhUMsU2k-Chu4Z9fjczePYUalWMyT19nhCwKYpGUvHJHthUkMYzUuM4_4Sog5tzAvkUn1AT4HLMPUtVE2GUmRT-hUFZk8xk7XIIT23LWJYCX09nrovT082UK7JwGTXkqnRXa2eFV44eCXfs3jIgD_yF20SvHnGDYjidPZRugrWuLKvc0A66qmr2Uav9EJmEObxreSW4350cXyplyPOIsxmGqka9JjclARYjDTlNgtfESqF8azKLfu1kYqUvcBcoIIJdPlHOJDEz2VnRnNeRIx9yPFz2SzyhIbajyZg774MSVb4DVEpckVTMGH1TE3QKzSecdqVpY16keznQ3i4nkOdi_WnYTfuxFfODtDguU45pPFXnvq3xeBUqhMteUWoKxgJ-Zk_-bpVOv6tv8q9QmZBxdEO87DfM6l_dFQVCJsmDe02orE5j98zVtc6qP0DScDVPtKg39CuhUGJekn-Zyg-U7lXP__cqZgM7Vt41I0VEaV7Gw

Requested by

Host: filecr.com
URL: https://filecr.com/en/?id=94759749504

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

skeleton.js Show response
static.adsafeprotected.com/ Frame 6661
Redirect Chain

https://pixel.adsafeprotected.com/rfw/st/490395/58820823/skeleton.js?ias_dspID=30&ias_campId=277442&ias_pubId=159855&ias_chanId=6&ias_placementId=1837526&bidurl=filecr.com&adsafe_url=https%3A%2F%2F...
https://static.adsafeprotected.com/skeleton.js

17 B
466 B

31ms
31ms

Script
application/javascript

2600:9000:224a:4600:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/skeleton.js
Requested by: Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Server: 2600:9000:224a:4600:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bdeed1e1c0751610c8f3dc2a5c78c93f841c366b36a7f7a54f5e6752c2656c05

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 08:35:57 GMT
via: 1.1 cd8cc1ff175a63c59feeb56bb3687766.cloudfront.net (CloudFront)
age: 17205695
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 17
last-modified: Mon, 17 Aug 2020 23:54:35 GMT
server: AmazonS3
etag: "53fab767ecbd3bf07990b10246befbd4"
x-amz-version-id: nylqTweorRThFHMBJSrf_fHcWx3KVKN3
cache-control: max-age=315360000
x-amz-cf-pop: DUS51-P1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: 8ICQOQM4xvO2vr8mMzNDqDXwyFtNW3xoqYtExfsC5XDtHbaLRWSKsQ==

Redirect headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
x-server-name: app05.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.js
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 sca.17.5.12.js Show response
static.adsafeprotected.com/ Frame 1E22 80 KB
21 KB 35ms
34ms Script
application/javascript 2600:9000:224a:4600:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.12.js
Requested by: Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:224a:4600:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 10:01:19 GMT
content-encoding: gzip
age: 5104573
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 19 Aug 2021 16:31:24 GMT
server: AmazonS3
etag: W/"9304f57298c3834ff107ea7ccb547996"
vary: Accept-Encoding
x-amz-version-id: 9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via: 1.1 cd8cc1ff175a63c59feeb56bb3687766.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: DUS51-P1
content-type: application/javascript
x-amz-cf-id: Bzl7ny1PFQ5zcEjE1v3tYWhNS1rse0R6rfMX48YXnb40tRj3YIr59w==

GET
H3 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame FF2C 106 KB
37 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
Origin: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 09:54:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7380
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 23 Jan 2022 09:54:31 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220119/r20110914/elements/html/ Frame FF2C 8 KB
3 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220119/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N996173.4385VERIZON/B25496923.322073577;dc_ver=83.241;sz=728x90;u_sd=1;gdpr=1;dc_adk=3281549113;ord=d99l06;click=https%3A%2F%2Fpr-preprod-2.ybp.yahoo.com%2Fcj%2Fcd%2FxJJ9IiwzE2-RobkFfbAKJTJCSey6mW6GABY1NFaqJ2mnQa6THohVeusJjOEnm1i0EaBqmChgB-ofk5kRns3b0E_b_8-Je_-p9uUsKBW6CoV4VCV9vE-8HwEsrYVnbtpqARBRX2Bik-ZcpJnl5Qr-V0h5rpIM-xn-MZGEE0XPQCI57lgpx3__-pH67anwQOUkqrtNd9DTlDwdkiVE33qB52G3t3zR0fu-mCuIknlNogPHMBu22_EwteQklmurwsOAKmnOTrfuGyOfEILBpgCOUdUoofLYxDhl%2Frurl%2F;dcopt=rcl;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Ffilecr.com%2F$0;xdt=1;crlt=Zwkb9RaF0n;gcsr=m;sttr=68;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:51:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 379
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 05 Feb 2022 11:51:12 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame FF2C 41 KB
15 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 15:54:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 245009
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Jan 2023 15:54:02 GMT

GET
H3 200 i8bj7ClzAoAUPYLrGgyCP56U_VUeYw5vpVcJR_BKyl0.js Show response
pagead2.googlesyndication.com/bg/ Frame 0117 35 KB
13 KB 27ms
25ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/i8bj7ClzAoAUPYLrGgyCP56U_VUeYw5vpVcJR_BKyl0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8bc6e3ec29730280143d82eb1a0c823f9e94fd551e630e6fa5570947f04aca5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 21 Jan 2022 07:40:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 101800
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13268
x-xss-protection: 0
last-modified: Wed, 12 Jan 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 21 Jan 2023 07:40:51 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 6661 43 B
215 B 426ms
209ms Image
image/gif 52.204.155.179
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=490395&asId=15c122c1-dfab-3bf8-761f-16c045d09494&tv=%7Bc:21HFYw,pingTime:-3,time:217,type:v,clog:%5B%7Bpiv:-1,vs:n,r:,w:970,h:250,t:180%7D,%7Bpiv:0,vs:o,r:l,t:217%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:217,n:217,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:180,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:i,cc:NaN.NaN.970.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B52~1,0~0%5D,as:%5B52~970.250%5D%7D%7D,%7Bsl:o,t:217,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:i,cc:NaN.NaN.970.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B1~0%5D,as:%5B1~970.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sVfkiH9+11%7C12%7C13%7C141%7C151%7C152%7C16%7C1711%7C1712%7C18*.490395-58820823%7C181%7C182%7C183%7C184%7C191%7C192%7C193%7C1a1%7C1a2%7C1a3%7C1b%7C1c,idMap:18*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=c
Requested by: Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.155.179 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-155-179.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
x-server-name: dt03.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 6661 43 B
215 B 424ms
209ms Image
image/gif 52.204.155.179
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=490395&asId=15c122c1-dfab-3bf8-761f-16c045d09494&tv=%7Bc:21HFYx,pingTime:-6,time:218,type:i,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:218,n:217,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:180,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:i,cc:NaN.NaN.970.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B52~1,0~0%5D,as:%5B52~970.250%5D%7D%7D,%7Bsl:o,t:217,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:i,cc:NaN.NaN.970.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B1~0%5D,as:%5B1~970.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sVfkiH9+11%7C12%7C13%7C141%7C151%7C152%7C16%7C1711%7C1712%7C18*.490395-58820823%7C181%7C182%7C183%7C184%7C191%7C192%7C193%7C1a1%7C1a2%7C1a3%7C1b%7C1c,idMap:18*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&tpiLookup=ao:filecr.com*&br=c
Requested by: Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.155.179 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-155-179.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
x-server-name: dt04.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 main.gr.19.8.280.js Show response
static.adsafeprotected.com/ Frame FF2C 188 KB
60 KB 35ms
34ms Script
application/javascript 2600:9000:224a:4600:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.gr.19.8.280.js
Requested by: Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/rjss/st/490395/58820829/skeleton.js?ias_dspID=30&ias_campId=277442&ias_pubId=159855&ias_chanId=6&ias_placementId=1837526&bidurl=filecr.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:224a:4600:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3a2d9cbe8b064e127245b7b16fa32baf1b1512aa3a3c8bdb3e499a4af1eea2f4

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 11 Jan 2022 23:31:11 GMT
content-encoding: gzip
age: 908781
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 11 Jan 2022 23:16:08 GMT
server: AmazonS3
etag: W/"90392bea80ae4672c9e7068b39b989e3"
vary: Accept-Encoding
x-amz-version-id: yTEXMMT7bLWcsJAanoak73m.vg84ulfF
via: 1.1 cd8cc1ff175a63c59feeb56bb3687766.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: DUS51-P1
content-type: application/javascript
x-amz-cf-id: j6OZaoBiIm7Zl7Tmw_3Sylmr_qKhLj03NRkKD5JWv_azP2ye2FwGew==

GET
H2 200 showad.js Show response
ads.pubmatic.com/AdServer/js/ Frame BB53 38 KB
14 KB 24ms
22ms Document
text/html 92.122.147.28
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 92.122.147.28 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-147-28.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 877fa64eb78a65e1b23fef6c4acd56fd991c23f286250122e75c89b97e2cd405

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/

Response headers

last-modified: Tue, 11 Jan 2022 05:13:08 GMT
etag: "1302647-9687-5d547824a78f1"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 13928
content-type: text/html; charset=UTF-8
cache-control: public, max-age=131000
expires: Mon, 24 Jan 2022 00:20:51 GMT
date: Sat, 22 Jan 2022 11:57:31 GMT
vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame F59B 1 KB
749 B 25ms
25ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Fri, 21 Jan 2022 13:26:12 GMT
expires: Sat, 22 Jan 2022 13:26:12 GMT
cache-control: public, max-age=86400
age: 81079
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame FF2C 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d1b0184fedc6a427058c3f61adb46c7e27a1ad1fc070c3d4868bd66ffa3cb3ef

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 6661 43 B
216 B 290ms
106ms Image
image/gif 52.204.155.179
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=490395&asId=15c122c1-dfab-3bf8-761f-16c045d09494&tv=%7Bc:21HFZ3,pingTime:-2,time:250,type:a,im:%7Bsf:1,pom:1,prf:%7BbeA:555,beZ:556,mfA:716,cmA:718,inA:718,inZ:723,prA:723,prZ:730,si:736,poA:737,poZ:751,cmZ:751,mfZ:751,loA:773,loZ:775,ltA:805,ltZ:805%7D%7D,sca:%7Bdfp:%7Bdf:3,sz:970.250,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:-1,vs:n,r:,w:970,h:250,t:180%7D,%7Bpiv:0,vs:o,r:l,t:217%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:250,n:217,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:180,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:i,cc:NaN.NaN.970.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B52~1,0~0%5D,as:%5B52~970.250%5D%7D%7D,%7Bsl:o,t:217,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:i,cc:NaN.NaN.970.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B33~0%5D,as:%5B33~970.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sVfkiH9+11%7C12%7C13%7C141%7C151%7C152%7C16%7C1711%7C1712%7C18*.490395-58820823%7C181%7C182%7C183%7C184%7C191%7C192%7C193%7C1a1%7C1a2%7C1a3%7C1b%7C1c,idMap:18*,pd:VEBo.mhjfbmdgcfjbbpaeojofohoefgiehjai,rmeas:1,rend:1,renddet:DIV.qs.sn,sinceFw:67,readyFired:true%7D&br=c
Requested by: Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.155.179 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-155-179.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
x-server-name: dt07.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 createjs.min.js Show response
code.createjs.com/1.0.0/ Frame B5DC 236 KB
63 KB 216ms
35ms Script
text/javascript 2a02:26f0:f7::5c7b:e051
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://code.createjs.com/1.0.0/createjs.min.js
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/9057854/1638374452378/970x250/index.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:f7::5c7b:e051 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Apache /
Resource Hash: e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:31 GMT
content-encoding: gzip
server: Apache
cache-control: max-age=900
vary: Accept-Encoding
content-type: text/javascript
x-n: S
accept-ranges: bytes
expires: Sat, 22 Jan 2022 12:12:31 GMT

GET
H3 200 index.js Show response
s0.2mdn.net/9057854/1638374452378/970x250/ Frame B5DC 104 KB
22 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9057854/1638374452378/970x250/index.js?1638283230357

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9057854/1638374452378/970x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7eb7530d55db570c440da9525a2c31235385ce9edd1996c3bda1ee1feb058257

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/9057854/1638374452378/970x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 21 Jan 2022 13:11:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 81987
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22077
x-xss-protection: 0
last-modified: Wed, 01 Dec 2021 16:00:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jan 2022 13:11:04 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame AB4A 42 B
64 B 92ms
59ms Fetch
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvN-Y-RP1uTdH4Dm5D1dkd4_c8g4Bh_IcDhXN8yY7leXy8b8zdxdMmBxC_DwAQhaMryeYax1_J3m8YN7hx3ag92f6CzzFUY_zI2sb84a_LrGsgoGqRqrA&sai=AMfl-YTjnRb06ekxhwR8GmmnupTpZPisUbGILfNcwYzbQRKBFHl-WLhnscRZQX65ji-1elSP_k9ixLaX_hFC&sig=Cg0ArKJSzOx9nH4buldXEAE&id=lidar2&mcvt=1021&p=0,0,280,1158&mtos=1021,1021,1021,1021,1021&tos=1021,0,0,0,0&v=20220119&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=1140498346&rs=2&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1642852649479&rpt=993&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 037C 52 KB
17 KB 365ms
33ms Document
text/html 92.122.145.117
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141
Requested by: Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 92.122.145.117 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-145-117.deploy.static.akamaitechnologies.com
Software: nginx/1.13.10 /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/

Response headers

Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: "5fc7ff8f-cf34"
Server: nginx/1.13.10
Content-Type: text/html
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Length: 17053
Cache-Control: max-age=86402
Expires: Sun, 23 Jan 2022 11:57:33 GMT
Date: Sat, 22 Jan 2022 11:57:31 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
DATA 200
OK truncated
/ Frame 09C1 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 810c979e9dca773b6784170d0ed8c35fbcf85679cac4f8607c61aa607a571232

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 8762 22 KB
8 KB 27ms
27ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 19 Jan 2022 10:49:42 GMT
expires: Thu, 19 Jan 2023 10:49:42 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 263269
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 index.html Show response
s0.2mdn.net/9057854/1638380999017/728x90/ Frame F8B4 6 KB
2 KB 27ms
26ms Document
text/html 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9057854/1638380999017/728x90/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

