bitly.ws Open in urlscan Pro
185.11.100.204 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://bitly.ws/35Bod?redirect=35Bod
Effective URL:
https://bitly.ws/?banned=1
Submission: On January 11 via api (January 11th 2024, 4:23:25 pm UTC) from US — Scanned from US

Summary HTTP 166 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 21 IPs in 3 countries across 23 domains to perform 166 HTTP transactions. The main IP is 185.11.100.204, located in Poland and belongs to CF-KRK, PL. The main domain is bitly.ws. The Cisco Umbrella rank of the primary domain is 158367.
TLS certificate: Issued by R3 on November 20th 2023. Valid for: 3 months.

This is the only time bitly.ws was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
4 12	185.11.100.204 185.11.100.204	29522 (CF-KRK) (CF-KRK)
25	2607:f8b0:400... 2607:f8b0:4004:c0b::9a	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4004:c06::61	15169 (GOOGLE) (GOOGLE)
17	2607:f8b0:400... 2607:f8b0:4004:c06::65	15169 (GOOGLE) (GOOGLE)
1	192.229.210.155 192.229.210.155	15133 (EDGECAST) (EDGECAST)
1	2607:f8b0:400... 2607:f8b0:4004:c17::8a	15169 (GOOGLE) (GOOGLE)
1 20	2607:f8b0:400... 2607:f8b0:4004:c08::9b	15169 (GOOGLE) (GOOGLE)
6	2607:f8b0:400... 2607:f8b0:4004:c09::5e	15169 (GOOGLE) (GOOGLE)
4	2607:f8b0:400... 2607:f8b0:4004:c08::5f	15169 (GOOGLE) (GOOGLE)
22	2607:f8b0:400... 2607:f8b0:4004:c09::84	15169 (GOOGLE) (GOOGLE)
35	2607:f8b0:400... 2607:f8b0:4004:c08::95	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4004:c1d::5e	15169 (GOOGLE) (GOOGLE)
2 4	2607:f8b0:400... 2607:f8b0:4004:c1d::93	15169 (GOOGLE) (GOOGLE)
6 15	172.253.63.154 172.253.63.154	15169 (GOOGLE) (GOOGLE)
3 7	104.18.36.155 104.18.36.155	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4 6	68.67.160.76 68.67.160.76	29990 (ASN-APPNEX) (ASN-APPNEX)
4	142.251.167.148 142.251.167.148	() ()
1	52.23.209.187 52.23.209.187	() ()
2	172.253.115.155 172.253.115.155	() ()
2 2	104.66.251.81 104.66.251.81	() ()
1 1	151.101.2.49 151.101.2.49	() ()
2 2	35.244.154.8 35.244.154.8	() ()
1	74.119.119.150 74.119.119.150	() ()
1 1	54.210.237.164 54.210.237.164	() ()
1 1	35.186.193.173 35.186.193.173	() ()
1 1	20.121.97.20 20.121.97.20	() ()
166	21

12 185.11.100.204 (Poland) 4 redirects

ASN29522 (CF-KRK, PL)
PTR: v5103.vps.ogicom.net

bitly.ws	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mp.org.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 2607:f8b0:4004:c0b::9a (Ashburn, United States)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c06::61 (Washington, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2607:f8b0:4004:c06::65 (Washington, United States)

ASN15169 (GOOGLE, US)

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.229.210.155 (United States)

ASN15133 (EDGECAST, US)

www.paypalobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c17::8a (Washington, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2607:f8b0:4004:c08::9b (Ashburn, United States) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2607:f8b0:4004:c09::5e (Ashburn, United States)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4004:c08::5f (Ashburn, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 2607:f8b0:4004:c09::84 (Ashburn, United States)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

35 2607:f8b0:4004:c08::95 (Ashburn, United States)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c1d::5e (Washington, United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4004:c1d::93 (Washington, United States) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 172.253.63.154 (United States) 6 redirects

ASN15169 (GOOGLE, US)
PTR: bi-in-f154.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.18.36.155 (None, ) 3 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 68.67.160.76 (Jersey City, United States) 4 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.167.148 (None, )

ASN- ()

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.23.209.187 (None, )

ASN- ()

s.cdnsynd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.253.115.155 (None, )

ASN- ()

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.66.251.81 (None, ) 2 redirects

ASN- ()

px.owneriq.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.2.49 (None, ) 1 redirects

ASN- ()

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.154.8 (None, ) 2 redirects

ASN- ()

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.119.119.150 (None, )

ASN- ()

dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.210.237.164 (None, ) 1 redirects

ASN- ()

sync.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.193.173 (None, ) 1 redirects

ASN- ()

ius.ctnsnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 20.121.97.20 (None, ) 1 redirects

ASN- ()

www.temu.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
47	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 140 tpc.googlesyndication.com — Cisco Umbrella Rank: 185	578 KB
35	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 407	464 KB
35	doubleclick.net 7 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 68 cm.g.doubleclick.net — Cisco Umbrella Rank: 338 ad.doubleclick.net	197 KB
21	google.com 2 redirects fundingchoicesmessages.google.com — Cisco Umbrella Rank: 1187 www.google.com — Cisco Umbrella Rank: 6	133 KB
10	bitly.ws 2 redirects bitly.ws — Cisco Umbrella Rank: 158367	27 KB
8	gstatic.com www.gstatic.com fonts.gstatic.com	122 KB
7	casalemedia.com 3 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 1194	4 KB
6	adnxs.com 4 redirects ib.adnxs.com — Cisco Umbrella Rank: 356	6 KB
4	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 271	259 KB
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 115	8 KB
2	rlcdn.com 2 redirects id.rlcdn.com	922 B
2	owneriq.net 2 redirects px.owneriq.net	2 KB
2	googleadservices.com www.googleadservices.com
2	mp.org.pl 2 redirects mp.org.pl	478 B
1	temu.com 1 redirects www.temu.com	516 B
1	ctnsnet.com 1 redirects ius.ctnsnet.com	624 B
1	stackadapt.com 1 redirects sync.srv.stackadapt.com	1 KB
1	criteo.com dis.criteo.com	363 B
1	everesttech.net 1 redirects sync-tm.everesttech.net	544 B
1	cdnsynd.com s.cdnsynd.com	64 B
1	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 101	240 B
1	paypalobjects.com www.paypalobjects.com — Cisco Umbrella Rank: 2512	441 B
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 114	78 KB
166	23

	Domain	Requested by
35	s0.2mdn.net	bitly.ws googleads.g.doubleclick.net s0.2mdn.net
25	pagead2.googlesyndication.com	bitly.ws pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com s0.2mdn.net
22	tpc.googlesyndication.com	googleads.g.doubleclick.net bitly.ws tpc.googlesyndication.com s0.2mdn.net pagead2.googlesyndication.com
17	fundingchoicesmessages.google.com	bitly.ws pagead2.googlesyndication.com
16	googleads.g.doubleclick.net	1 redirects pagead2.googlesyndication.com googleads.g.doubleclick.net bitly.ws
15	cm.g.doubleclick.net	6 redirects googleads.g.doubleclick.net bitly.ws
10	bitly.ws	2 redirects bitly.ws
7	dsum-sec.casalemedia.com	3 redirects googleads.g.doubleclick.net
6	ib.adnxs.com	4 redirects googleads.g.doubleclick.net
6	www.gstatic.com	googleads.g.doubleclick.net
4	ad.doubleclick.net	bitly.ws
4	www.google.com	2 redirects googleads.g.doubleclick.net tpc.googlesyndication.com
4	www.googletagservices.com	googleads.g.doubleclick.net bitly.ws
4	fonts.googleapis.com	googleads.g.doubleclick.net s0.2mdn.net
2	id.rlcdn.com	2 redirects
2	px.owneriq.net	2 redirects
2	www.googleadservices.com	bitly.ws
2	fonts.gstatic.com	fonts.googleapis.com
2	mp.org.pl	2 redirects
1	www.temu.com	1 redirects
1	ius.ctnsnet.com	1 redirects
1	sync.srv.stackadapt.com	1 redirects
1	dis.criteo.com	googleads.g.doubleclick.net
1	sync-tm.everesttech.net	1 redirects
1	s.cdnsynd.com	bitly.ws
1	www.google-analytics.com	www.googletagmanager.com
1	www.paypalobjects.com	bitly.ws
1	www.googletagmanager.com	bitly.ws
166	28

This site contains links to these domains. Also see Links.

Domain
xy2.eu
tinyurl.mobi
www.buymeacoffee.com
buy.stripe.com

Subject Issuer	Validity	Valid
bitly.ws R3	`2023-11-20` - `2024-02-18`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
www.paypal.com DigiCert SHA2 Extended Validation Server CA	`2023-10-12` - `2024-10-31`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
cdnsynd.com R3	`2023-11-30` - `2024-02-28`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-01` - `2024-03-01`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh

This page contains 26 frames:

Primary Page: https://bitly.ws/?banned=1
Frame ID: 1792527A2441D2A094B19721512BCAEA
Requests: 35 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20240109/r20190131/zrt_lookup_fy2021.html
Frame ID: 2B13DC0E8F0C9106FF3ED80F6A0E6D8F
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-2614556310778759&output=html&adk=1812271804&adf=3025194257&lmt=1704990199&plat=3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fbitly.ws%2F%3Fbanned%3D1&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~3~4~6&aslcwct=150&asacwct=25&aslmct=0.5&asamct=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1704990199059&bpp=7&bdt=387&idt=231&shv=r20240109&mjsv=m202401020101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=557443233933&frm=20&pv=2&ga_vid=2262019.1704990199&ga_sid=1704990199&ga_hid=1335102134&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079266%2C31079715%2C31080265%2C42532523%2C44809531%2C44807405%2C31079717%2C95320894&oid=2&pvsid=130113169792481&tmod=925275663&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=260
Frame ID: B889B8CBA7307DA99C92D59CCD3D9B57
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-2614556310778759&output=html&h=200&slotname=1428154055&adk=624732521&adf=477754370&pi=t.ma~as.1428154055&w=1200&fwrn=4&lmt=1704990199&rafmt=11&format=1200x200&url=https%3A%2F%2Fbitly.ws%2F%3Fbanned%3D1&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1704990199135&bpp=17&bdt=463&idt=189&shv=r20240109&mjsv=m202401020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=557443233933&frm=20&pv=1&ga_vid=2262019.1704990199&ga_sid=1704990199&ga_hid=1335102134&ga_fc=1&rplot=4&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=415&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079266%2C31079715%2C31080265%2C42532523%2C44809531%2C44807405%2C31079717%2C95320894&oid=2&pvsid=130113169792481&tmod=925275663&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=204
Frame ID: 9E6E754F63700F3EBEC564094DB9F5B4
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-2614556310778759&output=html&h=280&adk=3809598800&adf=4061442901&pi=t.aa~a.1976031760~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1704990200&rafmt=1&to=qs&pwprc=2480099511&format=1200x280&url=https%3A%2F%2Fbitly.ws%2F%3Fbanned%3D1&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1704990200434&bpp=1&bdt=1761&idt=-M&shv=r20240109&mjsv=m202401020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x200&nras=2&correlator=557443233933&frm=20&pv=1&ga_vid=2262019.1704990199&ga_sid=1704990199&ga_hid=1335102134&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1630&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079266%2C31079715%2C31080265%2C42532523%2C44809531%2C44807405%2C31079717%2C95320894&oid=2&pvsid=130113169792481&tmod=925275663&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=8
Frame ID: 76DDB2299EB7353E96ADFE192A6F9D1F
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-2614556310778759&output=html&h=280&adk=3088186576&adf=3730911173&pi=t.aa~a.1976031760~rp.3&w=1200&fwrn=4&fwrnh=100&lmt=1704990200&rafmt=1&to=qs&pwprc=2480099511&format=1200x280&url=https%3A%2F%2Fbitly.ws%2F%3Fbanned%3D1&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1704990200434&bpp=1&bdt=1762&idt=-M&shv=r20240109&mjsv=m202401020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x200%2C1200x280&nras=3&correlator=557443233933&frm=20&pv=1&ga_vid=2262019.1704990199&ga_sid=1704990199&ga_hid=1335102134&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1300&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079266%2C31079715%2C31080265%2C42532523%2C44809531%2C44807405%2C31079717%2C95320894&oid=2&pvsid=130113169792481&tmod=925275663&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=19
Frame ID: DE9516B2B114D657F7C6553C4DEAB9E9
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-2614556310778759&output=html&h=90&adk=2743202993&adf=1893186479&pi=t.aa~a.1977423791~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1704990200&rafmt=1&to=qs&pwprc=2480099511&format=1200x90&url=https%3A%2F%2Fbitly.ws%2F%3Fbanned%3D1&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1704990200434&bpp=1&bdt=1762&idt=-M&shv=r20240109&mjsv=m202401020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x200%2C1200x280%2C1200x280&nras=4&correlator=557443233933&frm=20&pv=1&ga_vid=2262019.1704990199&ga_sid=1704990199&ga_hid=1335102134&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2393&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079266%2C31079715%2C31080265%2C42532523%2C44809531%2C44807405%2C31079717%2C95320894&oid=2&pvsid=130113169792481&tmod=925275663&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=34
Frame ID: 4D424BF6A36C3B5E868AC7868B20A0B4
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-2614556310778759&output=html&h=60&adk=273762757&adf=1414068304&pi=t.aa~a.1977424468~rp.2&w=1200&fwrn=4&fwrnh=100&lmt=1704990200&rafmt=1&to=qs&pwprc=2480099511&format=1200x60&url=https%3A%2F%2Fbitly.ws%2F%3Fbanned%3D1&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1704990200434&bpp=1&bdt=1762&idt=1&shv=r20240109&mjsv=m202401020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x200%2C1200x280%2C1200x280%2C1200x90&nras=5&correlator=557443233933&frm=20&pv=1&ga_vid=2262019.1704990199&ga_sid=1704990199&ga_hid=1335102134&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2533&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079266%2C31079715%2C31080265%2C42532523%2C44809531%2C44807405%2C31079717%2C95320894&oid=2&pvsid=130113169792481&tmod=925275663&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=45
Frame ID: F5FB5C34B1136FE8B0BB0CEE1A2CE719
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20240109/r20110914/zrt_lookup_fy2021.html?fsb=1
Frame ID: F619F953D25E96400C852D96862A792D
Requests: 6 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20240109/r20110914/zrt_lookup_fy2021.html?fsb=1
Frame ID: 279A73125C04291E55078ABDEA02C532
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 6DF2CF71C7E19ED0F3046BCD8637B797
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI_bi-MCEIi_pesCGK_b-dIBMAE&v=APEucNXAxCE4KqqJ4SBhfZP39tjeHCQfwygsK1P3JvUg4nq_HGCVUb7Kyy6dgONh0JiN10kZchmGyP2Q8ugdnMbbhtdm-PHEpzz0Gmem6YH5y1lkryhpHV0
Frame ID: E29D46B2059FF5C865FAFE453EAE5E9B
Requests: 5 HTTP requests in this frame

Frame: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js
Frame ID: 206B5E6B6352DE31D5EC1BD5A9455BA7
Requests: 12 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: E2A36424F9000B207E14DBB999EFFABF
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: B5BF5CA8F7912B9AE42C9F4CFC8D99C4
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: D36AB2AEA77C4E729B5F7AB8A7E61E9C
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKChoQIQyNKa_wEYzLbW4AEwAQ&v=APEucNUgBDJrfgEAlk74X5XXLh6Z-v5-MSNPRlAcwalrPhf2Bg9FENLLy6x3El2tH_EpFjM1s7GPlpLofBgoCGPfgZtzoKFLUcCkSBFclWIOOmfIgpvw5SM
Frame ID: 6CCF5CCF2FB7A82E5394CA7078643222
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20240109/r20110914/abg_lite_fy2021.js
Frame ID: 197DBEFE47B8D4E10DEF2F2AA0D2EC23
Requests: 13 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 5C7D219819F508DE1DABB6AC5F6B225D
Requests: 9 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
Frame ID: D7F863C230C262BD6216495B8C1C3AE0
Requests: 38 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: 344A11A92629A6E2140C1CABBE87489D
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/VucML-pZXNsV9Bio95In_Vy1g44u5uVv1Eq8Y-LPojk.js
Frame ID: 6179069B50EC925BC50A28E6271C0F18
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/VucML-pZXNsV9Bio95In_Vy1g44u5uVv1Eq8Y-LPojk.js
Frame ID: CA5E75F47F0075F56115DB0061511DEA
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/MCFrRHZE15CKjvM6RLwmjguI7mqh03m56A7oA9GJNi8.js
Frame ID: ED49EA3D1E041C6F96B30B18C7DE8C40
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: A84D98C14F1CBAAC5E099EE6048C37A1
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 0F990C05013354A5AE488CEBFC843178
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Bitly | URL Shortener

Page URL History Show full URLs

https://bitly.ws/35Bod?redirect=35Bod HTTP 301
https://bitly.ws/?redirect=35Bod HTTP 301
https://mp.org.pl/yt-redirect.php?banurl=https://gift.instawp.xyz/NDQmYW1wO2k9ODEzMzM= HTTP 302
http://mp.org.pl/yt-redirect.php?banurl=https://gift.instawp.xyz/NDQmYW1wO2k9ODEzMzM= HTTP 302
https://bitly.ws/?banned=1 Page URL

Detected technologies

PayPal (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

<input[^>]+_s-xclick
paypalobjects\.com

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

166
Requests

91 %
HTTPS

42 %
IPv6

23
Domains

28
Subdomains

21
IPs

3
Countries

1871 kB
Transfer

4905 kB
Size

28
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://xy2.eu/
Title: XY2

Search URL Search Domain Scan URL

URL: https://tinyurl.mobi/
Title: TinyURL

Search URL Search Domain Scan URL

URL: https://www.buymeacoffee.com/oconnel

Search URL Search Domain Scan URL

URL: https://buy.stripe.com/eVa8z88iQeWTaEUeUU

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://bitly.ws/35Bod?redirect=35Bod HTTP 301
https://bitly.ws/?redirect=35Bod HTTP 301
https://mp.org.pl/yt-redirect.php?banurl=https://gift.instawp.xyz/NDQmYW1wO2k9ODEzMzM= HTTP 302
http://mp.org.pl/yt-redirect.php?banurl=https://gift.instawp.xyz/NDQmYW1wO2k9ODEzMzM= HTTP 302
https://bitly.ws/?banned=1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 62

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 65

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMR9qeAe2S8ejhvHmQOFPMw&google_cver=1&gdpr=0

Request Chain 66

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZaAV.Yn6H9c8ApF42H99cQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMR9qeAe2S8ejhvHmQOFPMw&google_cver=1&google_hm=2

Request Chain 67

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0 HTTP 302
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEBDqN5MH4ZuuJOLyqawEajY&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26gdpr%3D0%26code%3DCAESEBDqN5MH4ZuuJOLyqawEajY%26google_cver%3D1

Request Chain 68

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDc3NDYyMTk0NDEwMzMwMzM2Nw%3D%3D

Request Chain 82

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 120

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMR9qeAe2S8ejhvHmQOFPMw&google_cver=1&gdpr=0

Request Chain 121

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZaAV.Yn6H9c8ApF42H99cQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMR9qeAe2S8ejhvHmQOFPMw&google_cver=1&google_hm=2

Request Chain 122

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0 HTTP 302
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEBDqN5MH4ZuuJOLyqawEajY&google_cver=1

Request Chain 123

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDc3NDYyMTk0NDEwMzMwMzM2Nw%3D%3D

Request Chain 125

https://googleads.g.doubleclick.net/pagead/adview?ai=CY1L-9xWgZZXSH47wvPIPsOmg2Azyx8qddN3znJGwEezI__jbKRABIKyQlQJgyYaAgNyjxBCgAffLuMICyAEBqQKHziYVEOBJPqgDAcgDywSqBMQBT9AhsIVMPlvZtBFqMM_L3CNVKFh_TmYf_KpZAYML0WIy5inse2vvDzwNKwSxFYyMcy15u9IB7TbSBR0cRERCEP1-psiC_fpo3J06rEbLgfKabKWsRab8FCuu2orfORH3PywwhIj9xJKOfe4399SQflDrfyjUsMY61GfnPeMxeerNyBD-YC_3lDBv9gyAnA_y7mQiFqj2KHy2FIIfUiKH7RGOtZm2VEP0rWLWwdEsUgnVu8Of6DMDq7Cql58gQtuk0FhWxcAEzc-Lu9wDiAXV-5CeN5IFBAgEGAGSBQQIBRgEgAfxs8e9AagH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcFEJaWmgHSCB8IgGEQARgfMgKKAjoEgECAQEi9_cE6WKeQwLnf1YMDmglQaHR0cHM6Ly93d3cubWFuYWdlZW5naW5lLmNvbS9wcm9kdWN0cy9zZXJ2aWNlLWRlc2svbHAvc2VydmljZS1kZXNrLXNvbHV0aW9uLmh0bWyACgHICwHaDBAKChCAq_ncpc2G3FsSAgED2BMCiBQE0BUBmBYBgBcBshccChoIABIUcHViLTI2MTQ1NTYzMTA3Nzg3NTkYAA&sigh=CcA2fZLuawA&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTgAvHhf_QHIoYXSdp6hmu4ZRT6K_Mk8ll07HIwqevYuqD6yYW_lTW2S0M2vKovPsAt5sRV62pQYcFszCiiLmPmPQAcbwXbY6CsCxjzdBmhgB&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xa9fd7ae5903347ec0000000000000000%22,%222%22:%220x1dfb4d4d6ff8ac910000000000000000%22,%223%22:%220xe090e9fa9135d53b0000000000000000%22,%224%22:%220xd911e83a3e6e5eb0000000000000000%22,%225%22:%220xc847bfca177f9bbd0000000000000000%22},%22debug_key%22:%228174411223427533127%22,%22debug_reporting%22:true,%22destination%22:%22https://manageengine.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22676210167%22],%2222%22:[%22true%22],%224%22:[%2201-11%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%228528035573150701793%22}&andc=true

Request Chain 126

https://px.owneriq.net/ecmg?google_gid=CAESEKmxCjqaX6Dy8xcyE7CCzuY&google_cver=1&google_push=AXcoOmTsZOxk1A_ekBVhhd_gLJOMg4xYaXIunE-WVqQOCF6kwWNX9AXZ9ljlTVYYBSGGCKxZcGYOMGHLlnpgPuFok2ibidCR5O1JiCo HTTP 302
https://px.owneriq.net/ecc?redir=https%3a%2f%2fcm.g.doubleclick.net%2fpixel%3fgoogle_nid%3downeriq1%26google_sc%26google_push%3dAXcoOmTsZOxk1A_ekBVhhd_gLJOMg4xYaXIunE-WVqQOCF6kwWNX9AXZ9ljlTVYYBSGGCKxZcGYOMGHLlnpgPuFok2ibidCR5O1JiCo%26google_cver%3d1%26google_gid%3dCAESEKmxCjqaX6Dy8xcyE7CCzuY%26google_hm%3dUTc1ODI3NjYwMjE5NTAzNDEzMDU%3d&uid=Q7582766021950341305&ref=%2Fecmg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=owneriq1&google_sc&google_push=AXcoOmTsZOxk1A_ekBVhhd_gLJOMg4xYaXIunE-WVqQOCF6kwWNX9AXZ9ljlTVYYBSGGCKxZcGYOMGHLlnpgPuFok2ibidCR5O1JiCo&google_cver=1&google_gid=CAESEKmxCjqaX6Dy8xcyE7CCzuY&google_hm=UTc1ODI3NjYwMjE5NTAzNDEzMDU=

Request Chain 127

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESEKjTBl5EYuR9xtg65F-PBNA&google_cver=1&google_push=AXcoOmSLFcHR_o0nWQpsw1YBo00mDrGGFhbVMX0mroe9We_K27DRLTw9-gNjHRwwbVSNGZv6akX78jGDavfyoyQX1db-mjb9H7zcP8Q HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEKjTBl5EYuR9xtg65F-PBNA&google_push=AXcoOmSLFcHR_o0nWQpsw1YBo00mDrGGFhbVMX0mroe9We_K27DRLTw9-gNjHRwwbVSNGZv6akX78jGDavfyoyQX1db-mjb9H7zcP8Q

Request Chain 128

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAXcoOmS1_T5non4d3Ix7uonedETIUQnszOP165KJtmxWwJHxoNpAVIpx0gT3F6vWwptvO493fMXL0cqL4Zj3RgkPjqJ3IA6ry4AVDrg&google_gid=CAESEIH7qyhJIGYh-dTcZ7OTD2Q&google_cver=1 HTTP 307
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCPqrgK0GEgUI6AcQAEIASnNnb29nbGVfcHVzaD1BWGNvT21TMV9UNW5vbjRkM0l4N3VvbmVkRVRJVVFuc3pPUDE2NUtKdG14V3dKSHhvTnBBVklweDBnVDNGNnZXd3B0dk80OTNmTVhMMGNxTDRaajNSZ2tQanFKM0lBNnJ5NEFWRHJn HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcweFBiZVhzaUE1Q0VuTWF6SEdDb0RoWWhKdEF6N3FYcjRBMXNfbFZZeXE3bw==&google_push

Request Chain 130

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEEfzY_PJVqFTbdnRTwelqKQ&google_cver=1&google_push=AXcoOmTPza0IwaSb-hAEl0IemLX75YHvHUijlygldz5SGyFSnsUuLR_ddT0Y6frKAOByRptzg2Ft2rRDnCFEHY2N1lLA1nwfvyvTUuc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=8MRf7x0jVxh0e86Ka1U9ZCaEdk0&google_push=AXcoOmTPza0IwaSb-hAEl0IemLX75YHvHUijlygldz5SGyFSnsUuLR_ddT0Y6frKAOByRptzg2Ft2rRDnCFEHY2N1lLA1nwfvyvTUuc