305e5fcf44e99d9cbb98239c8c34065dd7db5e9e9b4bb1c9995c88f4b304d46e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-length: 2356
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 22 Jan 2022 05:05:46 GMT
expires: Sun, 23 Jan 2022 05:05:46 GMT
cache-control: public, max-age=86400
age: 24705
last-modified: Wed, 01 Dec 2021 17:49:59 GMT
content-type: text/html
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame FF2C 0
23 B 67ms
67ms Ping
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvtzUIWlw8NIuyKarvjMoP7uKJfcfnYfcErD--f1CBWgdU1oAu_i1CuBhwTF431EYWBbDr8Id2xN602_MRuhFXrO-LBCWD0YBcQLCOfUkptjMAc9T90sZzB3z6KTa8ZvwPcj1eWxFYRr-Sq0x0M&sig=Cg0ArKJSzHI3GmyCNz1QEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=125&cbvp=1&cstd=124&cisv=r20220119.36869&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-52-211-244-253.eu-west-1.compute.amazonaws.com

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Sat, 22 Jan 2022 11:57:31 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK event
enelspa.demdex.net/ Frame FF2C 42 B
953 B 92ms
56ms Image
image/gif 52.211.244.253
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://enelspa.demdex.net/event?d_event=imp&d_src=19902&d_campaign=display-verizon-fo_b2c_scegli_oggi_gas-performance-scegli_oggi_gas_3rdparty_mario_30&d_site=6534937&d_adsrc=514330643&d_bu=9057854&d_creative=162561719

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.211.244.253 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v027-0a827ee29.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: J/c4QmcSSeI=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2

200

skeleton.js Show response
static.adsafeprotected.com/ Frame FF2C
Redirect Chain

https://pixel.adsafeprotected.com/rfw/st/490395/58820829/skeleton.js?ias_dspID=30&ias_campId=277442&ias_pubId=159855&ias_chanId=6&ias_placementId=1837526&bidurl=filecr.com&adsafe_url=https%3A%2F%2F...
https://static.adsafeprotected.com/skeleton.js

17 B
464 B

35ms
34ms

Script
application/javascript

2600:9000:224a:4600:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/skeleton.js
Requested by: Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Server: 2600:9000:224a:4600:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bdeed1e1c0751610c8f3dc2a5c78c93f841c366b36a7f7a54f5e6752c2656c05

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 08:35:57 GMT
via: 1.1 cd8cc1ff175a63c59feeb56bb3687766.cloudfront.net (CloudFront)
age: 17205695
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 17
last-modified: Mon, 17 Aug 2020 23:54:35 GMT
server: AmazonS3
etag: "53fab767ecbd3bf07990b10246befbd4"
x-amz-version-id: nylqTweorRThFHMBJSrf_fHcWx3KVKN3
cache-control: max-age=315360000
x-amz-cf-pop: DUS51-P1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: 2htK2Z7VTkrdcm_q3ttgI43cIYOJZSt9PLcm1g-SkXRaJAqbdk9Stw==

Redirect headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
x-server-name: app22.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.js
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 sca.17.5.12.js Show response
static.adsafeprotected.com/ Frame 6FB1 80 KB
21 KB 34ms
34ms Script
application/javascript 2600:9000:224a:4600:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.12.js
Requested by: Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:224a:4600:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 10:01:19 GMT
content-encoding: gzip
age: 5104573
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 19 Aug 2021 16:31:24 GMT
server: AmazonS3
etag: W/"9304f57298c3834ff107ea7ccb547996"
vary: Accept-Encoding
x-amz-version-id: 9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via: 1.1 cd8cc1ff175a63c59feeb56bb3687766.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: DUS51-P1
content-type: application/javascript
x-amz-cf-id: NPRp1WvfRfxuU8_pKwHWREIxnQChNJh9oWwdaUFBozg1unBUFA41jQ==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame FF2C 43 B
215 B 123ms
106ms Image
image/gif 52.204.155.179
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=490395&asId=b0413342-ece1-10fd-7a41-b6dbf871099c&tv=%7Bc:21HG1K,pingTime:-3,time:187,type:v,clog:%5B%7Bpiv:-1,vs:n,r:,w:728,h:90,t:162%7D,%7Bpiv:0,vs:o,r:l,t:187%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:187,n:187,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:162,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B34~1,0~0%5D,as:%5B34~728.90%5D%7D%7D,%7Bsl:o,t:187,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B1~0%5D,as:%5B1~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sVfkiH9+11%7C12%7C13%7C141%7C151%7C152%7C16%7C1711%7C1712%7C18.490395-58820823%7C181%7C182%7C1831%7C184%7C185%7C191%7C192%7C193%7C1a1%7C1a2%7C1a3%7C1b*.490395-58820829%7C1b1%7C1b2%7C1b3%7C1b4%7C1c1,idMap:1b*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=c
Requested by: Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.155.179 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-155-179.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
x-server-name: dt06.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame FF2C 43 B
215 B 122ms
107ms Image
image/gif 52.204.155.179
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=490395&asId=b0413342-ece1-10fd-7a41-b6dbf871099c&tv=%7Bc:21HG1L,pingTime:-6,time:188,type:i,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:188,n:187,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:162,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B34~1,0~0%5D,as:%5B34~728.90%5D%7D%7D,%7Bsl:o,t:187,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B1~0%5D,as:%5B1~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sVfkiH9+11%7C12%7C13%7C141%7C151%7C152%7C16%7C1711%7C1712%7C18.490395-58820823%7C181%7C182%7C1831%7C184%7C185%7C191%7C192%7C193%7C1a1%7C1a2%7C1a3%7C1b*.490395-58820829%7C1b1%7C1b2%7C1b3%7C1b4%7C1c1,idMap:1b*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&tpiLookup=ao:filecr.com*&br=c
Requested by: Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.155.179 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-155-179.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
x-server-name: dt08.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame FF2C 43 B
215 B 114ms
107ms Image
image/gif 52.204.155.179
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=490395&asId=b0413342-ece1-10fd-7a41-b6dbf871099c&tv=%7Bc:21HG1T,pingTime:-2,time:196,type:a,im:%7Bsf:1,pom:1,prf:%7BbeA:749,beZ:751,mfA:901,cmA:901,inA:901,inZ:902,prA:902,prZ:909,si:912,poA:912,poZ:923,cmZ:923,mfZ:923,loA:937,loZ:938,ltA:945,ltZ:945%7D%7D,sca:%7Bdfp:%7Bdf:3,sz:728.90,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:-1,vs:n,r:,w:728,h:90,t:162%7D,%7Bpiv:0,vs:o,r:l,t:187%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:196,n:187,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:162,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B34~1,0~0%5D,as:%5B34~728.90%5D%7D%7D,%7Bsl:o,t:187,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B9~0%5D,as:%5B9~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sVfkiH9+11%7C12%7C13%7C141%7C151%7C152%7C16%7C1711%7C1712%7C18.490395-58820823%7C181%7C182%7C1831%7C184%7C185%7C191%7C192%7C193%7C1a1%7C1a2%7C1a3%7C1b*.490395-58820829%7C1b1%7C1b2%7C1b3%7C1b4%7C1c1,idMap:1b*,pd:VEBo.mhjfbmdgcfjbbpaeojofohoefgiehjai,rmeas:1,rend:1,renddet:DIV.qs.sn,sinceFw:33,readyFired:true%7D&br=c
Requested by: Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.155.179 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-155-179.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
x-server-name: dt05.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 dds
rtb.openx.net/sync/ Frame F59B 43 B
64 B 49ms
48ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEJ7fcDOsXbNic79NfBEKwyE&google_cver=1&google_push=AYg5qPKM2nDWg4OdWqthBPfbzR7hpuNtYM3-5yEaURFJxziQVTx9dr6zQHYmXC76Cu7TaiSb_ElBOfheHwImtFuhHJ4dfmmHNd5g
Requested by: Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: ori647d67k7qrv0v9vej0skc3n9ou2k9

GET

pixel
cm.g.doubleclick.net/ Frame F59B
Redirect Chain

https://onetag-sys.com/sync/i,19/?google_gid=CAESEMlySgqBQ6ejCofqYqQWT1w&google_cver=1&google_push=AYg5qPKfJehhMb4afHyOOZ8jJrRcO6Uilq2k4WlzZMZa2VZArGU5_8LMy3hurwBSL62kA5TF0VX_yurRW_EfvuwB1xmZp1RB31X9
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKfJehhMb4afHyOOZ8jJrRcO6Uilq2k4WlzZMZa2VZArGU5_8LMy3hurwBSL62kA5TF0VX_yurRW_EfvuwB1xmZp1RB31X9
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKfJehhMb4afHyOOZ8jJrRcO6Uilq2k4WlzZMZa2VZArGU5_8LMy3hurwBSL62kA5TF0VX_yurRW_EfvuwB1xmZp1RB31X9
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKfJehhMb4afHyOOZ8jJrRcO6Uilq2k4WlzZMZa2VZArGU5_8LMy3hurwBSL62kA5TF0VX_yurRW_EfvuwB1xmZp1RB31X9
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKfJehhMb4afHyOOZ8jJrRcO6Uilq2k4WlzZMZa2VZArGU5_8LMy3hurwBSL62kA5TF0VX_yurRW_EfvuwB1xmZp1RB31X9
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKfJehhMb4afHyOOZ8jJrRcO6Uilq2k4WlzZMZa2VZArGU5_8LMy3hurwBSL62kA5TF0VX_yurRW_EfvuwB1xmZp1RB31X9
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKfJehhMb4afHyOOZ8jJrRcO6Uilq2k4WlzZMZa2VZArGU5_8LMy3hurwBSL62kA5TF0VX_yurRW_EfvuwB1xmZp1RB31X9
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKfJehhMb4afHyOOZ8jJrRcO6Uilq2k4WlzZMZa2VZArGU5_8LMy3hurwBSL62kA5TF0VX_yurRW_EfvuwB1xmZp1RB31X9
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKfJehhMb4afHyOOZ8jJrRcO6Uilq2k4WlzZMZa2VZArGU5_8LMy3hurwBSL62kA5TF0VX_yurRW_EfvuwB1xmZp1RB31X9
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKfJehhMb4afHyOOZ8jJrRcO6Uilq2k4WlzZMZa2VZArGU5_8LMy3hurwBSL62kA5TF0VX_yurRW_EfvuwB1xmZp1RB31X9
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKfJehhMb4afHyOOZ8jJrRcO6Uilq2k4WlzZMZa2VZArGU5_8LMy3hurwBSL62kA5TF0VX_yurRW_EfvuwB1xmZp1RB31X9
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKfJehhMb4afHyOOZ8jJrRcO6Uilq2k4WlzZMZa2VZArGU5_8LMy3hurwBSL62kA5TF0VX_yurRW_EfvuwB1xmZp1RB31X9
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKfJehhMb4afHyOOZ8jJrRcO6Uilq2k4WlzZMZa2VZArGU5_8LMy3hurwBSL62kA5TF0VX_yurRW_EfvuwB1xmZp1RB31X9
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKfJehhMb4afHyOOZ8jJrRcO6Uilq2k4WlzZMZa2VZArGU5_8LMy3hurwBSL62kA5TF0VX_yurRW_EfvuwB1xmZp1RB31X9
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKfJehhMb4afHyOOZ8jJrRcO6Uilq2k4WlzZMZa2VZArGU5_8LMy3hurwBSL62kA5TF0VX_yurRW_EfvuwB1xmZp1RB31X9
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKfJehhMb4afHyOOZ8jJrRcO6Uilq2k4WlzZMZa2VZArGU5_8LMy3hurwBSL62kA5TF0VX_yurRW_EfvuwB1xmZp1RB31X9
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKfJehhMb4afHyOOZ8jJrRcO6Uilq2k4WlzZMZa2VZArGU5_8LMy3hurwBSL62kA5TF0VX_yurRW_EfvuwB1xmZp1RB31X9
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKfJehhMb4afHyOOZ8jJrRcO6Uilq2k4WlzZMZa2VZArGU5_8LMy3hurwBSL62kA5TF0VX_yurRW_EfvuwB1xmZp1RB31X9
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKfJehhMb4afHyOOZ8jJrRcO6Uilq2k4WlzZMZa2VZArGU5_8LMy3hurwBSL62kA5TF0VX_yurRW_EfvuwB1xmZp1RB31X9
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKfJehhMb4afHyOOZ8jJrRcO6Uilq2k4WlzZMZa2VZArGU5_8LMy3hurwBSL62kA5TF0VX_yurRW_EfvuwB1xmZp1RB31X9
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKfJehhMb4afHyOOZ8jJrRcO6Uilq2k4WlzZMZa2VZArGU5_8LMy3hurwBSL62kA5TF0VX_yurRW_EfvuwB1xmZp1RB31X9

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F59B
Redirect Chain

https://cs.media.net/cksync?type=g&google_gid=CAESEM9jbs8gUUdfEyo2WGPHDH0&google_cver=1&google_push=AYg5qPKeMDnvdDH0lR-0ZVCNPfhMyuSm-dXBZostmM4GfwNP1Sb4MSzwRDlgzERgjQ1xDCN7Tp3nN92yOUEA5DRiz3EWcpteoP4
https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=Mjg1ODU0MjUxNjA5MjAyMDAwMFYxMA%3d%3d&mn_hm=Mjg1ODU0MjUxNjA5MjAyMDAwMFYxMA%3d%3d&google_sc=1&google_push=AYg5qPKeMDnvdDH0lR-0ZVCNPfhMyuS...