Request Chain 131

https://ius.ctnsnet.com/int/cm?exc=1&acc=crimtan_holdings_limited&google_gid=CAESEGobCHrMfWt1mYzT8kBC1vU&google_cver=1&google_push=AXcoOmTXktLUPGC27gjTGyxCACvNxPHUMDUQ6b_ieeXlJq-6TIm4jYwYcP_34t2nK5Dfgw0-K-bXYBCN4lIWuuTgjrA1P7DLPftX5RM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AXcoOmTXktLUPGC27gjTGyxCACvNxPHUMDUQ6b_ieeXlJq-6TIm4jYwYcP_34t2nK5Dfgw0-K-bXYBCN4lIWuuTgjrA1P7DLPftX5RM&google_hm=dxQNFjq9TPmmA940Qfgwok0

Request Chain 132

https://www.temu.com/api/adx/cm/pixel?google_gid=CAESENn4P5HCvLfuMRJs3UXbtJk&google_cver=1&google_push=AXcoOmQzV59nDUQ3KEn2Z6LuLR_HBcRZp3_HY9F8WtORV9C9_tnwcjK6ol3W3csIz1Q9BKrD-SwIGthdrxGKD_qvEY2zPDOlpoXv5rM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1371970550&google_push=AXcoOmQzV59nDUQ3KEn2Z6LuLR_HBcRZp3_HY9F8WtORV9C9_tnwcjK6ol3W3csIz1Q9BKrD-SwIGthdrxGKD_qvEY2zPDOlpoXv5rM

166 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
bitly.ws/
Redirect Chain

https://bitly.ws/35Bod?redirect=35Bod
https://bitly.ws/?redirect=35Bod
https://mp.org.pl/yt-redirect.php?banurl=https://gift.instawp.xyz/NDQmYW1wO2k9ODEzMzM=
http://mp.org.pl/yt-redirect.php?banurl=https://gift.instawp.xyz/NDQmYW1wO2k9ODEzMzM=
https://bitly.ws/?banned=1

12 KB
5 KB

192ms
191ms

Document
text/html

185.11.100.204
CF-KRK

General

Check archive.org

Show headers Download Go to

Full URL: https://bitly.ws/?banned=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.11.100.204 , Poland, ASN29522 (CF-KRK, PL),
Reverse DNS: v5103.vps.ogicom.net
Software: Apache / PHP/5.5.38
Resource Hash: 369ee07f1efb77d297d3bce2b4aaf066c676255b2e9d026d9d3768d63a150499

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=0
content-encoding: gzip
content-type: text/html
date: Thu, 11 Jan 2024 16:23:18 GMT
expires: Thu, 11 Jan 2024 16:23:18 GMT
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/5.5.38

Redirect headers

cache-control: max-age=0
content-length: 0
content-type: text/html
date: Thu, 11 Jan 2024 16:23:18 GMT
expires: Thu, 11 Jan 2024 16:23:18 GMT
location: https://bitly.ws?banned=1
server: Apache
x-powered-by: PHP/5.5.38

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 148 KB
51 KB 222ms
107ms Script
text/javascript 2607:f8b0:4004:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

de1b97b2acff4d32e41cff57769e87f175e01ba52dbc8448f82172eea2969e54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:18 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51537
x-xss-protection: 0
server: cafe
etag: 9707834764357911621
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Thu, 11 Jan 2024 16:23:18 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 218 KB
78 KB 184ms
68ms Script
application/javascript 2607:f8b0:4004:c06::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-8Q1W6PKNCX

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f2f3806a938e3c386f41670b854e5e10f7e5f5382727ec8e601f1909f7072087

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:18 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 79270
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 11 Jan 2024 16:23:18 GMT

GET
H2 200 pub-2614556310778759 Show response
fundingchoicesmessages.google.com/i/ 182 KB
61 KB 217ms
95ms Script
application/javascript 2607:f8b0:4004:c06::65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/pub-2614556310778759?ers=1

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

adce4b2a52b21394dde912da1339a634858804494faade9cab2b7fa67333606f

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-YO00ESxKpRIHG9GuZumSXw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:18 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-YO00ESxKpRIHG9GuZumSXw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 style.css
bitly.ws/css/ 11 KB
3 KB 337ms
335ms Stylesheet
text/css 185.11.100.204
CF-KRK

General

Check archive.org

Show headers Download Go to

Full URL: https://bitly.ws/css/style.css
Requested by: Host: bitly.ws
URL: https://bitly.ws/?banned=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.11.100.204 , Poland, ASN29522 (CF-KRK, PL),
Reverse DNS: v5103.vps.ogicom.net
Software: Apache /
Resource Hash: b11dc47889de3326bebc34326b08c225799df4a275b28db686c6e3482b3f4bd7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bitly.ws/?banned=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:18 GMT
content-encoding: gzip
last-modified: Wed, 27 Dec 2023 14:06:38 GMT
server: Apache
etag: "2a1c-60d7e4eba09c9-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=0
accept-ranges: bytes
content-length: 2516
expires: Thu, 11 Jan 2024 16:23:18 GMT

GET
H2 200 adframe.js Show response
bitly.ws/js/ 16 B
211 B 336ms
334ms Script
application/javascript 185.11.100.204
CF-KRK

General

Check archive.org

Show headers Download Go to

Full URL: https://bitly.ws/js/adframe.js
Requested by: Host: bitly.ws
URL: https://bitly.ws/?banned=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.11.100.204 , Poland, ASN29522 (CF-KRK, PL),
Reverse DNS: v5103.vps.ogicom.net
Software: Apache /
Resource Hash: 0059cb4ff0a271382c38af8a7367aaf45cbeb31449637d3928d25317401e2828

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bitly.ws/?banned=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:18 GMT
last-modified: Sat, 30 Dec 2017 21:02:30 GMT
server: Apache
etag: "10-5619511402320"
content-type: application/javascript
cache-control: max-age=0
accept-ranges: bytes
content-length: 16
expires: Thu, 11 Jan 2024 16:23:18 GMT

GET
H2 200 paypal.jpg
bitly.ws/gfx/ 9 KB
9 KB 170ms
169ms Image
image/jpeg 185.11.100.204
CF-KRK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bitly.ws/gfx/paypal.jpg
Requested by: Host: bitly.ws
URL: https://bitly.ws/?banned=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.11.100.204 , Poland, ASN29522 (CF-KRK, PL),
Reverse DNS: v5103.vps.ogicom.net
Software: Apache /
Resource Hash: 1ae6619173f92af4f0201b7204322213c714b56df437aa7d6482a1c141d5337c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bitly.ws/?banned=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:18 GMT
last-modified: Tue, 02 Jan 2018 13:00:56 GMT
server: Apache
etag: "2204-561cab086d14b"
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 8708
expires: Fri, 10 Jan 2025 16:23:18 GMT

GET
H2 200 paypal.png
bitly.ws/gfx/ 5 KB
6 KB 334ms
333ms Image
image/png 185.11.100.204
CF-KRK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bitly.ws/gfx/paypal.png
Requested by: Host: bitly.ws
URL: https://bitly.ws/?banned=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.11.100.204 , Poland, ASN29522 (CF-KRK, PL),
Reverse DNS: v5103.vps.ogicom.net
Software: Apache /
Resource Hash: 675f6b6dc673aae01f8ef949697ee544c8df8574ca090a4dd690776ec6e442ea

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bitly.ws/?banned=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:18 GMT
last-modified: Tue, 02 Jan 2018 13:00:54 GMT
server: Apache
etag: "158c-561cab06562ce"
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 5516
expires: Fri, 10 Jan 2025 16:23:18 GMT

GET
H2 200 pixel.gif
www.paypalobjects.com/pl_PL/i/scr/ 43 B
441 B 125ms
28ms Image
image/gif 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paypalobjects.com/pl_PL/i/scr/pixel.gif

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (mic/9B64) /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:18 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-cache: HIT
paypal-debug-id: 3ddeb05243326
dc: ccg11-origin-www-1.paypal.com
content-length: 43
last-modified: Fri, 16 Aug 2019 04:57:41 GMT
server: ECAcc (mic/9B64)
traceparent: 00-00000000000000000003ddeb05243326-c0390848ad1539d2-01
etag: "5d5637c5-2b"
content-type: image/gif
cache-control: s-maxage=31536000, public,max-age=3600
accept-ranges: bytes
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
expires: Thu, 11 Jan 2024 17:23:18 GMT

GET
H2 200 bmac.png
bitly.ws/gfx/ 3 KB
3 KB 310ms
294ms Image
image/png 185.11.100.204
CF-KRK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bitly.ws/gfx/bmac.png
Requested by: Host: bitly.ws
URL: https://bitly.ws/?banned=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.11.100.204 , Poland, ASN29522 (CF-KRK, PL),
Reverse DNS: v5103.vps.ogicom.net
Software: Apache /
Resource Hash: 54339f1c8cb089c05773b2b18fd5da6e702956decbf7dea6ef0348a64203c657

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bitly.ws/?banned=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:18 GMT
last-modified: Sat, 19 Aug 2023 15:45:47 GMT
server: Apache
etag: "c86-6034889f203e4"
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 3206
expires: Fri, 10 Jan 2025 16:23:18 GMT

GET
H2 200 stripe.png
bitly.ws/gfx/ 1 KB
2 KB 303ms
295ms Image
image/png 185.11.100.204
CF-KRK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bitly.ws/gfx/stripe.png
Requested by: Host: bitly.ws
URL: https://bitly.ws/?banned=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.11.100.204 , Poland, ASN29522 (CF-KRK, PL),
Reverse DNS: v5103.vps.ogicom.net
Software: Apache /
Resource Hash: b8214bd5cbd9197f329d1df98d908dc7a1cd38c28e8010b92e49b3f35dd9986a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bitly.ws/?banned=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:18 GMT
last-modified: Sat, 19 Aug 2023 15:45:50 GMT
server: Apache
etag: "54f-603488a24201d"
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 1359
expires: Fri, 10 Jan 2025 16:23:18 GMT

GET
H2 200 bitly-chart.png
bitly.ws/gfx/ 210 B
400 B 311ms
295ms Image
image/png 185.11.100.204
CF-KRK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bitly.ws/gfx/bitly-chart.png
Requested by: Host: bitly.ws
URL: https://bitly.ws/?banned=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.11.100.204 , Poland, ASN29522 (CF-KRK, PL),
Reverse DNS: v5103.vps.ogicom.net
Software: Apache /
Resource Hash: c28530634cdfc14bb5c068fc74a7071f9e27fc97f9aa03a1258f5b33f9c8ab6d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bitly.ws/?banned=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:18 GMT
last-modified: Tue, 02 Jan 2018 13:00:56 GMT
server: Apache
etag: "d2-561cab088ec59"
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 210
expires: Fri, 10 Jan 2025 16:23:18 GMT

POST
H2 204 collect
www.google-analytics.com/g/ 0
240 B 166ms
60ms Ping
text/plain 2607:f8b0:4004:c17::8a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-8Q1W6PKNCX&gtm=45je4180v9119634474&_p=1704990198702&gcd=11l1l1l1l1&dma=0&cid=2262019.1704990199&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1704990199&sct=1&seg=0&dl=https%3A%2F%2Fbitly.ws%2F%3Fbanned%3D1&dt=Bitly%20%7C%20URL%20Shortener&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=2663
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-8Q1W6PKNCX
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c17::8a Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:19 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://bitly.ws
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401020101/ 403 KB
136 KB 104ms
103ms Script
text/javascript 2607:f8b0:4004:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401020101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

aacb998495fd8dbb90f9a3297e6545b3bc62f9380fdb4e5b2594ee3544805801

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:19 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 139401
x-xss-protection: 0
server: cafe
etag: 5237485272836335145
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Jan 2024 16:23:19 GMT

GET
H2 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240109/r20190131/ Frame 2B13 9 KB
4 KB 167ms
56ms Document
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240109/r20190131/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e93b8c0ae5b5910b7107c8b455eda029935c56efa8de0be2443d8eabba207197

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bitly.ws/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 62217
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4173
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 10 Jan 2024 23:06:22 GMT
etag: 9219409622527106327
expires: Wed, 24 Jan 2024 23:06:22 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 AGSKWxV_gTKVpO9Y46ULCvTSKta-y2qM6J6m37CaNZTaoye7i762j-OmeGaPWBYbdnD1yCk4PsC_Zv0bpl5TSnYm-lSLX_N40rffls4M6dyoW9IOErMuYB423S8GdwCYv8yf8vCavWUicA== Show response
fundingchoicesmessages.google.com/f/ 12 KB
6 KB 87ms
86ms Script
application/javascript 2607:f8b0:4004:c06::65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxV_gTKVpO9Y46ULCvTSKta-y2qM6J6m37CaNZTaoye7i762j-OmeGaPWBYbdnD1yCk4PsC_Zv0bpl5TSnYm-lSLX_N40rffls4M6dyoW9IOErMuYB423S8GdwCYv8yf8vCavWUicA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzA0OTkwMTk5LDEzMTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9iaXRseS53cy8iLG51bGwsW1s4LCIwZ05ObWRPM3ZnUSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdXV0