170 B
188 B

45ms
43ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=Mjg1ODU0MjUxNjA5MjAyMDAwMFYxMA%3d%3d&mn_hm=Mjg1ODU0MjUxNjA5MjAyMDAwMFYxMA%3d%3d&google_sc=1&google_push=AYg5qPKeMDnvdDH0lR-0ZVCNPfhMyuSm-dXBZostmM4GfwNP1Sb4MSzwRDlgzERgjQ1xDCN7Tp3nN92yOUEA5DRiz3EWcpteoP4&gdpr=&gdpr_consent=

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:31 GMT
Server: Apache
P3P: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Location: https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=Mjg1ODU0MjUxNjA5MjAyMDAwMFYxMA%3d%3d&mn_hm=Mjg1ODU0MjUxNjA5MjAyMDAwMFYxMA%3d%3d&google_sc=1&google_push=AYg5qPKeMDnvdDH0lR-0ZVCNPfhMyuSm-dXBZostmM4GfwNP1Sb4MSzwRDlgzERgjQ1xDCN7Tp3nN92yOUEA5DRiz3EWcpteoP4&gdpr=&gdpr_consent=
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html
Content-Length: 154
X-MNET-HL2: E
Expires: Sat, 22 Jan 2022 11:57:31 GMT

GET
H/1.1 200
OK sync
ssbsync.smartadserver.com/api/ Frame F59B 0
75 B 362ms
35ms Image
text/plain 185.86.138.120
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESECwBThY_Ym3zMBo8GgNQzBI&google_cver=1&google_push=AYg5qPL_UGCMvqYURSQ3F2ak9dclQr4zBrwgntTkKUY2A9TH6EV4jl23iILLWYmIGd_Q5MKFUvaM9ft-BkEMhxxs9TljZ503-W_t
Requested by: Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.138.120 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:31 GMT
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F59B
Redirect Chain

https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEBuFLEHP0LDO1vlMqjKTD04&google_cver=1&google_push=AYg5qPI1z8Y5oXyY5_ys8zHjtpkf4zpHgMRbFX5dIiRgFX2YgBmN5eoW...
https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEBuFLEHP0LDO1vlMqjKTD04&google_cver=1&google_push=AYg5qPI1z8Y5oXyY5_ys8zHjtpkf4zpHgMRbFX5dIiRgFX2YgBmN5eoW...
https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEBuFLEHP0LDO1vlMqjKTD04&google_cver=1&google_push=AYg5qPI1z8Y5oXyY5_ys8zHjtpkf4zpHgMRbFX5dIiRgFX2YgBmN5e...
https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA3YWJiZmVlNS03YjdhLTExZWMtYTllMi0wNjJmMGIwY2JjMDQ%3D&google_push=AYg5qPI1z8Y5oXyY5_ys8zHjtpkf4zpHgMRbFX5dIiRgFX2YgBmN5eoWFHWrb5o4n_...

170 B
188 B

43ms
41ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA3YWJiZmVlNS03YjdhLTExZWMtYTllMi0wNjJmMGIwY2JjMDQ%3D&google_push=AYg5qPI1z8Y5oXyY5_ys8zHjtpkf4zpHgMRbFX5dIiRgFX2YgBmN5eoWFHWrb5o4n_buJP0lW1ujXKWZnFlPPwJA6N7vfNbrvuV_0Q

Requested by

Host: filecr.com
URL: https://filecr.com/en/?id=94759749504

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA3YWJiZmVlNS03YjdhLTExZWMtYTllMi0wNjJmMGIwY2JjMDQ%3D&google_push=AYg5qPI1z8Y5oXyY5_ys8zHjtpkf4zpHgMRbFX5dIiRgFX2YgBmN5eoWFHWrb5o4n_buJP0lW1ujXKWZnFlPPwJA6N7vfNbrvuV_0Q
date: Sat, 22 Jan 2022 11:57:31 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F59B
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEB7QP4qszOB-oALY7JNTft0&google_cver=1&google_push=AYg5qPLexn4MAo2cLT0EIymj1QRiNqL9_786wvi2ez6svzbPZRM_JqPpbDmfp8kotWZb-vwh2h...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1WT1hqUmhwRTJ1RjIweTFkWVlvR2NEVXRyeEhCOHFBYn5B&google_push=AYg5qPLexn4MAo2cLT0EIymj1QRiNqL9_786wvi2ez6svzbPZRM_JqPpb...

170 B
188 B

51ms
47ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1WT1hqUmhwRTJ1RjIweTFkWVlvR2NEVXRyeEhCOHFBYn5B&google_push=AYg5qPLexn4MAo2cLT0EIymj1QRiNqL9_786wvi2ez6svzbPZRM_JqPpbDmfp8kotWZb-vwh2hQ8JDg7Rh57rgyE05jGuCE0kNMvSA

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1WT1hqUmhwRTJ1RjIweTFkWVlvR2NEVXRyeEhCOHFBYn5B&google_push=AYg5qPLexn4MAo2cLT0EIymj1QRiNqL9_786wvi2ez6svzbPZRM_JqPpbDmfp8kotWZb-vwh2hQ8JDg7Rh57rgyE05jGuCE0kNMvSA
date: Sat, 22 Jan 2022 11:57:31 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F59B
Redirect Chain

https://match.sharethrough.com/E4rooAtA/v1?google_gid=CAESEDtZeGrLLH-_ksklHipNZvY&google_cver=1&google_push=AYg5qPLVJ3kkduQPcryiCMht79DwMltBjm7XmTEiTmcoNe4vzdqyGRkeCEkmtZGKGpNCCxL-__-ldzwtKJG39Jyyz...
https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=NTRlNDBiYWQtYTNhYi00NjZhLWJhY2QtYzNlN2FkMTgzNzUy&google_push=AYg5qPLVJ3kkduQPcryiCMht79DwMltBjm7XmTEiTmcoNe4vzdqyGRkeCEkmtZGK...

170 B
188 B

47ms
44ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=NTRlNDBiYWQtYTNhYi00NjZhLWJhY2QtYzNlN2FkMTgzNzUy&google_push=AYg5qPLVJ3kkduQPcryiCMht79DwMltBjm7XmTEiTmcoNe4vzdqyGRkeCEkmtZGKGpNCCxL-__-ldzwtKJG39JyyzN-2OuGw1wvTLQ

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=NTRlNDBiYWQtYTNhYi00NjZhLWJhY2QtYzNlN2FkMTgzNzUy&google_push=AYg5qPLVJ3kkduQPcryiCMht79DwMltBjm7XmTEiTmcoNe4vzdqyGRkeCEkmtZGKGpNCCxL-__-ldzwtKJG39JyyzN-2OuGw1wvTLQ
date: Sat, 22 Jan 2022 11:57:31 GMT
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame F59B 0
12 B 47ms
46ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KdEOepxfztaxxaDcCGzfrvSrpwgqkMWDCgWK34Gr3U9xelwLiXcY7Fxqqfz1qFNGBMqg48qCB1

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:31 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 createjs.min.js Show response
code.createjs.com/1.0.0/ Frame F8B4 236 KB
63 KB 41ms
34ms Script
text/javascript 2a02:26f0:f7::5c7b:e051
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://code.createjs.com/1.0.0/createjs.min.js
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/9057854/1638380999017/728x90/index.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:f7::5c7b:e051 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Apache /
Resource Hash: e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:31 GMT
content-encoding: gzip
server: Apache
cache-control: max-age=900
vary: Accept-Encoding
content-type: text/javascript
x-n: S
accept-ranges: bytes
expires: Sat, 22 Jan 2022 12:12:31 GMT

GET
H3 200 index.js Show response
s0.2mdn.net/9057854/1638380999017/728x90/ Frame F8B4 107 KB
21 KB 30ms
26ms Script
text/javascript 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9057854/1638380999017/728x90/index.js?1638283168326

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9057854/1638380999017/728x90/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3048b8236e174fc17ca2db820084518db6b9bbea560debdea1890aaa3981243

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/9057854/1638380999017/728x90/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 05:05:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 24705
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21461
x-xss-protection: 0
last-modified: Wed, 01 Dec 2021 17:49:59 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 23 Jan 2022 05:05:46 GMT

GET
H3 200 i8bj7ClzAoAUPYLrGgyCP56U_VUeYw5vpVcJR_BKyl0.js Show response
pagead2.googlesyndication.com/bg/ Frame 8762 35 KB
13 KB 29ms
25ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/i8bj7ClzAoAUPYLrGgyCP56U_VUeYw5vpVcJR_BKyl0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8bc6e3ec29730280143d82eb1a0c823f9e94fd551e630e6fa5570947f04aca5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 21 Jan 2022 07:40:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 101800
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13268
x-xss-protection: 0
last-modified: Wed, 12 Jan 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 21 Jan 2023 07:40:51 GMT

GET
H3 200 foto.jpg
s0.2mdn.net/9057854/1638374452378/970x250/images/ Frame B5DC 139 KB
139 KB 32ms
31ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9057854/1638374452378/970x250/images/foto.jpg?1638283230351

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d5dd0623c0e1a317048927981bb6a853f9a0da60196c281e8bf8b84499c57c4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/9057854/1638374452378/970x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 21 Jan 2022 13:11:04 GMT
x-content-type-options: nosniff
age: 81987
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 142275
x-xss-protection: 0
last-modified: Wed, 01 Dec 2021 16:00:52 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jan 2022 13:11:04 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 6661 0
23 B 73ms
73ms Ping
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuVlkhNyx-X_JW444cKmGXyn0u6T6WJcr3340nVxetdEWp2KI0c5pviLFkxG8rTEzvhVOFRPmLD8KTwAnBS5d17WCoJpJPHPHc0IQQkw_pmJ_PEb5jOaDsO3hZDSDX8DSuHmk6i6sAZUWsYtYxN&sig=Cg0ArKJSzGSDuv3qcBdyEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=526&vt=11&dtpt=406&dett=3&cstd=118&cisv=r20220119.50183&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Sat, 22 Jan 2022 11:57:31 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0117 0
20 B 62ms
60ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BJzV5K_HrYYKiCoOJ7_UP5de0gAsAAAAAOAHgBAI&bg=!t7SltPDNAAZ_DxPPfw87ACkAdvg8Wl5wTRGHQV9B1m-9KwAOn0WFfU5LyNoIHHBSrq_hEUIVJV5tlAIAAADFUgAAAAJoAQeZAx7FIa4P9I7EzYhTediNTD_Cr-I005KdKwc4TZjA7PiCdr3ZXgrHiZdYoWtpRwgowlTsUCw3rgU7q2sxjI8VegEaW1VnbmUw6fOIcYtGjIq5VPhytAvb4mKxzSM-kv-G6kRBLvpE55ftZVPIQ9sS_3yyY8vz350uBGr8Nh3JMuwoh97rxXCcwCr4sgzKkOcMu0iySrF711DA5nWG5fXtQYlfkQ4Ztt2o9LZ1XfVdBin2U3rKIz0oCegnNk1HPu_AkgIQffeV9DqzEMHTom7y4TV2pFgCY6TSI5bwFKVhMp1p2YMDrD2BoAWDz5Q3p2HNwB6bGXtZEByIVvrG-pZN27w_fzoR764iGnqRqWbeHp42lz05r4Wp7ytGxr0xHNVpm1t6JpkZHUjdqveGMPxAheJ95AGD6w3tQws4XEqxsRP9B1H7dDYMGDaQQqx-5K6Ms-7s96RSV9v66U9DDbSQYEM3KF_tISBqWW2MgtjPi44u_SpRuF-Ss5mPslAA3Faxb5Cur-cquOXSSgwVe8vCwUnHyReYoCwcq5GaT5Qc_49Cz1QsiBpPRB3_KdRdIWgv8RRhKY_099R6LODyCZNH4shjHCuZtg5nV62BWQssYDGjzGg52Ldb1gR9ZS9ENGQ5gC5DeAlDNsKMbcva8gBfdZ_f23WSxGWavvaS4BEwX_bUZgq-hWOIb4V7l03K9Q-z_DLf4tL4xVaWOgWCaxq50GuOZpAWHk0Ihs6kgsWdHMFchtdgeONBj6h8C2A0yjIzzHYj3B3VOkDu3YZX9HpojfI1aGNkviOU6W__Lh_cwbnMwWo37s-l0n3UfvEo2XU5IpoHZaHTt0rmvjH6cgj0Svo5HDfEbtl4o9_wdozYUfwAFqMXWoR8DYAvRmcqIHcgGYCAtAiJySEJQfgIq6zAdMoan_55M_Wr6ji5R_K_Kn_WyTS5Adh757m_X0mj7qqvHmLGoa-l2NyYY08nUCCOeTkwt9qPEykXOx3C25vXqOHbuQb5RhAMImQT3MWv3uzBvvL31KzIBqb0daJNsv9sOT_bY2Ssf5iZOUFAUYv3Wto

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Copiashadowpng2.png
s0.2mdn.net/9057854/1638380999017/728x90/images/ Frame F8B4 32 KB
32 KB 31ms
31ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9057854/1638380999017/728x90/images/Copiashadowpng2.png?1638283168320

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c4e696a083cd3a0480288bf7c1c3ff80a7eb1744b1d620ef4f50e2b2da81e771

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/9057854/1638380999017/728x90/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 07:36:44 GMT
x-content-type-options: nosniff
age: 15647
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32588
x-xss-protection: 0
last-modified: Wed, 01 Dec 2021 17:49:59 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 23 Jan 2022 07:36:44 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame FF2C 0
23 B 70ms
69ms Ping
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvtzUIWlw8NIuyKarvjMoP7uKJfcfnYfcErD--f1CBWgdU1oAu_i1CuBhwTF431EYWBbDr8Id2xN602_MRuhFXrO-LBCWD0YBcQLCOfUkptjMAc9T90sZzB3z6KTa8ZvwPcj1eWxFYRr-Sq0x0M&sig=Cg0ArKJSzHI3GmyCNz1QEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=357&vt=11&dtpt=232&dett=3&cstd=124&cisv=r20220119.36869&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: filecr.com
URL: https://filecr.com/en/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Sat, 22 Jan 2022 11:57:31 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 6661 43 B
215 B 106ms
106ms Image
image/gif 52.204.155.179
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=490395&asId=15c122c1-dfab-3bf8-761f-16c045d09494&tv=%7Bc:21HG4R,pingTime:-10,time:610,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8TGludXggeDg2XzY0fHxHZWNrb3x8MjAwMzAxMDd8fDB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS85Ny4wLjQ2OTIuNzEgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.5.12v220002022000220000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1642852651852%7C%7Cae0c6d00a796e58e96fc71bc297871f6%7C%7C8866308252d63f9bf74b74e606896148%7C%7C2eb52423eb597c263708626456ad0c5b%7C%7Cc6c299645158f2cba157c22cc560d57e%7C%7C21095e91677245c30a2768dcb6fd8de1%7C%7C810c898d23a519d8878f8a9929a04ba3%7C%7C0e7dfe5e0da231348b83554c19f75159%7C%7C1629390669%7D
Requested by: Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.155.179 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-155-179.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
x-server-name: dt06.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 foto.jpg
s0.2mdn.net/9057854/1638380999017/728x90/images/ Frame F8B4 133 KB
133 KB 32ms
30ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9057854/1638380999017/728x90/images/foto.jpg?1638283168320

Requested by

Host: filecr.com
URL: https://filecr.com/en/?id=94759749504

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3db879c9ccbcdfd539d9757823539e2f82c04223a24bcebc1d7a830f2537ce0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/9057854/1638380999017/728x90/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 07:36:45 GMT
x-content-type-options: nosniff
age: 15646
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 136236
x-xss-protection: 0
last-modified: Wed, 01 Dec 2021 17:49:59 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 23 Jan 2022 07:36:45 GMT

GET
H3 200 logo.png
s0.2mdn.net/9057854/1638374452378/970x250/images/ Frame B5DC 18 KB
18 KB 30ms
29ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9057854/1638374452378/970x250/images/logo.png?1638283230351

Requested by

Host: 1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com
URL: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5af7982f24200a5aaafdabf3658c55faa39d1432226d14abde7365fe99b2ff32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/9057854/1638374452378/970x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 21 Jan 2022 13:11:04 GMT
x-content-type-options: nosniff
age: 81987
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18891
x-xss-protection: 0
last-modified: Wed, 01 Dec 2021 16:00:52 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jan 2022 13:11:04 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 037C 0
735 B 32ms
31ms Script
text/html 185.33.221.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.90 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:31 GMT
X-Proxy-Origin: 192.145.127.216; 192.145.127.216; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 20b42c89-4313-4aa4-90a2-8a7546ab5353
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 logo.png
s0.2mdn.net/9057854/1638380999017/728x90/images/ Frame F8B4 12 KB
12 KB 25ms
25ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9057854/1638380999017/728x90/images/logo.png?1638283168320

Requested by

Host: filecr.com
URL: https://filecr.com/en/?id=94759749504

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

12d60c9be3152e48e897324a8267bbeb58b0fff53492c796dccf50fa3bfb34cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/9057854/1638380999017/728x90/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 07:36:45 GMT
x-content-type-options: nosniff
age: 15646
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11785
x-xss-protection: 0
last-modified: Wed, 01 Dec 2021 17:49:59 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 23 Jan 2022 07:36:45 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 09C1 0
0 98ms
62ms Fetch
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssrnogB0PHIm1NtETy9kOD_CSpGVxcWMylHPrr4TsSVVWxam_qc-vhvjnF8iUrUFJX2qiKKPKmE41nfTcjYGSLtwiLKOGePDgJjeAMpLzUJZtknTgDFJvya8OvRmRk9Wwj720VARM5VqrtwtylCCgqLLxcb8EKtklY3ra7aJplw3IDqbQ8wwG1YOFrcRO0T8DBWD05N6r9N_5Ee39mpc9KTAm1KnqymjY7V2x7GvUgVo1FcyLKZbteQrNy-6piTeuDXV0syh0dzjIeXQEaUimc1mBve1gS87qWi1KYdcPKPWLi92K9DGyVx5zQ-uCZQllcD8UwJUQ&sig=Cg0ArKJSzAMKU6AEknwhEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 22 Jan 2022 11:57:32 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Sat, 22 Jan 2022 11:57:32 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8762 0
20 B 60ms
60ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BaJm7K_HrYZe2FYSp7gOL7LXQBQAAAAA4AeAEAg&bg=!jI-lj8vNAAZ_DxPPfw87ACkAdvg8Wsc48MT6OnT4UQvczGoGfO5HczFYLnee9VVFODcjBHsuyse7ggIAAAC1UgAAAANoAQcKAHyhKMLIkyn6H7McQsBQzjtvM1F_UdHratqzgFzsrVEkTfL4-ZwKn8wuRwCGGQBuZCMfv1M29eD8Q7EcSoL7O2RtKmLBMFbVOIikjHQvQDxGRWQH0HyDZr8TA4lbZa_VUR0YO9VOJjN96W-ZpL01RLKXQXiEGXlFOj9ssOxsmQL3OWeQ8AJm8zkf2EYIfswU6oMNPBl1jnVpyu2hGuVPky0wIITH4PBqgYfzxw7l4wQrH9e-YUDRM2cMLJ12DUJgbro_LX6vS18GYP5R1iCKDjD4fSM66MjexYVJyQE6IjmQdtRsUGLAlvLYYVzU_VVFtL-PHSfotJvRB9DznHDM5eNacrKTyMD2teKWMcE6AhxtxQOMBcI92i9kKmni7Z6jUNH83NdrrNqItmhc3T9_kCBHKd2orM4ZY9QAfS0YPVci3_H16DY0QmHBR9EI_7ne5oECTsOkiEqHFNndfuxMyAzFRwzaru5sCCjEgAzCHfjsoR1aNPtUz4scEzdpvTQMlM826UYg-AxSGqSbdZ-a5fZnwXg-nkweGLGd4vfsu9vBMtJWrivxcnJSc0AegD-ujAlWkIIDEQxAIDV2SpcmT_jDwvMgsCXlEsTrTLDm3VFOletNrbzbOrFevsL8_KhIbwRLSeWxVYGaI9GlYm4TE4b73kiEBxrebIQb3qAXn8W6RzWSt4SGeNkCGzeI9G9KY5w6KcJacAMnNFJ4Tg_3Hki32co1cUzevUDXwxcQybrF8hh2tgImbhZxf1MrAcFm7TJh10a01t3nvBA20BsuIYEquWF0G6fvsCSDHIEEG0G1VHFoKQYHD74Y2-bu6eq0Rmdzch5cA3cNI_wu2pRd4YpryPXUMo31N0DdeYTYhEAaZX-VO8eiTSfC0MJ0K0BU9UA9WJKGYEE2Ema-vC3MutehusGkz901HAbT-2nXB9j_BARFaLXvcg6WAVNgwEbataQshkANxSk3rvVO40wHiKkexFrnct5oNIBqZ7ilrVcgmY9wlOEbktnZKa4NMdoLVbgTMzR9XI2Pt_WW2vnQa-UXgbj9dXYFD5-l-4s1AoS1ZgE7FMv3IATxWd1Uu-P3HrgZPNQ2mVmoFTV91uY1wUdmZwmm-msow-NumJDlfotdjVCFyN2-gCc0jNYFiP3LXIn2jXKrFCOQNmq9CQSkB_MHPTIHfjFx

Requested by

Host: filecr.com
URL: https://filecr.com/en/?id=94759749504

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 12 KB
9 KB 39ms
39ms XHR
application/json 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220119&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

60fbe9177094d8acc5fed0647a3ab4be7d85d6ef0cf9c5728db667b99a1121d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 22 Jan 2022 11:57:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9220
x-xss-protection: 0

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame A455 13 KB
5 KB 40ms
39ms Document
text/html 2a02:2638:1::13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=filecr.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

7225c811b9035a4ce65639eb7ab5e7850833a340a866cc8e4bc5c2ce4abe8756

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/

Response headers

cache-control: private, max-age=3600
content-type: text/html; charset=utf-8
content-encoding: gzip
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
server-processing-duration-in-ticks: 2144
date: Sat, 22 Jan 2022 11:57:31 GMT
content-length: 5180
strict-transport-security: max-age=31536000; preload;

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 95ms
95ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 22 Jan 2022 11:57:32 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame A455
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=filecr.com&sn=ChromeSyncframe&so=0&topUrl=filecr.com&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=NVXpf3xHWWpuanBBd2JkYnRodk8rK3IrdnJUaDFmSTlFcnFjSUNhSjZTWHNMdDh0cWljSGxyWkVCcWIySTQzL1VtRTQvZ0VadjRNbEtQblRQZ05FM3FyQUdaZE5JZUxvbFFQaCtSSUxncWFCZUJzazZibzlFK0YrUlU0cU...

433 B
629 B

517ms
33ms

Fetch
application/json

178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=NVXpf3xHWWpuanBBd2JkYnRodk8rK3IrdnJUaDFmSTlFcnFjSUNhSjZTWHNMdDh0cWljSGxyWkVCcWIySTQzL1VtRTQvZ0VadjRNbEtQblRQZ05FM3FyQUdaZE5JZUxvbFFQaCtSSUxncWFCZUJzazZibzlFK0YrUlU0cUxDMXJyazJRRTJobk1KLzZNcGxiT1crNEdNdm8xRE5NTGJzeU9zT0hwd0pFSyt3N1kxb1ZtQk1VcGVNeHpqb0lDczE3aWZJYno0OGtXRk9tQ1ZJa0lKVlBQWmxoeEI5VFRGNnRTc0lXdUp3SFUwdnRSbTZwcForejh5MEhKQzdDVUs0Z1FBOC9DK1QwKzhqemw3dkdoQitLcFhTanpFQT09fA&cppv=2

Protocol

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

80717b26c611820b68032847940c4eade27533c06cad951ed2e2687f82eaa486

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:32 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 3629
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:31 GMT
strict-transport-security: max-age=31536000; preload;
content-type: text/html; charset=utf-8
location: https://mug.criteo.com/sid?cpp=NVXpf3xHWWpuanBBd2JkYnRodk8rK3IrdnJUaDFmSTlFcnFjSUNhSjZTWHNMdDh0cWljSGxyWkVCcWIySTQzL1VtRTQvZ0VadjRNbEtQblRQZ05FM3FyQUdaZE5JZUxvbFFQaCtSSUxncWFCZUJzazZibzlFK0YrUlU0cUxDMXJyazJRRTJobk1KLzZNcGxiT1crNEdNdm8xRE5NTGJzeU9zT0hwd0pFSyt3N1kxb1ZtQk1VcGVNeHpqb0lDczE3aWZJYno0OGtXRk9tQ1ZJa0lKVlBQWmxoeEI5VFRGNnRTc0lXdUp3SFUwdnRSbTZwcForejh5MEhKQzdDVUs0Z1FBOC9DK1QwKzhqemw3dkdoQitLcFhTanpFQT09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 1970
content-length: 541
expires: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame BE70 42 B
64 B 68ms
68ms Fetch
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu53Ioj-yYREXP4xf5c6M6M2gLqFVB5s1ZH-N6RFOlRhQ0wLhgtRgE2iyGKhTMO9nWgNtMDtUKMj-4XNRSvV6nphVKU9fU7Zt5V7pRndSHYe_UCcarrcw&sai=AMfl-YQFWGM9FClAOBBTaoBuO-G0SuBoxqd_N1gSG3XYL7BtQFFW15XFtQh1_9WqzRudF1QBSiikf1j5XTz55i7o_H_X27av69HcdCTeO3Ss9uDbzwvPbCh7SFKGRQg&sig=Cg0ArKJSzPXZL1foy9itEAE&cid=CAASEuRobWT78qkS64Hx7zsb2aeWdQ&id=lidar2&mcvt=1022&p=522,242,616,970&mtos=0,1022,1022,1022,1022&tos=0,1022,0,0,0&v=20220119&bin=7&avms=nio&bs=0,0&mc=0.96&if=1&app=0&itpl=20&adk=1058625133&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1642852650702&rpt=330&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame E17B 13 KB
5 KB 25ms
25ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 22 Jan 2022 11:53:13 GMT
expires: Sun, 22 Jan 2023 11:53:13 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
content-type: text/html
age: 259
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 8E74 783 B
535 B 41ms
35ms Document
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

b0b8a935f1bf8efe99765d2d98e20fe2050cb886b2bcfc2832a4728ff7c8046e

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-IinWaQFYZXMy16WIpjrJtw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Sat, 22 Jan 2022 11:57:32 GMT
date: Sat, 22 Jan 2022 11:57:32 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-IinWaQFYZXMy16WIpjrJtw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 3BC3 42 B
64 B 66ms
64ms Fetch
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvWUrlUu-4_94-SvKfQayBj1u9a0C6XZANIw6tExKmR8pbmdIWd4XssQStyQkCPlGe20kpgA35TUQDD6xYJb_w4C564lWcRAPPOuMur3fnbXaKYkyXvhg&sai=AMfl-YSXAs92hnNcB2XIKEYIQOIoSinbiFTF9uyUlZbXeKO5akSyqgfOInUf7JOjLkRGUHeEqHb3E20Edp7ArZF1kRXjyra28Gq-2RrV4HbbE3ox5h2rnNC4-GXwcrc&sig=Cg0ArKJSzNfrZO6dRf-nEAE&cid=CAASEuRoFDJYlWKpO2IC3uJoofdFsg&id=lidar2&mcvt=1000&p=453,1073,1057,1373&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20220119&bin=7&avms=nio&bs=0,0&mc=0.99&if=1&app=0&itpl=20&adk=1436553605&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1642852650692&rpt=426&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 RSjKnk5gG5e-YnqyaokaGBofRBYcmQ35b5mWA3AF7Xg.js Show response
pagead2.googlesyndication.com/bg/ Frame E17B 35 KB
13 KB 29ms
29ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/RSjKnk5gG5e-YnqyaokaGBofRBYcmQ35b5mWA3AF7Xg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4528ca9e4e601b97be627ab26a891a181a1f44161c990df96f9996037005ed78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 21 Jan 2022 07:15:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 103339
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13497
x-xss-protection: 0
last-modified: Wed, 12 Jan 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 21 Jan 2023 07:15:13 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 8E74 0
0 80ms
80ms Image
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220119&jk=588111893478375&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET generate_204
tpc.googlesyndication.com/ Frame E17B 0
0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 63ms
62ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20220119&jk=588111893478375&bg=!BQalBkLNAAZ_DxPPfw87ACkAdvg8Whco3xBNmP08MA7bUnp2mgCPVwYJCFOnlViDah7JEpiPs3OlkgIAAABTUgAAAARoAQeZAsFIpcLpp5Wsz4cS6iZ8YEVe9uoj0INY6kUI-3ktcX_t024vnJUX94e9Ptney-9tfCrU-E0GJtl6v77wKVD8EEyWB43mC86NRZsom6ILrariAkkoukOOqnnKDkQiKhzSO3sZs7FaEbw4WiMSIJFMbZbjThFecJwqXw8GZu2ysD-rGJykO8rHQbMbaDgTds_MVKks8HDjJlbulkYDKZmmfgdS96yibXdzpejecuoo4McYBQRwUixknguAIznLBF8EmuIjQ6ydEhNNjpt8sw6N78BwvBDwRggcuZbZrFPuGaWtHvkuNNxh1E5obbAeRHD84lF7oXbo7Aq3K9fBVn7zTyCJ5yys2h3Ka71mMJOS75dA-2MnO9CvuNrEomtLndzZ72yyDWDU_i_iYsmJB_tgxHiFpYAmyyeypFKmvaijH26vdiVkWNps0oOyVekUKN8Oz_T6hWVGoTx5Q8ge_lSJDFky4riaHQefVaAKY2yED4Y-miCdZO-pz4JJoBPRSznMv-N5L6zjBoX3FcN4PZZ7i9zaoAQyu9aPZrXFDYay0f_yO1Pcqekdm54bXq5qw4LXBQ8CYN3X_o94qfDN-SQonWWBWF_-rnjPuR1oD7_CSTbGeFvOMRZXLvJJlVewoK_51f_WZIAYggSz9zYprP5A8aOsIKmuD6Io_YpDBv0osCSTUa7per-4yUVwXi6hjNYtmiCx2yHofQiprPHpwwX9wdY6uerfYiEX3oW7mkC7N3YaUZp-iNYhvsmG7qyui2Lgl8WDtIdyamaGmuP93QikeB7J-OB-v939dPMMwtxZZtQ3VOuX8f2B5RVRJLVDROlLNnizDMRRwPMkBBXgTecJTWl8jzVHjcm2glZAMFkKkw8CbppKaJtV99GoqzKlniF0aZ3Oi4zV_--D2xVEW8iTcXCNoL3FlNRm7X6wlzXJ-J1I0RM