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.0gNNmdO3vgQ.es5.O/am=wA/d=1/rs=AJlcJMz2Me5VRzmgipKAl6Yl4-bTHdpcAQ/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a577e10a3a46838e76353daf77921010aef6fbaf01fbd4867ad39b7a2466f9c5

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-0AsOlUixSXaSpzYW0Gckig' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:19 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-0AsOlUixSXaSpzYW0Gckig' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame B889 328 KB
92 KB 712ms
709ms Document
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-2614556310778759&output=html&adk=1812271804&adf=3025194257&lmt=1704990199&plat=3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fbitly.ws%2F%3Fbanned%3D1&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~3~4~6&aslcwct=150&asacwct=25&aslmct=0.5&asamct=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1704990199059&bpp=7&bdt=387&idt=231&shv=r20240109&mjsv=m202401020101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=557443233933&frm=20&pv=2&ga_vid=2262019.1704990199&ga_sid=1704990199&ga_hid=1335102134&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079266%2C31079715%2C31080265%2C42532523%2C44809531%2C44807405%2C31079717%2C95320894&oid=2&pvsid=130113169792481&tmod=925275663&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=260

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401020101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

92d0d73346c5979ecc715fb56b82d9467b8b227feb7a554115e01615a3812888

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bitly.ws/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 94330
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 Jan 2024 16:23:20 GMT
expires: Thu, 11 Jan 2024 16:23:20 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 9E6E 128 KB
42 KB 823ms
821ms Document
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-2614556310778759&output=html&h=200&slotname=1428154055&adk=624732521&adf=477754370&pi=t.ma~as.1428154055&w=1200&fwrn=4&lmt=1704990199&rafmt=11&format=1200x200&url=https%3A%2F%2Fbitly.ws%2F%3Fbanned%3D1&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1704990199135&bpp=17&bdt=463&idt=189&shv=r20240109&mjsv=m202401020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=557443233933&frm=20&pv=1&ga_vid=2262019.1704990199&ga_sid=1704990199&ga_hid=1335102134&ga_fc=1&rplot=4&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=415&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079266%2C31079715%2C31080265%2C42532523%2C44809531%2C44807405%2C31079717%2C95320894&oid=2&pvsid=130113169792481&tmod=925275663&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=204

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401020101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e8a46037aede54df0aa9423e7beda6f4f46522d2df33f21cd48aa9b5eddc39a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bitly.ws/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 43302
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 Jan 2024 16:23:20 GMT
expires: Thu, 11 Jan 2024 16:23:20 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 px.gif
fundingchoicesmessages.google.com/img/ 43 B
68 B 77ms
77ms Image
image/gif 2607:f8b0:4004:c06::65
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fundingchoicesmessages.google.com/img/px.gif?ch=1&rn=0.6275781692557991

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport, script-src 'report-sample' 'nonce--2YR6FNlNLNu1G5_FpG6Bg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:20 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport, script-src 'report-sample' 'nonce--2YR6FNlNLNu1G5_FpG6Bg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 px.gif
fundingchoicesmessages.google.com/img/ 43 B
68 B 76ms
76ms Image
image/gif 2607:f8b0:4004:c06::65
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fundingchoicesmessages.google.com/img/px.gif?ch=2&rn=3.845532132363819

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-cugK5b3OdLcT7wJNboACrg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:20 GMT
content-security-policy: script-src 'report-sample' 'nonce-cugK5b3OdLcT7wJNboACrg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 4b0ef9dfa83525e0607f42119c034d23.js Show response
www.gstatic.com/mysidia/ Frame 9E6E 9 KB
4 KB 186ms
53ms Script
text/javascript 2607:f8b0:4004:c09::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/4b0ef9dfa83525e0607f42119c034d23.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-2614556310778759&output=html&h=200&slotname=1428154055&adk=624732521&adf=477754370&pi=t.ma~as.1428154055&w=1200&fwrn=4&lmt=1704990199&rafmt=11&format=1200x200&url=https%3A%2F%2Fbitly.ws%2F%3Fbanned%3D1&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1704990199135&bpp=17&bdt=463&idt=189&shv=r20240109&mjsv=m202401020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=557443233933&frm=20&pv=1&ga_vid=2262019.1704990199&ga_sid=1704990199&ga_hid=1335102134&ga_fc=1&rplot=4&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=415&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079266%2C31079715%2C31080265%2C42532523%2C44809531%2C44807405%2C31079717%2C95320894&oid=2&pvsid=130113169792481&tmod=925275663&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=204

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

97c530c44249746307c2b01b37eed0f53757d139bc4243798f468c71da9844da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Wed, 10 Jan 2024 08:19:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 115434
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4079
x-xss-protection: 0
last-modified: Fri, 05 Jan 2024 00:56:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 09 Apr 2024 08:19:26 GMT

GET
H2 200 67b2cf2770e31c0fa9735c0b8b540980.js Show response
www.gstatic.com/mysidia/ Frame 9E6E 11 KB
5 KB 187ms
55ms Script
text/javascript 2607:f8b0:4004:c09::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/67b2cf2770e31c0fa9735c0b8b540980.js?tag=text/vanilla_highlight_ms

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

559ed27b48f52ad1c65466a95a120b8264f7dea4a23d31f2ebb3b5beca3321f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Wed, 10 Jan 2024 09:45:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 110270
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4763
x-xss-protection: 0
last-modified: Fri, 05 Jan 2024 00:56:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 09 Apr 2024 09:45:30 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 9E6E 14 KB
2 KB 193ms
61ms Stylesheet
text/css 2607:f8b0:4004:c08::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::5f Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 11 Jan 2024 16:23:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 11 Jan 2024 14:44:09 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 11 Jan 2024 16:23:20 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240109/r20110914/client/ Frame 9E6E 2 KB
875 B 65ms
64ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240109/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Wed, 10 Jan 2024 23:02:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 62461
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 24 Jan 2024 23:02:19 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240109/r20110914/ Frame 9E6E 23 KB
9 KB 64ms
63ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240109/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

428f4d59e61cdf9887ad4cd7c4592a24b214d2d9c0ba09db01c4cfde66a3cd11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Wed, 10 Jan 2024 23:02:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 62461
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9276
x-xss-protection: 0
server: cafe
etag: 3558958386372919956
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 24 Jan 2024 23:02:19 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240109/r20110914/client/ Frame 9E6E 3 KB
1 KB 58ms
56ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240109/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 06:43:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 34765
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 Jan 2024 06:43:55 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240109/r20110914/client/ Frame 9E6E 20 KB
9 KB 184ms
52ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d58acf16b5e4521c9eb24fe9fd97308e5f8be1297e4b63a547e5b610611799ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 06:43:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 34766
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8492
x-xss-protection: 0
server: cafe
etag: 9878124937798820110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 Jan 2024 06:43:54 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9E6E 205 KB
65 KB 57ms
55ms Script
text/javascript 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ed88d5a1c97dc43c114c0b289b3b5abf077be44e8e8765a9ad777f94af433411

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66227
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1704891455226136"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 11 Jan 2024 16:23:20 GMT

GET
H2 200 4cee352c918c506f58256258d534a665.js Show response
www.gstatic.com/mysidia/ Frame 9E6E 37 KB
15 KB 56ms
54ms Script
text/javascript 2607:f8b0:4004:c09::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/4cee352c918c506f58256258d534a665.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e6b20a1535a6d3ca3d7a611ae199a6f4b464e0b67b450379ed43a7ef3e66957c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Wed, 10 Jan 2024 08:16:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 115624
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15452
x-xss-protection: 0
last-modified: Fri, 05 Jan 2024 00:56:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 09 Apr 2024 08:16:16 GMT

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401020101/ 161 KB
55 KB 79ms
78ms Script
text/javascript 2607:f8b0:4004:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401020101/reactive_library_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401020101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bca23272d45ca793486169369bdcde8ff1258b0b932c86ebc0f2fad2556c990b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:20 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56255
x-xss-protection: 0
server: cafe
etag: 6996140512848534585
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Jan 2024 16:23:20 GMT

GET
H3 200 ca-pub-2614556310778759 Show response
fundingchoicesmessages.google.com/i/ 183 KB
60 KB 91ms
90ms Script
application/javascript 2607:f8b0:4004:c06::65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/ca-pub-2614556310778759?ers=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401020101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

21ee655039db952f817a7f32a080a0e198ff8d0e568d0fda13ba14602efd283c

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-UBaTSHriVghRhInRqTqx9A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:20 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-UBaTSHriVghRhInRqTqx9A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxXTC8aXmCtUWSCovQuVLoVubgUAay_ElS_WUidA2tuZd-NZOnu5HTxsRrvrY8EwDkZ86hqC-s7WqmK34SE0Og2U8b9Xg4SQyiRdf5Y8isPkR7X1Zs7zUGxAFnzGzEol3mpRqEdUBw== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 173ms
68ms XHR
text/html 2607:f8b0:4004:c06::65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXTC8aXmCtUWSCovQuVLoVubgUAay_ElS_WUidA2tuZd-NZOnu5HTxsRrvrY8EwDkZ86hqC-s7WqmK34SE0Og2U8b9Xg4SQyiRdf5Y8isPkR7X1Zs7zUGxAFnzGzEol3mpRqEdUBw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-5Du_WFMaYNpUqIl9tD_6NQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://bitly.ws/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 11 Jan 2024 16:23:20 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-5Du_WFMaYNpUqIl9tD_6NQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://bitly.ws
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 76DD 712 B
380 B 352ms
350ms Document
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-2614556310778759&output=html&h=280&adk=3809598800&adf=4061442901&pi=t.aa~a.1976031760~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1704990200&rafmt=1&to=qs&pwprc=2480099511&format=1200x280&url=https%3A%2F%2Fbitly.ws%2F%3Fbanned%3D1&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1704990200434&bpp=1&bdt=1761&idt=-M&shv=r20240109&mjsv=m202401020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x200&nras=2&correlator=557443233933&frm=20&pv=1&ga_vid=2262019.1704990199&ga_sid=1704990199&ga_hid=1335102134&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1630&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079266%2C31079715%2C31080265%2C42532523%2C44809531%2C44807405%2C31079717%2C95320894&oid=2&pvsid=130113169792481&tmod=925275663&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=8

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401020101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b56fa83d9b2a2533d3111a4b1ff790588ceef64fbe3cb03bb0120f2719d1c5d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bitly.ws/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 355
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 Jan 2024 16:23:20 GMT
expires: Thu, 11 Jan 2024 16:23:20 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame DE95 712 B
380 B 463ms
456ms Document
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-2614556310778759&output=html&h=280&adk=3088186576&adf=3730911173&pi=t.aa~a.1976031760~rp.3&w=1200&fwrn=4&fwrnh=100&lmt=1704990200&rafmt=1&to=qs&pwprc=2480099511&format=1200x280&url=https%3A%2F%2Fbitly.ws%2F%3Fbanned%3D1&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1704990200434&bpp=1&bdt=1762&idt=-M&shv=r20240109&mjsv=m202401020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x200%2C1200x280&nras=3&correlator=557443233933&frm=20&pv=1&ga_vid=2262019.1704990199&ga_sid=1704990199&ga_hid=1335102134&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1300&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079266%2C31079715%2C31080265%2C42532523%2C44809531%2C44807405%2C31079717%2C95320894&oid=2&pvsid=130113169792481&tmod=925275663&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=19

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401020101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b8e20420db3d0e7e5ac332949e7ca3d380edeea32cfadf677b25944362011dc7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bitly.ws/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 355
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 Jan 2024 16:23:20 GMT
expires: Thu, 11 Jan 2024 16:23:20 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 4D42 109 KB
45 KB 413ms
405ms Document
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-2614556310778759&output=html&h=90&adk=2743202993&adf=1893186479&pi=t.aa~a.1977423791~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1704990200&rafmt=1&to=qs&pwprc=2480099511&format=1200x90&url=https%3A%2F%2Fbitly.ws%2F%3Fbanned%3D1&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1704990200434&bpp=1&bdt=1762&idt=-M&shv=r20240109&mjsv=m202401020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x200%2C1200x280%2C1200x280&nras=4&correlator=557443233933&frm=20&pv=1&ga_vid=2262019.1704990199&ga_sid=1704990199&ga_hid=1335102134&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2393&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079266%2C31079715%2C31080265%2C42532523%2C44809531%2C44807405%2C31079717%2C95320894&oid=2&pvsid=130113169792481&tmod=925275663&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=34

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401020101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cd21760834bc90538beefd492d28298f5b2232c200b3b7dc288d35facfbfdbe5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bitly.ws/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 46257
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 Jan 2024 16:23:20 GMT
expires: Thu, 11 Jan 2024 16:23:20 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame F5FB 712 B
381 B 421ms
420ms Document
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-2614556310778759&output=html&h=60&adk=273762757&adf=1414068304&pi=t.aa~a.1977424468~rp.2&w=1200&fwrn=4&fwrnh=100&lmt=1704990200&rafmt=1&to=qs&pwprc=2480099511&format=1200x60&url=https%3A%2F%2Fbitly.ws%2F%3Fbanned%3D1&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1704990200434&bpp=1&bdt=1762&idt=1&shv=r20240109&mjsv=m202401020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x200%2C1200x280%2C1200x280%2C1200x90&nras=5&correlator=557443233933&frm=20&pv=1&ga_vid=2262019.1704990199&ga_sid=1704990199&ga_hid=1335102134&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2533&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079266%2C31079715%2C31080265%2C42532523%2C44809531%2C44807405%2C31079717%2C95320894&oid=2&pvsid=130113169792481&tmod=925275663&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=45