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame FF2C 43 B
215 B 106ms
106ms Image
image/gif 52.204.155.179
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=490395&asId=b0413342-ece1-10fd-7a41-b6dbf871099c&tv=%7Bc:21HGev,pingTime:-10,time:978,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8TGludXggeDg2XzY0fHxHZWNrb3x8MjAwMzAxMDd8fDB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS85Ny4wLjQ2OTIuNzEgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.5.12v220002022000220000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1642852651852%7C%7Cae0c6d00a796e58e96fc71bc297871f6%7C%7C8866308252d63f9bf74b74e606896148%7C%7C2eb52423eb597c263708626456ad0c5b%7C%7Cc6c299645158f2cba157c22cc560d57e%7C%7C21095e91677245c30a2768dcb6fd8de1%7C%7C810c898d23a519d8878f8a9929a04ba3%7C%7C0e7dfe5e0da231348b83554c19f75159%7C%7C1629390669,sca:%7Bspg:15c122c1-dfab-3bf8-761f-16c045d09494%7D%7D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.155.179 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-155-179.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://1c32527295e07d48d0d3a55c9de3f8ae.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:32 GMT
x-server-name: dt06.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 037C 0
735 B 30ms
30ms Script
text/html 185.33.221.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.90 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:32 GMT
X-Proxy-Origin: 192.145.127.216; 192.145.127.216; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 078b01bf-5ddc-44e9-9fb1-e54610e37c10
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 57F5 281 B
554 B 76ms
24ms Document
text/html 104.92.74.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.92.74.8 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-92-74-8.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
ETag: "402b2-119-5d32342a551c0"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Sat, 22 Jan 2022 11:57:33 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 200 iframe Show response
mantodea.mantisadnetwork.com/prebid/ Frame 2014 233 B
470 B 107ms
107ms Document
text/html 35.174.217.176
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1642852650120&secure=true&version=9&uuid=95c2237f-58a7-4759-8bc6-cd9e3b56b5a0&title=FileCR%20-%20THE%20BIGGEST%20SOFTWARE%20STORE&url=https%3A%2F%2Ffilecr.com%2Fen%2F%3Fid%3D94759749504
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.174.217.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-174-217-176.compute-1.amazonaws.com
Software: / Express
Resource Hash: 8852dc4007339811b06753da707b4815bb8f2abb9e46eb84a7d6a77949638bed

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/

Response headers

date: Sat, 22 Jan 2022 11:57:33 GMT
content-type: text/html; charset=utf-8
content-length: 233
x-powered-by: Express
vary: Origin
access-control-allow-credentials: true
cache-control: private, no-cache, no-store, must-revalidate
pragma: no-cache
expires: -1
etag: W/"e9-GZ2E7tKvySh01E1LZd6JDT9X13Q"

GET
H2 200 sync Show response
eb2.3lift.com/ Frame 0746 1 KB
1 KB 26ms
26ms Document
text/html 13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: e9a44208e25036e97c1bb899b2a6ded125fdb945db49670545f721efc46fd329

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/

Response headers

date: Sat, 22 Jan 2022 11:57:33 GMT
content-type: text/html; charset=utf-8
content-length: 460
content-encoding: gzip
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control: no-cache, no-store, must-revalidate

GET
H2 200 sync.html Show response
public.servenobid.com/ Frame 6DE6 8 KB
4 KB 158ms
18ms Document
text/html 2620:1ec:46::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:46::45 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bbfd30e5fd2bd475d319b5b55ab61469966d1517b703f9bd830a6f3207387c27

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/

Response headers

cache-control: max-age=86400
content-type: text/html
content-encoding: br
last-modified: Wed, 15 Dec 2021 19:31:35 GMT
accept-ranges: bytes
etag: "32347ab14bd5257f1f3d2e210ba82276"
server: AmazonS3
x-cache: TCP_HIT
x-amz-id-2: eoSL6Yf6TpXhxr1+kTGZMynDRjCJgmG1HXav0o3AhJgOpcjexjTdnBzCRHY6V5FRBBk/dbWMTGY=
x-amz-request-id: DQRTNZJQ7Q10TS1K
x-amz-meta-codebuild-content-sha256: 8644b4f52d5a37b8f0b84f0bbcfa66f9e0f7f97407e4d25c13a055f86b22baed
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:us-east-1:559734745816:build/adserver-public-prod:0897103a-6355-4b89-92f6-53a82b1da700
x-amz-meta-codebuild-content-md5: 276cf0a41034befc9a603617ae1a1731
x-azure-ref-originshield: 0fM7rYQAAAAAl99YLjTDPS7PBdJy6MxX0QU1TMDRFREdFMTgxOQA4NGU3ZGZhMi0xNDQyLTQzMzQtYjM0Zi1lNDJkM2Y3ZGRhZDk=
x-azure-ref: 0LfHrYQAAAAAkYh7lo4JPTLcRciWbApqQTUlMMzBFREdFMDUxMAA4NGU3ZGZhMi0xNDQyLTQzMzQtYjM0Zi1lNDJkM2Y3ZGRhZDk=
date: Sat, 22 Jan 2022 11:57:32 GMT

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 7108 52 KB
17 KB 38ms
38ms Document
text/html 92.122.145.117
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 92.122.145.117 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-145-117.deploy.static.akamaitechnologies.com
Software: nginx/1.13.10 /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/

Response headers

Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: "5fc7ff8f-cf34"
Server: nginx/1.13.10
Content-Type: text/html
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Length: 17053
Cache-Control: max-age=86402
Expires: Sun, 23 Jan 2022 11:57:35 GMT
Date: Sat, 22 Jan 2022 11:57:33 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 6AA5 2 KB
814 B 43ms
43ms Document
text/html 51.89.9.252
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1642852649900

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/filecr.js?1642852200000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/

Response headers

content-type: text/html
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
strict-transport-security: max-age=15552000

GET
H2 204 /
onetag-sys.com/usync/ 0
52 B 35ms
35ms Image
text/plain 51.89.9.252
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/usync/?tag=img

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://filecr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-cache, no-transform

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame 0746 70 B
265 B 156ms
49ms Image
image/gif 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=1&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:33 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2

404

xuidmid=7976&xuid=Xahq8j84M&dongle=u6nf
eb2.3lift.com/ Frame 0746
Redirect Chain

https://ad.mrtnsvr.com/sync/triplelift
https://eb2.3lift.com/xuidmid=7976&xuid=Xahq8j84M&dongle=u6nf

37 B
155 B

26ms
25ms

Image
image/gif

13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuidmid=7976&xuid=Xahq8j84M&dongle=u6nf
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:33 GMT
cache-control: no-cache, no-store, must-revalidate
x-error: Not Found
content-length: 37
content-type: image/gif

Redirect headers

location: https://eb2.3lift.com/xuidmid=7976&xuid=Xahq8j84M&dongle=u6nf
date: Sat, 22 Jan 2022 11:57:33 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 92
vary: Origin
content-type: text/html; charset=utf-8

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 0746 170 B
188 B 43ms
42ms Image
image/png 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=1&gdpr_consent=

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0746
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=1&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTM3NDE3NTM0NzEyNDMwODg5MDQ%3D

170 B
188 B

42ms
41ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTM3NDE3NTM0NzEyNDMwODg5MDQ%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTM3NDE3NTM0NzEyNDMwODg5MDQ%3D
date: Sat, 22 Jan 2022 11:57:33 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 setuid
px.ads.linkedin.com/ Frame 0746 0
707 B 221ms
181ms Image
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=13741753471243088904&dbredirect=true&gdpr=1&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:33 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 99643A52233A43A1A5BDEA5DCE154B29 Ref B: MIL30EDGE1005 Ref C: 2022-01-22T11:57:33Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXWKnDRgh/Jhso3Ezly8Q==

GET
H2

200

xuid
eb2.3lift.com/ Frame 0746
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/13741753471243088904?gdpr=1&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-6T9k8vFE2oSA7LvoxtPFn6IPJOAMIdsuu4I2_GDeKw--~A&dongle=0883

37 B
353 B

27ms
27ms

Image
image/gif

13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-6T9k8vFE2oSA7LvoxtPFn6IPJOAMIdsuu4I2_GDeKw--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:33 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date: Sat, 22 Jan 2022 11:57:33 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-6T9k8vFE2oSA7LvoxtPFn6IPJOAMIdsuu4I2_GDeKw--~A&dongle=0883
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame 0746 43 B
220 B 119ms
39ms Image
image/gif 18.158.102.161
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=triplelift&user_id=13741753471243088904&gdpr=1&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.158.102.161 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-102-161.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Sat, 22 Jan 2022 11:57:33 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 c.gif
c.bing.com/ Frame 0746 42 B
593 B 88ms
48ms Image
image/gif 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=13741753471243088904&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:33 GMT
etag: "9ea1ae3587d81:0"
last-modified: Wed, 12 Jan 2022 02:05:35 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 7237B02095444CCEAB59417149DF59B5 Ref B: MIL30EDGE0720 Ref C: 2022-01-22T11:57:33Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

GET
H/1.1

200
OK

iu3
s.amazon-adsystem.com/ Frame 0746
Redirect Chain

https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=1&gdpr_consent=&uid=13741753471243088904
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=13741753471243088904&dcc=t

0
0

191ms
110ms

Image
text/html

209.54.176.128
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=13741753471243088904&dcc=t
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: HTTP/1.1
Server: 209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Redirect headers

Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:33 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: E9WXS41B8E35Q8VAPKMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=13741753471243088904&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame 0746
Redirect Chain

https://b1sync.zemanta.com/usersync/triplelift?gdpr=1&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1

37 B
139 B

28ms
26ms

Image
image/gif

13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:33 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:33 GMT
Cache-Control: no-cache, no-store, must-revalidate
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Content-Length: 95
Content-Type: text/html; charset=utf-8

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 7108 0
735 B 43ms
43ms Script
text/html 185.33.221.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.90 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:33 GMT
X-Proxy-Origin: 192.145.127.216; 192.145.127.216; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 0df8392d-f0e8-4231-a4f8-91e2ae114ad5
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 57F5 32 KB
10 KB 25ms
25ms Script
text/html 104.92.74.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.92.74.8 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-92-74-8.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: d3596b1c56113b0c34f24fa24b10ea60b24117474a15cac1d13f06eab561d508

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Sat, 22 Jan 2022 11:57:33 GMT
Content-Encoding: gzip
Last-Modified: Wed, 15 Dec 2021 23:04:16 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=59508
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9704
Expires: Sun, 23 Jan 2022 04:29:21 GMT

GET
H2 200 fltiu.js Show response
pixel.yabidos.com/ Frame 2014 2 KB
1 KB 95ms
25ms Script
application/javascript 104.16.200.58
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.yabidos.com/fltiu.js?qid=83233313f553333313f513430313&cid=1041&p=undefined&s=filecr.com
Requested by: Host: mantodea.mantisadnetwork.com
URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1642852650120&secure=true&version=9&uuid=95c2237f-58a7-4759-8bc6-cd9e3b56b5a0&title=FileCR%20-%20THE%20BIGGEST%20SOFTWARE%20STORE&url=https%3A%2F%2Ffilecr.com%2Fen%2F%3Fid%3D94759749504
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.200.58 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 04e15c27c7c1e344842fec61d78bfb338739501f6d293a013d57a808efcc3674

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:33 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 21 Jan 2022 14:45:58 GMT
server: cloudflare
age: 4156
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 6d189afb4cbf374d-MXP
content-length: 1168
expires: Sat, 22 Jan 2022 13:57:33 GMT

GET
H2

200

query
ecs.mantisadnetwork.com/sync/pixel/ Frame 2014
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=rjrqv8k&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=rjrqv8k&ttd_tpi=1
https://ecs.mantisadnetwork.com/sync/pixel/query?source=tradedesk&id=7a2bb36c-19a7-4c60-9c7a-3e335f72bd53

35 B
152 B

112ms
110ms

Image
image/gif

35.174.217.176
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ecs.mantisadnetwork.com/sync/pixel/query?source=tradedesk&id=7a2bb36c-19a7-4c60-9c7a-3e335f72bd53
Requested by: Host: mantodea.mantisadnetwork.com
URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1642852650120&secure=true&version=9&uuid=95c2237f-58a7-4759-8bc6-cd9e3b56b5a0&title=FileCR%20-%20THE%20BIGGEST%20SOFTWARE%20STORE&url=https%3A%2F%2Ffilecr.com%2Fen%2F%3Fid%3D94759749504
Protocol: H2
Server: 35.174.217.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-174-217-176.compute-1.amazonaws.com
Software: / Express
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:33 GMT
x-powered-by: Express
etag: W/"23-X71HIiL+uKIs9biqXcW44Tr4jis"
content-length: 35
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:33 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://ecs.mantisadnetwork.com/sync/pixel/query?source=tradedesk&id=7a2bb36c-19a7-4c60-9c7a-3e335f72bd53
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 241