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401020101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

49e66fa1a3b9c0e5f45eb825c648e14da1bb0aa7163c05fb167f43ceebee6a24

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bitly.ws/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 356
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 Jan 2024 16:23:20 GMT
expires: Thu, 11 Jan 2024 16:23:20 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240109/r20110914/ Frame F619 9 KB
4 KB 54ms
52ms Document
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240109/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401020101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e93b8c0ae5b5910b7107c8b455eda029935c56efa8de0be2443d8eabba207197

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bitly.ws/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 42472
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4173
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 Jan 2024 04:35:28 GMT
etag: 9219409622527106327
expires: Thu, 25 Jan 2024 04:35:28 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240109/r20110914/ Frame 279A 9 KB
4 KB 54ms
52ms Document
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240109/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401020101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e93b8c0ae5b5910b7107c8b455eda029935c56efa8de0be2443d8eabba207197

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bitly.ws/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 42472
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4173
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 Jan 2024 04:35:28 GMT
etag: 9219409622527106327
expires: Thu, 25 Jan 2024 04:35:28 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css2
fonts.googleapis.com/ Frame F619 4 KB
744 B 85ms
61ms Stylesheet
text/css 2607:f8b0:4004:c08::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::5f Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 11 Jan 2024 16:23:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 11 Jan 2024 14:31:38 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 11 Jan 2024 16:23:20 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame F619 205 B
294 B 79ms
58ms Image
image/png 2607:f8b0:4004:c09::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 15:22:26 GMT
x-content-type-options: nosniff
age: 3654
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 10 Jan 2025 15:22:26 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame F619 604 B
918 B 77ms
57ms Image
image/png 2607:f8b0:4004:c09::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 15:32:54 GMT
x-content-type-options: nosniff
age: 3026
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 10 Jan 2025 15:32:54 GMT

GET
H2 200 fullscreen_api_adapter_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240109/r20110914/elements/html/ Frame F619 16 KB
7 KB 86ms
69ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240109/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

972f7a26f860f2f122dcf2a4c5cae616df3a4a83e0c8318a1afb824c766fb651

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Wed, 10 Jan 2024 23:02:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 62428
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6823
x-xss-protection: 0
server: cafe
etag: 11129212757755515379
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 24 Jan 2024 23:02:52 GMT

GET
H2 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240109/r20110914/elements/html/ Frame F619 22 KB
9 KB 72ms
56ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240109/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a519c62e734157227e61ce5209158e1b7b484b5f2b68e3ccaed1ffe444de36d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 07:02:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33676
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9422
x-xss-protection: 0
server: cafe
etag: 10624764489894593518
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 Jan 2024 07:02:04 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6DF2 143 B
166 B 65ms
59ms Document
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-2614556310778759&output=html&h=200&slotname=1428154055&adk=624732521&adf=477754370&pi=t.ma~as.1428154055&w=1200&fwrn=4&lmt=1704990199&rafmt=11&format=1200x200&url=https%3A%2F%2Fbitly.ws%2F%3Fbanned%3D1&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1704990199135&bpp=17&bdt=463&idt=189&shv=r20240109&mjsv=m202401020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=557443233933&frm=20&pv=1&ga_vid=2262019.1704990199&ga_sid=1704990199&ga_hid=1335102134&ga_fc=1&rplot=4&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=415&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079266%2C31079715%2C31080265%2C42532523%2C44809531%2C44807405%2C31079717%2C95320894&oid=2&pvsid=130113169792481&tmod=925275663&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=204
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 1295
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 Jan 2024 16:01:45 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame E29D 645 B
254 B 83ms
82ms Document
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CI_bi-MCEIi_pesCGK_b-dIBMAE&v=APEucNXAxCE4KqqJ4SBhfZP39tjeHCQfwygsK1P3JvUg4nq_HGCVUb7Kyy6dgONh0JiN10kZchmGyP2Q8ugdnMbbhtdm-PHEpzz0Gmem6YH5y1lkryhpHV0

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20240109/r20110914/zrt_lookup_fy2021.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 234
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 Jan 2024 16:23:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 206B 172 KB
61 KB 283ms
54ms Script
text/javascript 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Wed, 10 Jan 2024 19:53:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 73814
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 11 Jan 2024 19:53:07 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240109/r20110914/elements/html/ Frame 206B 7 KB
3 KB 64ms
63ms Script
text/javascript 2607:f8b0:4004:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240109/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Wed, 10 Jan 2024 23:03:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 62420
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3071
x-xss-protection: 0
server: cafe
etag: 10674441169935035545
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 24 Jan 2024 23:03:00 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240109/r20110914/ Frame 206B 23 KB
9 KB 58ms
58ms Script
text/javascript 2607:f8b0:4004:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240109/r20110914/abg_lite_fy2021.js

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

428f4d59e61cdf9887ad4cd7c4592a24b214d2d9c0ba09db01c4cfde66a3cd11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Wed, 10 Jan 2024 23:03:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 62420
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9276
x-xss-protection: 0
server: cafe
etag: 3558958386372919956
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 24 Jan 2024 23:03:00 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 206B 41 KB
14 KB 59ms
58ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Sun, 07 Jan 2024 22:12:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 324625
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 06 Jan 2025 22:12:55 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240109/r20110914/client/ Frame 206B 3 KB
1 KB 72ms
71ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240109/r20110914/client/window_focus_fy2021.js

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 06:43:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 34765
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 Jan 2024 06:43:55 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240109/r20110914/client/ Frame 206B 20 KB
8 KB 59ms
58ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d58acf16b5e4521c9eb24fe9fd97308e5f8be1297e4b63a547e5b610611799ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 06:43:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 34766
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8492
x-xss-protection: 0
server: cafe
etag: 9878124937798820110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 Jan 2024 06:43:54 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 206B 205 KB
65 KB 59ms
58ms Script
text/javascript 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ed88d5a1c97dc43c114c0b289b3b5abf077be44e8e8765a9ad777f94af433411

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66227
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1704891455226136"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 11 Jan 2024 16:23:20 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 206B 42 B
63 B 77ms
77ms Image
image/gif 2607:f8b0:4004:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-B3rzIqW4noy2AC1C8nLap3m8A4lKwBRAwG4Bl-y0PGZJA9CvTPrSQl0BvetzxKgYTFThQW6oqzAIT9Vby5YC9SW7ZKNdT05U4vwj0Kt_OamNIcPf0

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 9E6E 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5176454ff2b23ffbdbc2d7a4415779612c7f1d26743a816df984044421159673

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame 9E6E 33 KB
34 KB 204ms
52ms Font
font/woff2 2607:f8b0:4004:c1d::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::5e Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Tue, 09 Jan 2024 08:48:37 GMT
x-content-type-options: nosniff
age: 200084
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Jan 2025 08:48:37 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame E2A3 14 KB
1 KB 64ms
63ms Stylesheet
text/css 2607:f8b0:4004:c08::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::5f Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 11 Jan 2024 16:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 11 Jan 2024 15:18:45 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 11 Jan 2024 16:23:21 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240109/r20110914/client/ Frame E2A3 2 KB
822 B 54ms
53ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240109/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Wed, 10 Jan 2024 23:02:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 62462
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 24 Jan 2024 23:02:19 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240109/r20110914/ Frame E2A3 23 KB
9 KB 53ms
53ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240109/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

428f4d59e61cdf9887ad4cd7c4592a24b214d2d9c0ba09db01c4cfde66a3cd11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Wed, 10 Jan 2024 23:02:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 62462
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9276
x-xss-protection: 0
server: cafe
etag: 3558958386372919956
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 24 Jan 2024 23:02:19 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame B5BF 143 B
166 B 54ms
52ms Document
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20240109/r20110914/zrt_lookup_fy2021.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 1296
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 Jan 2024 16:01:45 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240109/r20110914/client/ Frame E2A3 3 KB
1 KB 63ms
63ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240109/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 06:43:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 34766
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 Jan 2024 06:43:55 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240109/r20110914/client/ Frame E2A3 20 KB
8 KB 63ms
63ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d58acf16b5e4521c9eb24fe9fd97308e5f8be1297e4b63a547e5b610611799ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 06:43:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 34767
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8492
x-xss-protection: 0
server: cafe
etag: 9878124937798820110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 Jan 2024 06:43:54 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame E2A3 205 KB
65 KB 177ms
176ms Script
text/javascript 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ed88d5a1c97dc43c114c0b289b3b5abf077be44e8e8765a9ad777f94af433411

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66227
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1704891455226136"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 11 Jan 2024 16:23:21 GMT

GET
H3 200 4cee352c918c506f58256258d534a665.js Show response
www.gstatic.com/mysidia/ Frame E2A3 37 KB
15 KB 63ms
62ms Script
text/javascript 2607:f8b0:4004:c09::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/4cee352c918c506f58256258d534a665.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e6b20a1535a6d3ca3d7a611ae199a6f4b464e0b67b450379ed43a7ef3e66957c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Wed, 10 Jan 2024 08:16:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 115625
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15452
x-xss-protection: 0
last-modified: Fri, 05 Jan 2024 00:56:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 09 Apr 2024 08:16:16 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6DF2
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

75ms
74ms

Document
text/html

2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 Jan 2024 16:23:21 GMT
expires: Thu, 11 Jan 2024 16:23:21 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 Jan 2024 16:23:21 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 206B 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7ad9ba0ea59d8d692e78af538e8a4d25c67db0c58f702dca9ed0830a0e04ca74

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame D36A 38 KB
13 KB 57ms
54ms Document
text/html 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 55620
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 11 Jan 2024 00:56:21 GMT
expires: Fri, 10 Jan 2025 00:56:21 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame E29D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMR9qeAe2S8ejhvHmQOFPMw&google_cver=1&gdpr=0

43 B
338 B

86ms
83ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMR9qeAe2S8ejhvHmQOFPMw&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI_bi-MCEIi_pesCGK_b-dIBMAE&v=APEucNXAxCE4KqqJ4SBhfZP39tjeHCQfwygsK1P3JvUg4nq_HGCVUb7Kyy6dgONh0JiN10kZchmGyP2Q8ugdnMbbhtdm-PHEpzz0Gmem6YH5y1lkryhpHV0
Protocol: H2
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:21 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UbEzv3n983PGxHLIwpoxSpW%2FfxC5dNg0Dg9BnQP9cRSAzOfQ%2BbetPeSIc6v1u1XNvmBtq3%2Fm7w4t4eE2n%2FDeRnHG6yGXsnpuXuY8Qkb7Keh%2FBpWg9L0bYOKc6a292EGm6ut3uSdukcqDLw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 843e80f85f03da77-MIA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:21 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMR9qeAe2S8ejhvHmQOFPMw&google_cver=1&gdpr=0
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 324
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame E29D
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZaAV.Yn6H9c8ApF42H99cQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMR9qeAe2S8ejhvHmQOFPMw&google_cver=1&google_hm=2

43 B
734 B

132ms
131ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMR9qeAe2S8ejhvHmQOFPMw&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI_bi-MCEIi_pesCGK_b-dIBMAE&v=APEucNXAxCE4KqqJ4SBhfZP39tjeHCQfwygsK1P3JvUg4nq_HGCVUb7Kyy6dgONh0JiN10kZchmGyP2Q8ugdnMbbhtdm-PHEpzz0Gmem6YH5y1lkryhpHV0
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:22 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LPaEg9HPcmg0ys%2FlulYH2jSLe8ktovLR%2BndH%2BIMCqQxEjlthuYEXETZEwZ%2FjZn2DTPE6oAdbBPb7J8Pl0qG72xPv1HzfqEBtsL6hGPOLJD7gXsa9KaYfyzYEJOVmVkyBRUqOSRzK3p0Sdw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 843e80fa6ee62886-MIA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:21 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMR9qeAe2S8ejhvHmQOFPMw&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

bounce
ib.adnxs.com/ Frame E29D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEBDqN5MH4ZuuJOLyqawEajY&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26gdpr%3D0%26code%3DCAESEBDqN5MH4ZuuJOLyqawEajY%26google_cver%3D1

43 B
1 KB

74ms
69ms

Image
image/gif

68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26gdpr%3D0%26code%3DCAESEBDqN5MH4ZuuJOLyqawEajY%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI_bi-MCEIi_pesCGK_b-dIBMAE&v=APEucNXAxCE4KqqJ4SBhfZP39tjeHCQfwygsK1P3JvUg4nq_HGCVUb7Kyy6dgONh0JiN10kZchmGyP2Q8ugdnMbbhtdm-PHEpzz0Gmem6YH5y1lkryhpHV0

Protocol

Server

68.67.160.76 Jersey City, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:21 GMT
an-x-request-uuid: 028e8d6b-f2d6-4dd0-94b2-f11575090f0f
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 38.132.118.77; 38.132.118.77; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:21 GMT
an-x-request-uuid: 1a82fcdc-c05f-476b-8dc1-4f16552f33a2
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26gdpr%3D0%26code%3DCAESEBDqN5MH4ZuuJOLyqawEajY%26google_cver%3D1
cache-control: no-store, no-cache, private
x-proxy-origin: 38.132.118.77; 38.132.118.77; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame E29D
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDc3NDYyMTk0NDEwMzMwMzM2Nw%3D%3D

170 B
243 B

69ms
68ms

Image
image/png

172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDc3NDYyMTk0NDEwMzMwMzM2Nw%3D%3D

Requested by

Protocol

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:21 GMT
an-x-request-uuid: 7d4b5a94-bbcf-45b6-84e3-7f7fa8a56327
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDc3NDYyMTk0NDEwMzMwMzM2Nw%3D%3D
x-proxy-origin: 38.132.118.77; 38.132.118.77; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 6CCF 645 B
254 B 89ms
84ms Document
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKChoQIQyNKa_wEYzLbW4AEwAQ&v=APEucNUgBDJrfgEAlk74X5XXLh6Z-v5-MSNPRlAcwalrPhf2Bg9FENLLy6x3El2tH_EpFjM1s7GPlpLofBgoCGPfgZtzoKFLUcCkSBFclWIOOmfIgpvw5SM

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-2614556310778759&output=html&h=90&adk=2743202993&adf=1893186479&pi=t.aa~a.1977423791~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1704990200&rafmt=1&to=qs&pwprc=2480099511&format=1200x90&url=https%3A%2F%2Fbitly.ws%2F%3Fbanned%3D1&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1704990200434&bpp=1&bdt=1762&idt=-M&shv=r20240109&mjsv=m202401020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x200%2C1200x280%2C1200x280&nras=4&correlator=557443233933&frm=20&pv=1&ga_vid=2262019.1704990199&ga_sid=1704990199&ga_hid=1335102134&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2393&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079266%2C31079715%2C31080265%2C42532523%2C44809531%2C44807405%2C31079717%2C95320894&oid=2&pvsid=130113169792481&tmod=925275663&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=34

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-2614556310778759&output=html&h=90&adk=2743202993&adf=1893186479&pi=t.aa~a.1977423791~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1704990200&rafmt=1&to=qs&pwprc=2480099511&format=1200x90&url=https%3A%2F%2Fbitly.ws%2F%3Fbanned%3D1&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1704990200434&bpp=1&bdt=1762&idt=-M&shv=r20240109&mjsv=m202401020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x200%2C1200x280%2C1200x280&nras=4&correlator=557443233933&frm=20&pv=1&ga_vid=2262019.1704990199&ga_sid=1704990199&ga_hid=1335102134&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2393&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079266%2C31079715%2C31080265%2C42532523%2C44809531%2C44807405%2C31079717%2C95320894&oid=2&pvsid=130113169792481&tmod=925275663&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=34
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 234
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 Jan 2024 16:23:21 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240109/r20110914/ Frame 197D 23 KB
9 KB 107ms
61ms Script
text/javascript 2607:f8b0:4004:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240109/r20110914/abg_lite_fy2021.js

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

428f4d59e61cdf9887ad4cd7c4592a24b214d2d9c0ba09db01c4cfde66a3cd11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Wed, 10 Jan 2024 23:03:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 62421
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9276
x-xss-protection: 0
server: cafe
etag: 3558958386372919956
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 24 Jan 2024 23:03:00 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240109/r20110914/elements/html/ Frame 197D 7 KB
3 KB 101ms
57ms Script
text/javascript 2607:f8b0:4004:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240109/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Wed, 10 Jan 2024 23:03:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 62421
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3071
x-xss-protection: 0
server: cafe
etag: 10674441169935035545
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 24 Jan 2024 23:03:00 GMT

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame 197D 0
0 480ms
80ms Fetch
image/gif 142.251.167.148

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjstbYCPsamguPh_ko7PA5dmXd1-cjxJYLxvxYAUEpq7S3aBVJNm0CzEEzHz9dMz_Oa_Tl-eOmGho5cwSIoX4qsUB0Z0l8Dbs2xAkP9VCFKe7LqcTpgP8LtrvRHC9sHXdGq5a3GkCo86GjxaYNVUa3avGzlCgigEPeiijFpdC9O5p7Ow4jjIJFL2zWt2ut-kdYKY77i3a8tK9STm-w58tgWrN3cFCkINoYjL4YyVGQCMizU1yzoxV5H8pr1FtpJQINObsQq5M-15EdZlMheXgWvekkXm5DwHOOjexF1N7SLqoxJ_W51KQ7nwKg1k-7f0lwIUSUkoMgfZl1znO7fnjpYFoZ2twtG1SsY9R6hGlUrBWm0Z3nKY-Okk_wH9YrQh2Gu50v1aWzUTgavZxGuM9S_5__GrMXUAfrL5jwjyQTw805sudEVYDlDCdjbZ1gKYReqgsFF-yHy_R2Ysk9kiROh9Mr4YIycGhlErp8BFkwdb8s_W60nODg_EO4WUgmUuoCp4I8dzIBpD_dM2B68q9Cb6tibGk4kFkJlNQO7myU5fUzqFCWoth-WOy3xVRFy4S34aeSW7oMWwn0gYtWosopFY2XL5bn5xesivSNG3uUXK_Rv-k_420WT2u4JMyGed43tBxzTNRnYABpLMZyHqXF_TwVoUsdU_F69CiUoJh2Wko54X1pjP-oBgoPuC-Ej_spB0EJFkDCud3RodfDUB2NfEIzDiSdbvUFvBjsu_rWBptcOXfdPWFDQ6r7DriqZG85OoxOqsByZwLFsj9458EWVTDzrnZINMBkZeY0XGLWdu81KSI-ZPyP-uPJMWx78Z18J02yB1TD6CmEEjpTE_HUQYAGWqBBx8Nh38dfP9A283wfkHcGFtzKd0A6mpaUpO8m-PVU89mmvVHUaFlB5Ui5woqQZ63iO-9f_3BE3uoAqPHA_oo12a5sHtNxuVNbcmpTuCjlprLDLKjnYcza3RaRAxj73aE37OeHEx2sj_kmDQOO0t3V0RWmw_rz8_gvoK6U0lUje-jaaEJM5q0ak_zvmIf5fNTEKjDxdZx4UPZNKjOJGRoYE7vd8-bqedT5yKbhRH1n2ejmO1rhcE8RQPFrb_oc4PIDPBj33IyNLtpN2zl-BgGUzouPeOZC2E8r6jKw3Fi25uPAIWQSfn-BGGIjCsXeQTP9t-MHFRMFCoA_m5HfzOnDRGHZRD8X1WNyh7ZD3TaRcbMgL052iWDZ4dmzwc701LjCTKsU17SDUtrZafK_O1VHnRsdJG2mr8EtVvJP_Tu9Nxa4rAg58W2uNP8cMdbP9ICAkJblG4h4EAnn7thKSATdVJs4A&sai=AMfl-YRtubhr4GGvO2NTzBrxnp928IV6Si15pNDL0ZVSNNarkHYwxmVSBo7_6YQTXsaNMl9jlCCvAA7ljG3tSBVXaNcK7zpjGYwboytLynJsbquheGHA1J9LC0GdcbhLtDpd3OF7CzRaP2Cim9nfcEqaK-7A4Y0IWOv700UcTlgkWGCMHruCSU5VimZfP5d82Se7gAww1-SSgh2wfJkQO65UyWuphQd1P_8C-VUqY6TBKb_WsOXoTzLuuTily8nnRctA1wHB1Vc6i4Liu_Yt2-V5app-34UTSucrSuGflvp3tCO97SuZ-MiGc9FdBWu9FMfJeYMF8VcMy6uF8uK11jGigrEIh1gg36sqHaEMbwE2Nt8LHVAxXnk5RvL4JoqQlK452Iqr7qA1K9eiW9tlK-eAQzoCz5FQC4I7Z5RGPIhn&sig=Cg0ArKJSzOGT7Nc2E49iEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9oaXNjb3guY29t&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=3&cbvp=1&cstd=1&cisv=r20240109.52704&arae=0&ftch=1&adurl=

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.148 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 11 Jan 2024 16:23:21 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 204
No Content analytics.js Show response
s.cdnsynd.com/2/641959/ Frame 197D 0
64 B 492ms
52ms Script
text/plain 52.23.209.187

General

Check archive.org

Show headers Download Go to

Full URL: https://s.cdnsynd.com/2/641959/analytics.js?dt=6419591531399173184001&ac=11362813&si=4792984&pc=359396505&pi=550288690&cr=186526148&dm=728x90&ai=6836545&ui=AMsySZaXw3KSYtz2CqX5pDj3VG4x&cb=906367611&pp=N555803.2382313DOUBLECLICKBIDMAN&md=display
Requested by: Host: bitly.ws
URL: https://bitly.ws/?banned=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 52.23.209.187 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date: Thu, 11 Jan 2024 16:23:21 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 197D 41 KB
14 KB 103ms
81ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Sun, 07 Jan 2024 22:12:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 324626
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 06 Jan 2025 22:12:55 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240109/r20110914/client/ Frame 197D 3 KB
1 KB 97ms
75ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240109/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-2614556310778759&output=html&h=90&adk=2743202993&adf=1893186479&pi=t.aa~a.1977423791~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1704990200&rafmt=1&to=qs&pwprc=2480099511&format=1200x90&url=https%3A%2F%2Fbitly.ws%2F%3Fbanned%3D1&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1704990200434&bpp=1&bdt=1762&idt=-M&shv=r20240109&mjsv=m202401020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x200%2C1200x280%2C1200x280&nras=4&correlator=557443233933&frm=20&pv=1&ga_vid=2262019.1704990199&ga_sid=1704990199&ga_hid=1335102134&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2393&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079266%2C31079715%2C31080265%2C42532523%2C44809531%2C44807405%2C31079717%2C95320894&oid=2&pvsid=130113169792481&tmod=925275663&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=34

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 06:43:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 34766
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 Jan 2024 06:43:55 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 5C7D 1 KB
643 B 56ms
52ms Document
text/html 2607:f8b0:4004:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-2614556310778759&output=html&h=90&adk=2743202993&adf=1893186479&pi=t.aa~a.1977423791~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1704990200&rafmt=1&to=qs&pwprc=2480099511&format=1200x90&url=https%3A%2F%2Fbitly.ws%2F%3Fbanned%3D1&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1704990200434&bpp=1&bdt=1762&idt=-M&shv=r20240109&mjsv=m202401020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x200%2C1200x280%2C1200x280&nras=4&correlator=557443233933&frm=20&pv=1&ga_vid=2262019.1704990199&ga_sid=1704990199&ga_hid=1335102134&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2393&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079266%2C31079715%2C31080265%2C42532523%2C44809531%2C44807405%2C31079717%2C95320894&oid=2&pvsid=130113169792481&tmod=925275663&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=34

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 58529
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 Jan 2024 00:07:52 GMT
etag: 48472445140208031
expires: Fri, 12 Jan 2024 00:07:52 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240109/r20110914/client/ Frame 197D 20 KB
8 KB 97ms
76ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-2614556310778759&output=html&h=90&adk=2743202993&adf=1893186479&pi=t.aa~a.1977423791~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1704990200&rafmt=1&to=qs&pwprc=2480099511&format=1200x90&url=https%3A%2F%2Fbitly.ws%2F%3Fbanned%3D1&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1704990200434&bpp=1&bdt=1762&idt=-M&shv=r20240109&mjsv=m202401020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x200%2C1200x280%2C1200x280&nras=4&correlator=557443233933&frm=20&pv=1&ga_vid=2262019.1704990199&ga_sid=1704990199&ga_hid=1335102134&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2393&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079266%2C31079715%2C31080265%2C42532523%2C44809531%2C44807405%2C31079717%2C95320894&oid=2&pvsid=130113169792481&tmod=925275663&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=34

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d58acf16b5e4521c9eb24fe9fd97308e5f8be1297e4b63a547e5b610611799ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 06:43:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 34767
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8492
x-xss-protection: 0
server: cafe
etag: 9878124937798820110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 Jan 2024 06:43:54 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 197D 0
0 94ms
72ms Image
text/html 2607:f8b0:4004:c1d::93
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTrifkysWpgKabbKs0cAdrpLD2YOwNmH32b2PsrqMYiaHz_bzNhs_vusZkNahoWnkONruAc3z8JJONAp96H3oSUMDb_0A
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-2614556310778759&output=html&h=90&adk=2743202993&adf=1893186479&pi=t.aa~a.1977423791~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1704990200&rafmt=1&to=qs&pwprc=2480099511&format=1200x90&url=https%3A%2F%2Fbitly.ws%2F%3Fbanned%3D1&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1704990200434&bpp=1&bdt=1762&idt=-M&shv=r20240109&mjsv=m202401020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x200%2C1200x280%2C1200x280&nras=4&correlator=557443233933&frm=20&pv=1&ga_vid=2262019.1704990199&ga_sid=1704990199&ga_hid=1335102134&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2393&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079266%2C31079715%2C31080265%2C42532523%2C44809531%2C44807405%2C31079717%2C95320894&oid=2&pvsid=130113169792481&tmod=925275663&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=34
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c1d::93 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 197D 205 KB
65 KB 79ms
63ms Script
text/javascript 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=44809771