GET
H2 200 13926 Show response
g2.gumgum.com/usync/ Frame 6C2C 4 KB
2 KB 160ms
50ms Document
text/html 52.210.54.130
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.210.54.130 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-54-130.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 3bf2fabdfac63c34cf836330dbbf6455d59d4a2317054abdaa1879df7c805718

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://public.servenobid.com/

Response headers

date: Sat, 22 Jan 2022 11:57:33 GMT
content-type: text/html;charset=UTF-8
server: nginx
etag: W/"068b2f84bbf3df9f76011adc66901cd39"
timing-allow-origin: *
content-encoding: gzip

GET
H2 204 ps
pixel.33across.com/ Frame E1C1 0
0 1548ms
127ms Document
text/plain 67.202.105.22
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.33across.com/ps?m=xch&rt=html&id=0010b00002Mq2FYAAZ&ru=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D304%26uid%3D33XUSERID33X
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.22 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip22.67-202-105.static.steadfastdns.net
Software: 33XP003 /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://public.servenobid.com/

Response headers

x-33x-status: 2000208
server: 33XP003
date: Sat, 22 Jan 2022 11:57:33 GMT

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 3B05 2 KB
814 B 35ms
35ms Document
text/html 51.89.9.252
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://public.servenobid.com/

Response headers

content-type: text/html
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK sync Show response
ssbsync.smartadserver.com/api/ Frame 8102 635 B
885 B 35ms
35ms Document
text/html 185.86.138.120
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.138.120 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 4189e444fe05f378db48e696f813f041b6c0c39fad09ca6a2ac02617b225fba5

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://public.servenobid.com/

Response headers

date: Sat, 22 Jan 2022 11:57:33 GMT
content-type: text/html
content-length: 635

GET
H/1.1 200
OK usermatch Show response
ssum-sec.casalemedia.com/ Frame CA5F 2 KB
3 KB 71ms
69ms Document
text/html 92.122.147.230
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 92.122.147.230 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-147-230.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 33e808300e6356f98bf29de294896f7f84bd2523e434ed7d4f76a515174c15c9

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://public.servenobid.com/

Response headers

Server: Apache
Content-Type: text/html
Dropped-Udsids: 230|39|241|46|40|17|10|88
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Vary: Is-Traffic-Usersync
Expires: Sat, 22 Jan 2022 11:57:33 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:33 GMT
Content-Length: 1600
Connection: keep-alive

GET
H2

200

sync
ads.servenobid.com/ Frame 6DE6
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=312&uid=4047297810264048102

0
344 B

51ms
50ms

Image
image/avif

18.202.39.221
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=312&uid=4047297810264048102
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 18.202.39.221 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-39-221.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:33 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:33 GMT
X-Proxy-Origin: 192.145.127.216; 192.145.127.216; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: df366cc1-b841-474d-9e28-7fa373e42f39
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ads.servenobid.com/sync?pid=312&uid=4047297810264048102
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 6DE6
Redirect Chain

https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D
https://ads.servenobid.com/sync?pid=310&uid=4d30eaf5a62744b37f571bd4

0
348 B

53ms
52ms

Image
image/avif

18.202.39.221
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=310&uid=4d30eaf5a62744b37f571bd4
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 18.202.39.221 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-39-221.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:33 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:33 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Location: https://ads.servenobid.com/sync?pid=310&uid=4d30eaf5a62744b37f571bd4
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1ams1
Content-Length: 0
Expires: Fri, 20 Mar 2009 00:00:00 GMT

GET
H2

200

usersync
rtb.gumgum.com/ Frame 6DE6
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync2/rmpssp?sub=duration&zcc=1&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D&cb=1642852653402
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=3423952646
https://sync.1rx.io/usersync/tradedesk/7a2bb36c-19a7-4c60-9c7a-3e335f72bd53
https://sync.targeting.unrulymedia.com/csync/RX-6d18e588-763d-4781-a1b8-adb04c7d462c-003?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3DRX-6d18e588-763d-4781-a1b8-adb04c7d462c-003
https://rtb.gumgum.com/usersync?b=rhy&i=RX-6d18e588-763d-4781-a1b8-adb04c7d462c-003

35 B
208 B

61ms
59ms

Image
image/gif

52.210.54.130
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=rhy&i=RX-6d18e588-763d-4781-a1b8-adb04c7d462c-003
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.210.54.130 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-54-130.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:33 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

location: https://rtb.gumgum.com/usersync?b=rhy&i=RX-6d18e588-763d-4781-a1b8-adb04c7d462c-003
date: Sat, 22 Jan 2022 11:57:33 GMT
server: Tengine
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RX6d18e588763d4781a1b8adb04c7d462c003
content-type: text/html

GET
H2 200 101954
jadserve.postrelease.com/suid/ Frame 6DE6 43 B
428 B 328ms
106ms Image
image/gif 75.101.244.20
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jadserve.postrelease.com/suid/101954?ntv_r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D322%26uid%3DNTV_USER_ID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.101.244.20 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-75-101-244-20.compute-1.amazonaws.com
Software: nginx/1.12.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:33 GMT
server: nginx/1.12.1
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type: image/gif
content-length: 43
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 6DE6
Redirect Chain

https://p.rfihub.com/cm?pub=44007&in=1
https://ads.servenobid.com/sync?pid=324&uid=5123196421135070961

0
344 B

51ms
51ms

Image
image/avif

18.202.39.221
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=324&uid=5123196421135070961
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 18.202.39.221 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-39-221.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:33 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Location: https://ads.servenobid.com/sync?pid=324&uid=5123196421135070961
Date: Sat, 22 Jan 2022 11:57:33 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET usa
sync.go.sonobi.com/ Frame 6DE6 0
0

GET
H2

200

sync
ads.servenobid.com/ Frame 6DE6
Redirect Chain

https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1YN-&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D
https://ads.servenobid.com/sync?pid=327&uid=657005ee-315d-4b52-88f7-92414570a142&gdpr=0&gdpr_consent=&us_privacy=1YN-

0
356 B

51ms
51ms

Image
image/avif

18.202.39.221
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=327&uid=657005ee-315d-4b52-88f7-92414570a142&gdpr=0&gdpr_consent=&us_privacy=1YN-
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 18.202.39.221 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-39-221.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:33 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=327&uid=657005ee-315d-4b52-88f7-92414570a142&gdpr=0&gdpr_consent=&us_privacy=1YN-
date: Sat, 22 Jan 2022 11:57:33 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
content-length: 0

GET
H2

200

sync
ads.servenobid.com/ Frame 6DE6
Redirect Chain

https://ups.analytics.yahoo.com/ups/58559/occ
https://ads.servenobid.com/sync?pid=337&uid=y-CJL7dYtE2uG2t8IVd5xOPD05bxRF6WjA2Fmvd1Q-~A

0
366 B

51ms
51ms

Image
image/avif

18.202.39.221
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=337&uid=y-CJL7dYtE2uG2t8IVd5xOPD05bxRF6WjA2Fmvd1Q-~A
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 18.202.39.221 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-39-221.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:33 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=337&uid=y-CJL7dYtE2uG2t8IVd5xOPD05bxRF6WjA2Fmvd1Q-~A
date: Sat, 22 Jan 2022 11:57:33 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

btu4jd3a
sync-tm.everesttech.net/ct/upi/pid/ Frame 57F5
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D&_test=YevxLQAAc1sM2ABB

85 B
164 B

17ms
15ms

Image
image/png

151.101.2.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D&_test=YevxLQAAc1sM2ABB
Protocol: H2
Server: 151.101.2.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:33 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
age: 160
x-served-by: cache-mxp6942-MXP
x-cache: HIT
content-type: image/png
cache-control: no-cache
accept-ranges: bytes
x-timer: S1642852654.512923,VS0,VE0
content-length: 85
x-cache-hits: 632

Redirect headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:33 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1642852653.398542,VS0,VE96
x-served-by: cache-mxp6942-MXP
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
location: https://sync-tm.everesttech.net/ct/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D&_test=YevxLQAAc1sM2ABB
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-cache-hits: 0

GET
H2 200 rubicon
match.adsrvr.org/track/cmf/ Frame 57F5 70 B
264 B 50ms
48ms Image
image/gif 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/rubicon
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:33 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 57F5
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZjFkNzlhNzMwZDkwNzIzNTQ5NWVkNTM1ZDAyN2RmYTExZDlhZWJhZg

170 B
188 B

42ms
41ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZjFkNzlhNzMwZDkwNzIzNTQ5NWVkNTM1ZDAyN2RmYTExZDlhZWJhZg

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZjFkNzlhNzMwZDkwNzIzNTQ5NWVkNTM1ZDAyN2RmYTExZDlhZWJhZg
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 37b22a0c36bd84993dd2cda4a5e04b1d
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame 57F5
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/jLq5vZI0aRpEpAaC2Yz3ZQ?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=1500918594727875451

0
239 B

26ms
26ms

Image
image/gif

69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=1500918594727875451
Protocol: HTTP/1.1
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 37b22a0c36bd84993dd2cda4a5e04b1d
Content-Type: image/gif

Redirect headers

date: Sat, 22 Jan 2022 11:57:33 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=1500918594727875451
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 57F5
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1lQUzFUSk4tVC1KWVNJ

170 B
188 B

44ms
44ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1lQUzFUSk4tVC1KWVNJ

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1lQUzFUSk4tVC1KWVNJ
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 37b22a0c36bd84993dd2cda4a5e04b1d
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame 57F5
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=9&redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4222%26nid%3D1512%26put%3D%5BMM_UUID%5D
https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=e60e61eb-f12d-4100-8d91-fd962fb3ba97

0
239 B

26ms
26ms

Image
image/gif

69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=e60e61eb-f12d-4100-8d91-fd962fb3ba97
Protocol: HTTP/1.1
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 37b22a0c36bd84993dd2cda4a5e04b1d
Content-Type: image/gif

Redirect headers

Date: Sat, 22 Jan 2022 11:57:33 GMT
Server: MT3 4133 baa842e master cdg-pixel-x30 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=e60e61eb-f12d-4100-8d91-fd962fb3ba97
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Sat, 22 Jan 2022 11:57:32 GMT

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame 57F5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEDp6tHJXA1oyjV4UD4zq6fQ&google_cver=1

0
239 B

27ms
26ms

Image
image/gif

69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEDp6tHJXA1oyjV4UD4zq6fQ&google_cver=1
Protocol: HTTP/1.1
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 37b22a0c36bd84993dd2cda4a5e04b1d
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:33 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEDp6tHJXA1oyjV4UD4zq6fQ&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 451 709414.gif
id.rlcdn.com/ Frame 57F5 0
0 68ms
33ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/709414.gif
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H2 200 sync
ads.servenobid.com/ Frame 8102 0
344 B 51ms
51ms Image
image/avif 18.202.39.221
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=317&uid=7650666162795629976&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.202.39.221 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-39-221.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:33 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H/1.1 200 9.gif
id5-sync.com/i/102/ Frame 8102 43 B
1009 B 176ms
36ms Image
image/gif 51.89.21.31
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/i/102/9.gif?gdpr=0&gdpr_consent=

Requested by

Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

51.89.21.31 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

p22.id5-sync.com

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Sat, 22 Jan 2022 11:57:32 GMT
Transfer-Encoding: chunked
Content-Type: image/gif;charset=UTF-8
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
P3P: CP="CAO PSA OUR"

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 8102
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D124%26partneruserid%3D%7Bdevice_id%7D&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=f08baf5c-56b5-4a8c-9425-5580279ee237&gdpr_consent=null&gdpr=0

43 B
426 B

183ms
36ms

Image
image/gif

185.86.139.114
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=f08baf5c-56b5-4a8c-9425-5580279ee237&gdpr_consent=null&gdpr=0
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 185.86.139.114 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:32 GMT
cache-control: no-cache,no-store
content-type: image/gif
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=f08baf5c-56b5-4a8c-9425-5580279ee237&gdpr_consent=null&gdpr=0
date: Sat, 22 Jan 2022 11:57:33 GMT
server: _
content-length: 0

GET
H/1.1

200
OK

redir
rtb-csync.smartadserver.com/ Frame 8102
Redirect Chain

https://match.prod.bidr.io/cookie-sync/sas?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/sas?gdpr=0&gdpr_consent=&_bee_ppp=1
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAEkek7D1-IAAEEHcanZKQ&gdpr=0

43 B
453 B

36ms
36ms

Image
image/gif

185.86.139.114
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAEkek7D1-IAAEEHcanZKQ&gdpr=0
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 185.86.139.114 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:33 GMT
cache-control: no-cache,no-store
content-type: image/gif
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location: https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAEkek7D1-IAAEEHcanZKQ&gdpr=0
Date: Sat, 22 Jan 2022 11:57:33 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
strict-transport-security: max-age=2592000; includeSubDomains

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 8102
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D86%26partneruserid%3D$UID&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=4047297810264048102&gdpr=0&gdpr_consent=

43 B
408 B

260ms
36ms

Image
image/gif

185.86.139.114
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=4047297810264048102&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 185.86.139.114 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:33 GMT
cache-control: no-cache,no-store
content-type: image/gif
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:33 GMT
X-Proxy-Origin: 192.145.127.216; 192.145.127.216; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 1337c068-692b-4217-b592-0c0a06dbffea
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=4047297810264048102&gdpr=0&gdpr_consent=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 flimpobj.js Show response
pixel.yabidos.com/ Frame 2014 31 KB
24 KB 27ms
27ms Script
application/javascript 104.16.200.58
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.yabidos.com/flimpobj.js?cb=1642852653355&ver1=2.2.3&qid=83233313f553333313f513430313&rnd=wvljwcfhz27v&cid=1041
Requested by: Host: pixel.yabidos.com
URL: https://pixel.yabidos.com/fltiu.js?qid=83233313f553333313f513430313&cid=1041&p=undefined&s=filecr.com
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.200.58 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4cf0498d6f16d928751dae8b235dab5e250f65d561f43e2dc20d982efac6016f

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:33 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 21 Jan 2022 14:45:58 GMT
server: cloudflare
age: 4160
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 6d189afb9d97374d-MXP
content-length: 24217
expires: Sat, 22 Jan 2022 13:57:33 GMT

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame CA5F 170 B
188 B 43ms
41ms Image
image/png 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&gdpr_consent=&us_privacy=&gdpr=1

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 casale
match.adsrvr.org/track/cmf/ Frame CA5F 70 B
264 B 52ms
48ms Image
image/gif 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/casale?gdpr=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:33 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame CA5F
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&dcc=t

43 B
645 B

121ms
121ms

Image
image/gif

209.54.176.128
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D

Protocol

HTTP/1.1

Server

209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:33 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 27W1EPXK647X4PS7189K
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:33 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 54MZZMC5B2TGD51SXFJE
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 400
Request failed due to privacy signals getuid
secure.adnxs.com/ Frame CA5F 0
0 59ms
32ms Image
text/html 185.33.221.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID&gdpr=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 185.33.221.90 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS: 727.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame CA5F
Redirect Chain

https://b1sync.zemanta.com/usersync/index/?us_privacy=&gdpr=1&gdpr_consent=
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=&gdpr=1

43 B
315 B

43ms
43ms

Image
image/gif

92.122.147.230
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=&gdpr=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: HTTP/1.1
Server: 92.122.147.230 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-147-230.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:33 GMT
Server: Apache
Vary: Is-Traffic-Usersync
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 43
Expires: Sat, 22 Jan 2022 11:57:33 GMT

Redirect headers

Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=&gdpr=1
Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:33 GMT
Cache-Control: no-cache, no-store, must-revalidate
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Content-Length: 106
Content-Type: text/html; charset=utf-8

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame CA5F
Redirect Chain

https://ums.acuityplatform.com/tum?umid=8
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=10&external_user_id=641834436159

43 B
1 KB

138ms
138ms

Image
image/gif

92.122.147.230
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=10&external_user_id=641834436159
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: HTTP/1.1
Server: 92.122.147.230 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-147-230.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:33 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sat, 22 Jan 2022 11:57:33 GMT

Redirect headers

access-control-allow-origin: *
content-length: 0
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=10&external_user_id=641834436159

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame CA5F
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&gdpr=1
https://sync-tm.everesttech.net/ct/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&gdpr=1&_test=YevxLQAAc1QM3ABB
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YevxLQAAc1QM3ABB&gdpr=1&_test=YevxLQAAc1QM3ABB

43 B
1 KB

73ms
73ms

Image
image/gif

92.122.147.230
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YevxLQAAc1QM3ABB&gdpr=1&_test=YevxLQAAc1QM3ABB
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: HTTP/1.1
Server: 92.122.147.230 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-147-230.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:33 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sat, 22 Jan 2022 11:57:33 GMT

Redirect headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:33 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1642852654.537943,VS0,VE0
x-served-by: cache-mxp6942-MXP
x-cache: HIT
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YevxLQAAc1QM3ABB&gdpr=1&_test=YevxLQAAc1QM3ABB
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 200 sync
ads.servenobid.com/ Frame CA5F 0
357 B 55ms
52ms Image
image/avif 18.202.39.221
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=333&uid=YevxKnyJKLqIfUTBWDuIGgAABzUAAAAB
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.202.39.221 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-39-221.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:33 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H2

200

cs&eq_cc=1 Show response
um2.eqads.com/um/ Frame E784
Redirect Chain

https://um2.eqads.com/um/cs
https://um2.eqads.com/um/cs&eq_cc=1

186 B
370 B

110ms
109ms

Document
text/html

52.45.237.203
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://um2.eqads.com/um/cs&eq_cc=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.45.237.203 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-45-237-203.compute-1.amazonaws.com
Software: /
Resource Hash: 5c71b049efc9b9395044467da7885960a38f38615cc727a442ed869a47e30b0b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://ssum-sec.casalemedia.com/

Response headers

date: Sat, 22 Jan 2022 11:57:33 GMT
content-type: text/html; charset=utf-8
content-length: 186
cache-control: no-cache, must-revalidate
expires: Sat, 6 May 1995 12:00:00 GMT
last-modified: Sat, 22 Jan 2022 11:57:33 GMT
pragma: no-cache

Redirect headers

date: Sat, 22 Jan 2022 11:57:33 GMT
content-type: text/html; charset=utf-8
content-length: 41
location: /um/cs&eq_cc=1

GET
H2 200 vbl.gif
pre.glotgrx.com/ Frame 2014 26 B
304 B 100ms
38ms Image
image/gif 2606:4700::6810:77c3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pre.glotgrx.com/vbl.gif?cb=1642852653424&rnd=wvljwcfhz27v&ifm=1&uai=1&cid=1041&s=filecr.com&p=undefined&x=&adtg=&ats=0&atf=&nsi=&si=&nci=&nai=&pft=0&iip=0&adb=1&adc=0&adcd=i0_f0_o0_e0&ai=&icp=undefined&impid=&idl=&ttduid=&id5=&emh=
Requested by: Host: mantodea.mantisadnetwork.com
URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1642852650120&secure=true&version=9&uuid=95c2237f-58a7-4759-8bc6-cd9e3b56b5a0&title=FileCR%20-%20THE%20BIGGEST%20SOFTWARE%20STORE&url=https%3A%2F%2Ffilecr.com%2Fen%2F%3Fid%3D94759749504
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:77c3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:33 GMT
cf-cache-status: HIT
last-modified: Fri, 21 Jan 2022 14:45:49 GMT
server: cloudflare
age: 3693
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 6d189afc6d07f933-MXP
content-length: 26
expires: Sat, 22 Jan 2022 13:57:33 GMT

GET
H2 200 nflrc.gif
pre.glotgrx.com/ Frame 2014 26 B
88 B 124ms
62ms Image
image/gif 2606:4700::6810:77c3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pre.glotgrx.com/nflrc.gif?cb=1642852653412322&ver=1.2r81&qid=83233313f553333313f513430313&p=undefined&s=filecr.com&x=&cid=1041&od1=&od2=&adtg=&nci=&nai=&si=&ai=&nsi=&co=0&cstm1=&cstm2=&cstm3=&rnd=wvljwcfhz27v&impid=&idl=&ttduid=&id5=&emh=&tps=2&ver1=2.2.3&1=8bc4b1d79e408f99c0da59b34ff29ffd&2=0.0&3=1200_1600_1200_1600_24_24_1&5=%7B%220%22%3A%7B%220%22%3A%22Chrome%2520PDF%2520Plugin%2520-%2520%2520-%2520internal-pdf-viewer%2520-%2520Portable%2520Document%2520Formatfl_br%22%2C%221%22%3A%22Chrome%2520PDF%2520Viewer%2520-%2520%2520-%2520mhjfbmdgcfjbbpaeojofohoefgiehjai%2520-%2520fl_br%22%2C%222%22%3A%22Native%2520Client%2520-%2520%2520-%2520internal-nacl-plugin%2520-%2520fl_br%22%7D%7D&6=2&7={%22e%22:%2211%22,%22m%22:%220%22,%22f%22:%223428%22}&ats=0&atf=&dbgcid=1041&ifm=1&penv=b&pt=&ptbp=&tw=0&ldp=1&icpl=23&icp=https%253A//filecr.com/&irfl=23&irf=https%253A//filecr.com/&cty=4&fcs=0&flky=ver-fl-6-qid-fl-28-p-fl-9-s-fl-10-x-fl-0-cid-fl-4-od1-fl-0-od2-fl-0-adtg-fl-0-nci-fl-0-nai-fl-0-si-fl-0-ai-fl-0-nsi-fl-0-co-fl-0-cstm1-fl-0-cstm2-fl-0-cstm3-fl-0-rnd-fl-12-impid-fl-0-idl-fl-0-ttduid-fl-0-id5-fl-0-emh-fl-0-tps-fl-0-cb-fl-13-ver1-fl-5-&spfp=1&spfnp=0&sp1=Chromefl_andLinux&sp2=Chromefl_andWindows&adv=0&det=1&adb=1&iip=0&spf=0&adc=0&adcd=i0_f0_o0_e0&vps=0x0&gpu=Intel%20Iris%20OpenGL%20Engine&ncf=4g_9.1_undefined_null_0_undefined_false&chua={%22architecture%22:%22%22,%22brands%22:[],%22mobile%22:false,%22model%22:%22%22,%22platform%22:%22%22,%22platformVersion%22:%22%22,%22uaFullVersion%22:%22%22}&fli=&flerr=0&trim=&fio=20
Requested by: Host: mantodea.mantisadnetwork.com
URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1642852650120&secure=true&version=9&uuid=95c2237f-58a7-4759-8bc6-cd9e3b56b5a0&title=FileCR%20-%20THE%20BIGGEST%20SOFTWARE%20STORE&url=https%3A%2F%2Ffilecr.com%2Fen%2F%3Fid%3D94759749504
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:77c3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:33 GMT
cf-cache-status: HIT
last-modified: Fri, 21 Jan 2022 14:45:49 GMT
server: cloudflare
age: 4282
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 6d189afc6d08f933-MXP
content-length: 26
expires: Sat, 22 Jan 2022 13:57:33 GMT

GET
H2

200

usersync
rtb.gumgum.com/ Frame 6C2C
Redirect Chain

https://secure.adnxs.com/getuid?https://rtb.gumgum.com/usersync?b=apn&i=$UID
https://rtb.gumgum.com/usersync?b=apn&i=4047297810264048102

35 B
208 B

101ms
84ms

Image
image/gif

52.210.54.130
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=apn&i=4047297810264048102
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 52.210.54.130 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-54-130.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:33 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:33 GMT
X-Proxy-Origin: 192.145.127.216; 192.145.127.216; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 9e593b21-d500-43c3-9222-af01515f728e
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://rtb.gumgum.com/usersync?b=apn&i=4047297810264048102
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

usersync
rtb.gumgum.com/ Frame 6C2C
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=e_56641a5a-dc1e-4d5d-b2c4-4205b18833f8&gdpr=0&gdpr_consent=&us_privacy=1---
https://x.bidswitch.net/ul_cb/sync?ssp=gumgum2&user_id=e_56641a5a-dc1e-4d5d-b2c4-4205b18833f8&gdpr=0&gdpr_consent=&us_privacy=1---
https://ads.avct.cloud/getuid?url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dgumgum2
https://ads.avct.cloud/getuid?bounce=true&url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dgumgum2
https://x.bidswitch.net/sync?dsp_id=59&user_id=6dd36a74-c498-48fd-aa61-4331ba948137&ssp=gumgum2
https://rtb.gumgum.com/usersync?b=bsw&i=99f10533-51e3-4e68-80f9-e3ad5bbd5463

35 B
208 B

56ms
56ms

Image
image/gif

52.210.54.130
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=bsw&i=99f10533-51e3-4e68-80f9-e3ad5bbd5463
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 52.210.54.130 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-54-130.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:33 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Location: //rtb.gumgum.com/usersync?b=bsw&i=99f10533-51e3-4e68-80f9-e3ad5bbd5463
Date: Sat, 22 Jan 2022 11:57:33 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H/1.1

204
No Content

sync.php
pixel-us-east.rubiconproject.com/exchange/ Frame 6C2C
Redirect Chain

https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRdUrl%7D
https://rtb.gumgum.com/usersync?b=obn&i=ENC%28rn2BKWj47FbzvDON970e2iEEtJSwXcwpyg2pHMhPv6tsv2PRf7KCKd5d_al1RT6A%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%26pla...
https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=e_56641a5a-dc1e-4d5d-b2c4-4205b18833f8&obuid=ENC(rn2BKWj47FbzvDON970e2iEEtJSwXcwpyg2pHMhPv6tsv2PRf7KCKd5d_al1RT6A)
https://sync.outbrain.com/syncPartner?platformId=GUMGU18H7EL9NI653I7DPEH51
https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=15268

0
239 B

561ms
109ms

Image
image/gif

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=15268
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 6734403d2cb3625dc1fef1bbd4a17cf3
Content-Type: image/gif

Redirect headers

Location: https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=15268
Date: Sat, 22 Jan 2022 11:57:34 GMT
X-TraceId: f69a683aa4151f6cb2db4ea81e1fff55
Content-Length: 0

GET
H2

200

usersync
rtb.gumgum.com/ Frame 6C2C
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://us-u.openx.net/w/1.0/cm?cc=1&_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://rtb.gumgum.com/usersync?b=opx&i=74b0a7a5-40ba-47dd-b90e-fccea2cca1ee

35 B
208 B

59ms
58ms

Image
image/gif

52.210.54.130
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=opx&i=74b0a7a5-40ba-47dd-b90e-fccea2cca1ee
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 52.210.54.130 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-54-130.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:33 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

date: Sat, 22 Jan 2022 11:57:33 GMT
content-encoding: gzip
server: OXGW/17.1.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://rtb.gumgum.com/usersync?b=opx&i=74b0a7a5-40ba-47dd-b90e-fccea2cca1ee
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
via: 1.1 google

GET
H2

200

usersync
rtb.gumgum.com/ Frame 6C2C
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=sta&i=0-78ee5b30-f786-47a1-630c-b869cd8018a7$ip$192.145.127.216

35 B
208 B

55ms
55ms

Image
image/gif

52.210.54.130
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=sta&i=0-78ee5b30-f786-47a1-630c-b869cd8018a7$ip$192.145.127.216
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 52.210.54.130 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-54-130.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:34 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Location: https://rtb.gumgum.com/usersync?b=sta&i=0-78ee5b30-f786-47a1-630c-b869cd8018a7$ip$192.145.127.216
Date: Sat, 22 Jan 2022 11:57:34 GMT
Connection: keep-alive
Content-Length: 124
Content-Type: text/html; charset=utf-8

GET
H2

200

usersync
rtb.gumgum.com/ Frame 6C2C
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=oth&i=y-lMrEGSdE2pfvUPr1eSqw391HiriLy4i5yfog~A

35 B
208 B

86ms
84ms

Image
image/gif

52.210.54.130
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=oth&i=y-lMrEGSdE2pfvUPr1eSqw391HiriLy4i5yfog~A
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 52.210.54.130 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-54-130.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:33 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

date: Sat, 22 Jan 2022 11:57:33 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://rtb.gumgum.com/usersync?b=oth&i=y-lMrEGSdE2pfvUPr1eSqw391HiriLy4i5yfog~A
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H2