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-2614556310778759&output=html&h=90&adk=2743202993&adf=1893186479&pi=t.aa~a.1977423791~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1704990200&rafmt=1&to=qs&pwprc=2480099511&format=1200x90&url=https%3A%2F%2Fbitly.ws%2F%3Fbanned%3D1&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1704990200434&bpp=1&bdt=1762&idt=-M&shv=r20240109&mjsv=m202401020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x200%2C1200x280%2C1200x280&nras=4&correlator=557443233933&frm=20&pv=1&ga_vid=2262019.1704990199&ga_sid=1704990199&ga_hid=1335102134&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2393&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079266%2C31079715%2C31080265%2C42532523%2C44809531%2C44807405%2C31079717%2C95320894&oid=2&pvsid=130113169792481&tmod=925275663&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=34

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ed88d5a1c97dc43c114c0b289b3b5abf077be44e8e8765a9ad777f94af433411

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66227
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1704891455226136"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 11 Jan 2024 16:23:21 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 197D 42 B
63 B 100ms
84ms Image
image/gif 2607:f8b0:4004:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-A02eu2XrCXUYx88NlwmkWy32TwXFRGgrNbsN8EcbNZzjWrXU2mlGM3fl9U-EbHT98V4Fi2QE6MNKgXhtgeVFDzdM9yNCCJCEUaS_8oS4KpMNYSpvA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-2614556310778759&output=html&h=90&adk=2743202993&adf=1893186479&pi=t.aa~a.1977423791~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1704990200&rafmt=1&to=qs&pwprc=2480099511&format=1200x90&url=https%3A%2F%2Fbitly.ws%2F%3Fbanned%3D1&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1704990200434&bpp=1&bdt=1762&idt=-M&shv=r20240109&mjsv=m202401020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x200%2C1200x280%2C1200x280&nras=4&correlator=557443233933&frm=20&pv=1&ga_vid=2262019.1704990199&ga_sid=1704990199&ga_hid=1335102134&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2393&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079266%2C31079715%2C31080265%2C42532523%2C44809531%2C44807405%2C31079717%2C95320894&oid=2&pvsid=130113169792481&tmod=925275663&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=34

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 4619148384219772552
s0.2mdn.net/simgad/ Frame 197D 34 KB
34 KB 170ms
58ms Image
image/jpeg 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/4619148384219772552

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-2614556310778759&output=html&h=90&adk=2743202993&adf=1893186479&pi=t.aa~a.1977423791~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1704990200&rafmt=1&to=qs&pwprc=2480099511&format=1200x90&url=https%3A%2F%2Fbitly.ws%2F%3Fbanned%3D1&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1704990200434&bpp=1&bdt=1762&idt=-M&shv=r20240109&mjsv=m202401020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x200%2C1200x280%2C1200x280&nras=4&correlator=557443233933&frm=20&pv=1&ga_vid=2262019.1704990199&ga_sid=1704990199&ga_hid=1335102134&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2393&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079266%2C31079715%2C31080265%2C42532523%2C44809531%2C44807405%2C31079717%2C95320894&oid=2&pvsid=130113169792481&tmod=925275663&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=34

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

09ae30740d7efa16807978e7afbd2e6367bad9098fd863390ba2476d8a6cbc13

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 10:42:15 GMT
date: Thu, 11 Jan 2024 10:42:15 GMT
x-content-type-options: nosniff
age: 20466
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35212
x-xss-protection: 0
last-modified: Tue, 07 Feb 2023 09:56:43 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame B5BF
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

92ms
76ms

Document
text/html

2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 Jan 2024 16:23:21 GMT
expires: Thu, 11 Jan 2024 16:23:21 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 Jan 2024 16:23:21 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 adPos Show response
fundingchoicesmessages.google.com/f/AGSKWxUYNJGfjueefXijSyx7c2e24GelfWP3ZdWXtnFweUwjzylTCUm6sQb5gaVIpztqDkJ8ADO4SDeLlatpTUu7YSviIKtmO9yb82JvZ0eZccePF-zWieOQSageCfGUCEkip8RVpvCkJT-Tu4YHKQOCrEsWXqzGe... 54 B
109 B 75ms
72ms Script
application/javascript 2607:f8b0:4004:c06::65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUYNJGfjueefXijSyx7c2e24GelfWP3ZdWXtnFweUwjzylTCUm6sQb5gaVIpztqDkJ8ADO4SDeLlatpTUu7YSviIKtmO9yb82JvZ0eZccePF-zWieOQSageCfGUCEkip8RVpvCkJT-Tu4YHKQOCrEsWXqzGell6kWshQ2JSYtDrbdkUbXUm5PXIAeMn/__radio_ad_/doubleclickad./ad300ws./adPos?/webadvert.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.0gNNmdO3vgQ.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMxn2lZ1P4aLLqQehvEmoMdKCwnc9A/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7d07a2bad8c5739b856dc542d79740e0b73dacd426419c488119e8438c17d136

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-OnM_XDJUJ4JgjA1SVHUgGA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:21 GMT
content-security-policy: script-src 'report-sample' 'nonce-OnM_XDJUJ4JgjA1SVHUgGA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 148 KB
50 KB 87ms
84ms Script
text/javascript 2607:f8b0:4004:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?fcd=true

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

caccd85a1282fd19360b2d465363a858ccfbf9146c3663ab602e03ec0280b481

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:21 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51538
x-xss-protection: 0
server: cafe
etag: 15890742442655314523
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Thu, 11 Jan 2024 16:23:21 GMT

POST
H3 204 AGSKWxXTC8aXmCtUWSCovQuVLoVubgUAay_ElS_WUidA2tuZd-NZOnu5HTxsRrvrY8EwDkZ86hqC-s7WqmK34SE0Og2U8b9Xg4SQyiRdf5Y8isPkR7X1Zs7zUGxAFnzGzEol3mpRqEdUBw== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 69ms
68ms XHR
text/html 2607:f8b0:4004:c06::65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXTC8aXmCtUWSCovQuVLoVubgUAay_ElS_WUidA2tuZd-NZOnu5HTxsRrvrY8EwDkZ86hqC-s7WqmK34SE0Og2U8b9Xg4SQyiRdf5Y8isPkR7X1Zs7zUGxAFnzGzEol3mpRqEdUBw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-f30d-g-fMcIO9oavM7Yi2w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://bitly.ws/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 11 Jan 2024 16:23:21 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-f30d-g-fMcIO9oavM7Yi2w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://bitly.ws
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 5326842_BLD_Display_singlemessage_v1.html Show response
s0.2mdn.net/sadbundle/7448582456568971264/ Frame D7F8 50 KB
7 KB 69ms
68ms Document
text/html 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba02e591f3b8d15e9361017c112d3b461218191b09e96f7b3660d07df1738804

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Thu, 11 Jan 2024 16:23:21 GMT
expires: Fri, 10 Jan 2025 16:23:21 GMT
last-modified: Wed, 31 May 2023 13:35:05 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame 206B 0
0 355ms
78ms Fetch
image/gif 142.251.167.148

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjssigM0PpF0RGuMs-gdCDMIxPb3GJdBwiDtx_CpaBXNzFYk1jZzldN3sxLDhcRcnv2lBj1mpGDsRX2JEjbIr7Es-fApnE9yVsa_RKanGMxxFfh1hHLvbqPK4ICJmMyr1UqHXlXVsCh6VmGsiuF6UgeMb4NvCfXZt13LS6AezfmKnoSsXP1s2U1Kq5LEesycwb-zyZt_5_SsvoArLcIyPfY8GDs9ITxNtecTUJW4cMvDAOD91WpG_rEhmx4-w-YXvmtIWshdqzUcoUdZOc3b5TgYupBhir0bVMXf12KLg4Pjht6bhNAu-01rj7tiVv7Y_e1hIZuq-_BDAK1OaMSS6QV1upMhbEx20ByCc1wTJ-_1b9Hvwwu5ue4cYg9VbW4HiGNMg4EmevAw-fLN6F-cWn2SNycsak4mgMV4CRH7LKCXc84hEz-MhVZvW0a38C65-bKS6hK5nvIOTPT9fBpKHJF0yBBLl3Xbg-Eb6ZqKZE0moG6p8jT_crc1bHHRp5T7lyMqqp3E5JYfr2jBSuaVo0AViYdZULleFFwDzhAJdwQMKVUlgEhBew4mjNKe61s6bwNWnpb4UINjQBDklysz5Xa0iQd4LzMyoXXZS-4M-7Pa6W3d5ureB-5ymvpjdzlZ-skmJOtyS9BMdxOFOeBVroAIbIZfG1Ok73qxFuLZtHLFIuzy6fDCL9gNDfQfigrr01OoRY4wiFDEhUGXyjHUjQPlp2m-G0GQ7P2ZPH6-tQ_B8nFb4g3OqK04UWqxF5UgtC_xl0ywVN5uEsetxQ0uVlzMWHIPxfpPpVJ8s_-APPOAwBFlpG0ZDOO1ENZoDCfL752NW6wOYHtO6X13lXhDifevNYOZVtYaW9WVA-03xQBdRlbD9rk7Hhy5FtecT9oM1PyncPagNGvTNavM47SB21XZcT-BipUP9mJxjYYEDGz5mLoOK-MbS1sdqPHpHpI-m1JJ0Fo-gmiw6r0Q9nR7Gmxy_oY8Rfr1QlBIkjbcsJhO8rlyFAI5iS-17CykHSaRYTn36D94oK1RHTFi2QWNpm4o937-PzJZ7hZcXourWsBL5PR6OZ9z3Oi90miE1zSrNKRghbGw2W6_shO9tQ-0TZ65LdpfAv_BhlThagEodMpGQSF2JbZ-4iGtshvUC9Az_bVurnBhr_iwU6smXP1UNxiizVXUJ_WGAYPPku6BgkR7OLM3Tc7CUX8S52LcKb90DT-6NfDXA64CU7erzIF5wKl8YXts5mM7O8VchGRQgMVJh4iQVFjz3G1Id7jMRABjOcQin2nYZLKbCfXrj42a2UAGYEGa52rHv3wAiT-21Y9DAxyPNRUCqFR6gzHCS&sai=AMfl-YQMNKCjwZoDOcp-AGLa468Y1CiQKj-xE33058tIgTS3SuzyZWxJeZkSMEj7Sche4kxqW4TC6dzXAmEXgrMmJXqTF7ghwXGX3mP0TEtNyhGF3wFbMlXb8HppnKDHWc1pWu9xOzY_I85KWIdDbJk_k4vJsmBFW1kfYmdvvvg2ixq08RoAVo2XjE8BH8TpuD4bFSIhpBVMlmVpSZgzDAg2YWcBoVOFztcVs0dHq39X9IIcsQDk0NZIBSxZVb-eK7TMH9Jhn3cvW0Nj-1OcfZdLZT5lYO9u5bP5V7PfoQmciZ37UqKFniwXZjLBoc6GSy6bJAJRiOqAo5zcs4EjQBs305V4FI1jznnRpmCghzkGX7nhNHma2x_80GB6fLZhKKqLQ22GKsPQtQMkh9Y1Q5pMQuKsueeIhQYE6XQLod-GpKMdcPwIG5ILz4uNiy2xeRS5kSYYY6dTWl0LkZyiIXx897Ooefo_DZkAkQWciEL1j0bVAPRUBQHkHP0yH8EReM0Ka1x_LsQ&sig=Cg0ArKJSzK_D1g1jdwVDEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9idWlsZC5jb20&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=490&cbvp=1&cstd=477&cisv=r20240109.22606&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.148 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 11 Jan 2024 16:23:21 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 MCFrRHZE15CKjvM6RLwmjguI7mqh03m56A7oA9GJNi8.js Show response
pagead2.googlesyndication.com/bg/ Frame D36A 39 KB
15 KB 53ms
52ms Script
text/javascript 2607:f8b0:4004:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/MCFrRHZE15CKjvM6RLwmjguI7mqh03m56A7oA9GJNi8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30216b447644d7908a8ef33a44bc268e0b88ee6aa1d379b9e80ee803d189362f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 15:37:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2756
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15229
x-xss-protection: 0
last-modified: Wed, 03 Jan 2024 11:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 10 Jan 2025 15:37:25 GMT

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame 197D 0
0 236ms
70ms Fetch
image/gif 142.251.167.148

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjstbYCPsamguPh_ko7PA5dmXd1-cjxJYLxvxYAUEpq7S3aBVJNm0CzEEzHz9dMz_Oa_Tl-eOmGho5cwSIoX4qsUB0Z0l8Dbs2xAkP9VCFKe7LqcTpgP8LtrvRHC9sHXdGq5a3GkCo86GjxaYNVUa3avGzlCgigEPeiijFpdC9O5p7Ow4jjIJFL2zWt2ut-kdYKY77i3a8tK9STm-w58tgWrN3cFCkINoYjL4YyVGQCMizU1yzoxV5H8pr1FtpJQINObsQq5M-15EdZlMheXgWvekkXm5DwHOOjexF1N7SLqoxJ_W51KQ7nwKg1k-7f0lwIUSUkoMgfZl1znO7fnjpYFoZ2twtG1SsY9R6hGlUrBWm0Z3nKY-Okk_wH9YrQh2Gu50v1aWzUTgavZxGuM9S_5__GrMXUAfrL5jwjyQTw805sudEVYDlDCdjbZ1gKYReqgsFF-yHy_R2Ysk9kiROh9Mr4YIycGhlErp8BFkwdb8s_W60nODg_EO4WUgmUuoCp4I8dzIBpD_dM2B68q9Cb6tibGk4kFkJlNQO7myU5fUzqFCWoth-WOy3xVRFy4S34aeSW7oMWwn0gYtWosopFY2XL5bn5xesivSNG3uUXK_Rv-k_420WT2u4JMyGed43tBxzTNRnYABpLMZyHqXF_TwVoUsdU_F69CiUoJh2Wko54X1pjP-oBgoPuC-Ej_spB0EJFkDCud3RodfDUB2NfEIzDiSdbvUFvBjsu_rWBptcOXfdPWFDQ6r7DriqZG85OoxOqsByZwLFsj9458EWVTDzrnZINMBkZeY0XGLWdu81KSI-ZPyP-uPJMWx78Z18J02yB1TD6CmEEjpTE_HUQYAGWqBBx8Nh38dfP9A283wfkHcGFtzKd0A6mpaUpO8m-PVU89mmvVHUaFlB5Ui5woqQZ63iO-9f_3BE3uoAqPHA_oo12a5sHtNxuVNbcmpTuCjlprLDLKjnYcza3RaRAxj73aE37OeHEx2sj_kmDQOO0t3V0RWmw_rz8_gvoK6U0lUje-jaaEJM5q0ak_zvmIf5fNTEKjDxdZx4UPZNKjOJGRoYE7vd8-bqedT5yKbhRH1n2ejmO1rhcE8RQPFrb_oc4PIDPBj33IyNLtpN2zl-BgGUzouPeOZC2E8r6jKw3Fi25uPAIWQSfn-BGGIjCsXeQTP9t-MHFRMFCoA_m5HfzOnDRGHZRD8X1WNyh7ZD3TaRcbMgL052iWDZ4dmzwc701LjCTKsU17SDUtrZafK_O1VHnRsdJG2mr8EtVvJP_Tu9Nxa4rAg58W2uNP8cMdbP9ICAkJblG4h4EAnn7thKSATdVJs4A&sai=AMfl-YRtubhr4GGvO2NTzBrxnp928IV6Si15pNDL0ZVSNNarkHYwxmVSBo7_6YQTXsaNMl9jlCCvAA7ljG3tSBVXaNcK7zpjGYwboytLynJsbquheGHA1J9LC0GdcbhLtDpd3OF7CzRaP2Cim9nfcEqaK-7A4Y0IWOv700UcTlgkWGCMHruCSU5VimZfP5d82Se7gAww1-SSgh2wfJkQO65UyWuphQd1P_8C-VUqY6TBKb_WsOXoTzLuuTily8nnRctA1wHB1Vc6i4Liu_Yt2-V5app-34UTSucrSuGflvp3tCO97SuZ-MiGc9FdBWu9FMfJeYMF8VcMy6uF8uK11jGigrEIh1gg36sqHaEMbwE2Nt8LHVAxXnk5RvL4JoqQlK452Iqr7qA1K9eiW9tlK-eAQzoCz5FQC4I7Z5RGPIhn&sig=Cg0ArKJSzOGT7Nc2E49iEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9oaXNjb3guY29t&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=236&vt=11&dtpt=233&dett=2&cstd=1&cisv=r20240109.52704&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.148 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:21 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

POST
H3 204 AGSKWxXTC8aXmCtUWSCovQuVLoVubgUAay_ElS_WUidA2tuZd-NZOnu5HTxsRrvrY8EwDkZ86hqC-s7WqmK34SE0Og2U8b9Xg4SQyiRdf5Y8isPkR7X1Zs7zUGxAFnzGzEol3mpRqEdUBw== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 75ms
74ms XHR
text/html 2607:f8b0:4004:c06::65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXTC8aXmCtUWSCovQuVLoVubgUAay_ElS_WUidA2tuZd-NZOnu5HTxsRrvrY8EwDkZ86hqC-s7WqmK34SE0Og2U8b9Xg4SQyiRdf5Y8isPkR7X1Zs7zUGxAFnzGzEol3mpRqEdUBw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-DC3oiIQYOHhfFj95dHuZ0g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://bitly.ws/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 11 Jan 2024 16:23:21 GMT
content-security-policy: script-src 'report-sample' 'nonce-DC3oiIQYOHhfFj95dHuZ0g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://bitly.ws
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxXTC8aXmCtUWSCovQuVLoVubgUAay_ElS_WUidA2tuZd-NZOnu5HTxsRrvrY8EwDkZ86hqC-s7WqmK34SE0Og2U8b9Xg4SQyiRdf5Y8isPkR7X1Zs7zUGxAFnzGzEol3mpRqEdUBw== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 94ms
80ms XHR
text/html 2607:f8b0:4004:c06::65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXTC8aXmCtUWSCovQuVLoVubgUAay_ElS_WUidA2tuZd-NZOnu5HTxsRrvrY8EwDkZ86hqC-s7WqmK34SE0Og2U8b9Xg4SQyiRdf5Y8isPkR7X1Zs7zUGxAFnzGzEol3mpRqEdUBw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-NWDc_bazl1wjx-1jkFwqlg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://bitly.ws/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 11 Jan 2024 16:23:21 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-NWDc_bazl1wjx-1jkFwqlg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://bitly.ws
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxXTC8aXmCtUWSCovQuVLoVubgUAay_ElS_WUidA2tuZd-NZOnu5HTxsRrvrY8EwDkZ86hqC-s7WqmK34SE0Og2U8b9Xg4SQyiRdf5Y8isPkR7X1Zs7zUGxAFnzGzEol3mpRqEdUBw== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 92ms
82ms XHR
text/html 2607:f8b0:4004:c06::65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXTC8aXmCtUWSCovQuVLoVubgUAay_ElS_WUidA2tuZd-NZOnu5HTxsRrvrY8EwDkZ86hqC-s7WqmK34SE0Og2U8b9Xg4SQyiRdf5Y8isPkR7X1Zs7zUGxAFnzGzEol3mpRqEdUBw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-Qtn4I-OjTI1tn-Gw9cWDgQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://bitly.ws/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 11 Jan 2024 16:23:21 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-Qtn4I-OjTI1tn-Gw9cWDgQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://bitly.ws
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxXt_p9fZLVvbjVr2fqUT-F6scvaRYO8vhaZTHQ2uJxxR_p0AtHxrCnQL77qToI1NSnqA2rdKyYU4zyXekU9zqIptS8jQJLGGDHDjH9N20UtM38B4zEWIrF7lBXxDKYYLlehqBmB9A== Show response
fundingchoicesmessages.google.com/f/ 5 KB
2 KB 92ms
89ms Script
application/javascript 2607:f8b0:4004:c06::65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXt_p9fZLVvbjVr2fqUT-F6scvaRYO8vhaZTHQ2uJxxR_p0AtHxrCnQL77qToI1NSnqA2rdKyYU4zyXekU9zqIptS8jQJLGGDHDjH9N20UtM38B4zEWIrF7lBXxDKYYLlehqBmB9A==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzA0OTkwMjAxLDYyODAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNl0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vYml0bHkud3MvIixudWxsLFtbOCwiMGdOTm1kTzN2Z1EiXSxbOSwiZW4tVVMiXSxbMTksIjIiXSxbMTgsIltbWzBdXV0iXV1d

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3b4e4807190e52f7c1968c62069645480cd7b9562a4a949e865f418369b75bde

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ngh7G3KXKOz6YRcXlhlw8g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:21 GMT
content-security-policy: script-src 'report-sample' 'nonce-ngh7G3KXKOz6YRcXlhlw8g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 197D 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5c47674d2d9f45991f5aad3960ec96163fcd71f0c55f188ae25c22bfda5cf3b7

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame D7F8 153 KB
5 KB 70ms
68ms Stylesheet
text/css 2607:f8b0:4004:c08::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto+Condensed:300,300italic,regular,italic,700,700italic|Roboto:100,100italic,300,300italic,regular,italic,500,500italic,700,700italic,900,900italic|Montserrat:100,200,300,regular,500,600,700,800,900,100italic,200italic,300italic,italic,500italic,600italic,700italic,800italic,900italic|Poppins:100,100italic,200,200italic,300,300italic,regular,italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic|Open+Sans:300,regular,500,600,700,800,300italic,italic,500italic,600italic,700italic,800italic

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::5f Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1ff2fb733c2070049712d4395073deb3840a78737f80db8a4ae9a20bd6aa0d09

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 11 Jan 2024 16:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 11 Jan 2024 15:00:38 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 11 Jan 2024 16:23:21 GMT

GET
H3 200 gwdpage_style.css
s0.2mdn.net/sadbundle/7448582456568971264/ Frame D7F8 55 B
104 B 91ms
79ms Stylesheet
text/css 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/gwdpage_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2afb3cf38deea01d461f29b961c8aab0da4f121a84a9c843f49dc7cced99b6a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:06 GMT
date: Thu, 11 Jan 2024 11:03:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19215
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 74
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 gwdpagedeck_style.css
s0.2mdn.net/sadbundle/7448582456568971264/ Frame D7F8 731 B
264 B 88ms
75ms Stylesheet
text/css 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/gwdpagedeck_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3974624ff80521dbd81d3ed32f8ec10c7baef11c272f46626a6284538e90e44b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:06 GMT
date: Thu, 11 Jan 2024 11:03:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19215
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 234
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 gwdgooglead_style.css
s0.2mdn.net/sadbundle/7448582456568971264/ Frame D7F8 24 B
73 B 79ms
67ms Stylesheet
text/css 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/gwdgooglead_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e52ad60cf8269c44381d5e0833e69b9b8f3b9f9346b7066b1dc5a52b390feedc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:06 GMT
date: Thu, 11 Jan 2024 11:03:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19215
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 gwdimage_style.css
s0.2mdn.net/sadbundle/7448582456568971264/ Frame D7F8 303 B
203 B 88ms
77ms Stylesheet
text/css 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/gwdimage_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e17f25a33727defde4f0e88b24844c00e48ed88484c4440d978025a82567287

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:06 GMT
date: Thu, 11 Jan 2024 11:03:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19215
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 173
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 gwdattached_style.css
s0.2mdn.net/sadbundle/7448582456568971264/ Frame D7F8 26 B
75 B 78ms
67ms Stylesheet
text/css 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/gwdattached_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fffa14e9a3c576087a9202af54e8f11669f29c37617df0c6f728ca24d95f60bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:06 GMT
date: Thu, 11 Jan 2024 11:03:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19215
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 gwdgesture_style.css
s0.2mdn.net/sadbundle/7448582456568971264/ Frame D7F8 57 B
103 B 90ms
79ms Stylesheet
text/css 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/gwdgesture_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f058ecc947d0bc01e2855afaff0be17a2e30ae1e067ad3a5389b986a62225e26

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:06 GMT
date: Thu, 11 Jan 2024 11:03:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19215
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 73
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 gwdgallerynavigation_style.css
s0.2mdn.net/sadbundle/7448582456568971264/ Frame D7F8 1 KB
492 B 86ms
75ms Stylesheet
text/css 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/gwdgallerynavigation_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

86ee0e760c043b495df32283b44ba844e416df4ac5189fe6a0d801c781e35125

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:06 GMT
date: Thu, 11 Jan 2024 11:03:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19215
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 462
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 gwdtransitiongallery_style.css
s0.2mdn.net/sadbundle/7448582456568971264/ Frame D7F8 300 B
193 B 87ms
77ms Stylesheet
text/css 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/gwdtransitiongallery_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cca91000f734b29920238acfd5b89ad375215a5dae2cf669dcf81fc318313842

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:06 GMT
date: Thu, 11 Jan 2024 11:03:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19215
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 163
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 googbase_min.js Show response
s0.2mdn.net/sadbundle/7448582456568971264/ Frame D7F8 400 B
305 B 103ms
93ms Script
application/x-javascript 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/googbase_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e13459782d7fc46c73821602bedc17cc2b3a2dc5ec07e91e30ed715193698a94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:06 GMT
date: Thu, 11 Jan 2024 11:03:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19215
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 275
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 gwd_webcomponents_v1_min.js Show response
s0.2mdn.net/sadbundle/7448582456568971264/ Frame D7F8 20 KB
6 KB 90ms
80ms Script
application/x-javascript 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/gwd_webcomponents_v1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bddbf7e9ab14ce92ecc37640bf54fcb90d8a02da52d87ec12e252cfde4432e66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:02:30 GMT
date: Thu, 11 Jan 2024 11:02:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19251
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6289
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