200

usersync
rtb.gumgum.com/ Frame 6C2C
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=1---&redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%...
https://rtb.gumgum.com/usersync?b=vnt&i=7c0a02de-7b7a-11ec-89d9-c532182b6380

35 B
208 B

58ms
57ms

Image
image/gif

52.210.54.130
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=vnt&i=7c0a02de-7b7a-11ec-89d9-c532182b6380
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 52.210.54.130 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-54-130.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:33 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Location: https://rtb.gumgum.com/usersync?b=vnt&i=7c0a02de-7b7a-11ec-89d9-c532182b6380
Date: Sat, 22 Jan 2022 11:57:33 GMT
Server: Apache-Coyote/1.1
Connection: keep-alive
Content-Length: 0
X-CI-RTID: 7c0a02df-7b7a-11ec-89d9-c532182b6380

GET
H2 204 services
sync.technoratimedia.com/ Frame 6C2C 0
293 B 383ms
113ms Image
text/plain 193.122.128.135
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=1---&cb=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 193.122.128.135 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:33 GMT
via: 1.1 varnish
server: nginx
age: 0
access-control-allow-methods: POST,GET,HEAD,OPTIONS
x-varnish: 529105162
access-control-allow-origin: https://g2.gumgum.com/
access-control-allow-credentials: true

GET
H2 200 142
match.deepintent.com/usersync/ Frame 6C2C 0
44 B 378ms
114ms Image
text/plain 169.197.150.8
DEEPINTENT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.deepintent.com/usersync/142
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.8 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS: g.deepintent.com
Software: c /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:33 GMT
content-length: 0
server: c

GET
H2

200

usersync
rtb.gumgum.com/ Frame 6C2C
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=e_56641a5a-dc1e-4d5d-b2c4-4205b18833f8&gdpr=0&gdpr_consent=&us_privacy=1---
https://stags.bluekai.com/site/23178?id=iOnM27vSn-tJFSUjwm6g&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT22KPNZGTEN3WKNXC25CKIZJVK2TXNU3GOJTVONPXA...
https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=iOnM27vSn-tJFSUjwm6g&us_privacy=1---

35 B
208 B

55ms
55ms

Image
image/gif

52.210.54.130
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=iOnM27vSn-tJFSUjwm6g&us_privacy=1---
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 52.210.54.130 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-54-130.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:34 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:34 GMT
P3p: CP="We do not support P3P header."
Location: https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=iOnM27vSn-tJFSUjwm6g&us_privacy=1---
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=utf-8
Content-Length: 118
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

200

usersync
rtb.gumgum.com/ Frame 6C2C
Redirect Chain

https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://rtb.gumgum.com/usersync?b=idi&i=f1445727-1573-487d-b159-fc291ee88c2e

35 B
208 B

55ms
55ms

Image
image/gif

52.210.54.130
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=idi&i=f1445727-1573-487d-b159-fc291ee88c2e
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 52.210.54.130 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-54-130.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:33 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

location: https://rtb.gumgum.com/usersync?b=idi&i=f1445727-1573-487d-b159-fc291ee88c2e
date: Sat, 22 Jan 2022 11:57:33 GMT
access-control-allow-origin: *
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

200

usersync
rtb.gumgum.com/ Frame 6C2C
Redirect Chain

https://sync.1rx.io/usersync2/floor6&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=726277119
https://sync.1rx.io/usersync/tradedesk/7a2bb36c-19a7-4c60-9c7a-3e335f72bd53
https://sync.targeting.unrulymedia.com/csync/RX-6d18e588-763d-4781-a1b8-adb04c7d462c-003?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3DRX-6d18e588-763d-4781-a1b8-adb04c7d462c-003
https://rtb.gumgum.com/usersync?b=rhy&i=RX-6d18e588-763d-4781-a1b8-adb04c7d462c-003

35 B
208 B

61ms
59ms

Image
image/gif

52.210.54.130
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=rhy&i=RX-6d18e588-763d-4781-a1b8-adb04c7d462c-003
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 52.210.54.130 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-54-130.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:33 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

location: https://rtb.gumgum.com/usersync?b=rhy&i=RX-6d18e588-763d-4781-a1b8-adb04c7d462c-003
date: Sat, 22 Jan 2022 11:57:33 GMT
server: Tengine
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RX6d18e588763d4781a1b8adb04c7d462c003
content-type: text/html

GET
H2

200

usersync
rtb.gumgum.com/ Frame 6C2C
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://rtb.gumgum.com/usersync?b=pln&i=8XoYDUXe7bw2&ev=1&pid=558355

35 B
208 B

55ms
55ms

Image
image/gif

52.210.54.130
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=pln&i=8XoYDUXe7bw2&ev=1&pid=558355
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 52.210.54.130 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-54-130.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 22 Jan 2022 11:57:33 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: it-IT
location: https://rtb.gumgum.com/usersync?b=pln&i=8XoYDUXe7bw2&ev=1&pid=558355
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-775b5b88b7-4hxfv
expires: -1

GET
H/1.1 200
OK sync
ssbsync.smartadserver.com/api/ Frame 6C2C 0
75 B 43ms
35ms Image
text/plain 185.86.138.120
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=15
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.138.120 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:32 GMT
content-length: 0

GET
H2 200 sync
ads.servenobid.com/ Frame 6C2C 0
358 B 53ms
52ms Image
image/avif 18.202.39.221
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=309&uid=e_56641a5a-dc1e-4d5d-b2c4-4205b18833f8
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.202.39.221 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-39-221.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 11:57:33 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame 8582
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2frtb.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
https://rtb.gumgum.com/usersync?b=mmh&i=e60e61eb-f12d-4100-8d91-fd962fb3ba97&gdpr=0&gdpr_consent=

35 B
208 B

98ms
83ms

Document
image/gif

52.210.54.130
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=mmh&i=e60e61eb-f12d-4100-8d91-fd962fb3ba97&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.210.54.130 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-54-130.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://g2.gumgum.com/

Response headers

date: Sat, 22 Jan 2022 11:57:33 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

Date: Sat, 22 Jan 2022 11:57:33 GMT
Content-Type: image/gif
Content-Length: 0
Connection: keep-alive
Keep-Alive: timeout=360
Access-Control-Allow-Origin: *
Server: MT3 4133 baa842e master cdg-pixel-x25 config:1.0.0
Cache-Control: no-cache
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://rtb.gumgum.com/usersync?b=mmh&i=e60e61eb-f12d-4100-8d91-fd962fb3ba97&gdpr=0&gdpr_consent=
Expires: Sat, 22 Jan 2022 11:57:32 GMT

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame 353E
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=&_test=YevxLQAAc79KuAAy
https://rtb.gumgum.com/usersync?b=atm&i=YevxLQAAc79KuAAy&gdpr=0&gdpr_consent=&_test=YevxLQAAc79KuAAy

35 B
208 B

55ms
55ms

Document
image/gif

52.210.54.130
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=atm&i=YevxLQAAc79KuAAy&gdpr=0&gdpr_consent=&_test=YevxLQAAc79KuAAy
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.210.54.130 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-54-130.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://g2.gumgum.com/

Response headers

date: Sat, 22 Jan 2022 11:57:33 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

server: Varnish
retry-after: 0
location: https://rtb.gumgum.com/usersync?b=atm&i=YevxLQAAc79KuAAy&gdpr=0&gdpr_consent=&_test=YevxLQAAc79KuAAy
accept-ranges: bytes
date: Sat, 22 Jan 2022 11:57:33 GMT
via: 1.1 varnish
x-served-by: cache-mxp6942-MXP
x-cache: HIT
x-cache-hits: 0
x-timer: S1642852654.645297,VS0,VE0
cache-control: no-cache
pragma: no-cache
content-length: 0

GET
H3 200 pixel Show response
cm.g.doubleclick.net/ Frame F0FB 170 B
188 B 43ms
42ms Document
image/png 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV81NjY0MWE1YS1kYzFlLTRkNWQtYjJjNC00MjA1YjE4ODMzZjg=&gdpr=0&gdpr_consent=

Requested by

Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://g2.gumgum.com/

Response headers

content-type: image/png
date: Sat, 22 Jan 2022 11:57:33 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
server: HTTP server (unknown)
content-length: 170
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 8E97 14 KB
5 KB 20ms
18ms Document
text/html 92.122.147.28
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 92.122.147.28 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-147-28.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://g2.gumgum.com/

Response headers

last-modified: Tue, 15 Jun 2021 06:08:03 GMT
etag: "1300708-3945-5c4c7cc02bd56"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5054
content-type: text/html; charset=UTF-8
cache-control: max-age=95578
expires: Sun, 23 Jan 2022 14:30:31 GMT
date: Sat, 22 Jan 2022 11:57:33 GMT
vary: Accept-Encoding

GET
H2 204 /
ssc-cms.33across.com/ps/ Frame 4EB1 0
0 405ms
127ms Document
text/plain 67.202.105.22
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc-cms.33across.com/ps/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.22 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip22.67-202-105.static.steadfastdns.net
Software: 33XP005 /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://g2.gumgum.com/

Response headers

x-33x-status: 2000208
server: 33XP005
date: Sat, 22 Jan 2022 11:57:33 GMT

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame 45B3
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=ttd&i=7a2bb36c-19a7-4c60-9c7a-3e335f72bd53&t=1645444653

35 B
208 B

82ms
82ms

Document
image/gif

52.210.54.130
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=ttd&i=7a2bb36c-19a7-4c60-9c7a-3e335f72bd53&t=1645444653
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.210.54.130 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-54-130.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://g2.gumgum.com/

Response headers

date: Sat, 22 Jan 2022 11:57:33 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

date: Sat, 22 Jan 2022 11:57:33 GMT
content-type: text/html
content-length: 209
location: https://rtb.gumgum.com/usersync?b=ttd&i=7a2bb36c-19a7-4c60-9c7a-3e335f72bd53&t=1645444653
cache-control: private,no-cache, must-revalidate
pragma: no-cache
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 23EB
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

281 B
554 B

47ms
47ms

Document
text/html

104.92.74.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.92.74.8 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-92-74-8.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://g2.gumgum.com/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
ETag: "402b2-119-5d32342a551c0"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Sat, 22 Jan 2022 11:57:33 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

server: AkamaiGHost
content-length: 0
location: https://eus.rubiconproject.com/usync.html?p=gumgum
date: Sat, 22 Jan 2022 11:57:33 GMT
access-control-allow-credentials: true
access-control-allow-origin: *

GET
H2 204 um
cs.emxdgt.com/ Frame B353 0
0 301ms
56ms Document
text/html 18.195.155.181
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cs.emxdgt.com/um?redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24UID
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.155.181 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-155-181.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://g2.gumgum.com/

Response headers

content-type: text/html
date: Sat, 22 Jan 2022 11:57:33 GMT
content-length: 0

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame E256
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=gumgum
https://rtb.gumgum.com/usersync?b=sus&i=YevxLsCo5s0AAG1RGuwAAAAA

35 B
208 B

58ms
57ms

Document
image/gif

52.210.54.130
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=sus&i=YevxLsCo5s0AAG1RGuwAAAAA
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.210.54.130 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-54-130.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://g2.gumgum.com/

Response headers

date: Sat, 22 Jan 2022 11:57:34 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

Server: nginx
Date: Sat, 22 Jan 2022 11:57:34 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private
Location: https://rtb.gumgum.com/usersync?b=sus&i=YevxLsCo5s0AAG1RGuwAAAAA
P3P: CP="See also http://www.scaleout.jp/privacy/"
X-SO-Ads-Time: 3
X-SO-HostName: a-ad40183.dc2p.scaleout.jp
X-SO-LB-Hostname: a-tgng40009.dc2p.scaleout.jp
X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":1,"gdpr":true,"ipv4":"0.0.0.0","key":"YevxLsCo5s0AAG1RGuwAAAAA","privacy_sensitive":true,"uid":"","upstream_id":"a-ad40183"}
X-SO-Key: YevxLsCo5s0AAG1RGuwAAAAA
X-SO-IP: 192.145.127.216
X-SO-Cluster-ID: 1
X-SO-Upstream-ID: a-ad40183

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame 818E
Redirect Chain

https://creativecdn.com/cm-notify?pi=gumgum
https://creativecdn.com/cm-notify?pi=gumgum&tc=1
https://rtb.gumgum.com/usersync?b=rth&i=0yXAO71TAz4s6pZiQAum&pi=gumgum&tc=1

35 B
208 B

55ms
55ms

Document
image/gif

52.210.54.130
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=rth&i=0yXAO71TAz4s6pZiQAum&pi=gumgum&tc=1
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.210.54.130 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-54-130.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://g2.gumgum.com/

Response headers

date: Sat, 22 Jan 2022 11:57:33 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

date: Sat, 22 Jan 2022 11:57:33 GMT Sat, 22 Jan 2022 11:57:33 GMT
location: https://rtb.gumgum.com/usersync?b=rth&i=0yXAO71TAz4s6pZiQAum&pi=gumgum&tc=1
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
content-length: 0

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 23EB 32 KB
10 KB 28ms
28ms Script
text/html 104.92.74.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.92.74.8 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-92-74-8.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: d3596b1c56113b0c34f24fa24b10ea60b24117474a15cac1d13f06eab561d508

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Sat, 22 Jan 2022 11:57:33 GMT
Content-Encoding: gzip
Last-Modified: Wed, 15 Dec 2021 23:04:16 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=59508
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9704
Expires: Sun, 23 Jan 2022 04:29:21 GMT

GET
H/1.1 204
No Content sync.php
pixel.rubiconproject.com/exchange/ Frame 23EB 0
239 B 26ms
26ms Image
image/gif 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&khaos=KYPS1TJN-T-JYSI
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 37b22a0c36bd84993dd2cda4a5e04b1d
Content-Type: image/gif

GET
H/1.1 200
OK crum
dsum-sec.casalemedia.com/ Frame E784 43 B
1 KB 46ms
46ms Image
image/gif 92.122.147.230
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=40&external_user_id=5d741dd2-1c98-4c2d-b636-a4ce21f0e3e3&expiration=1650628653
Requested by: Host: um2.eqads.com
URL: https://um2.eqads.com/um/cs&eq_cc=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 92.122.147.230 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-147-230.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://um2.eqads.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 22 Jan 2022 11:57:33 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sat, 22 Jan 2022 11:57:33 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 7108 0
735 B 32ms
32ms Script
text/html 185.33.221.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.90 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS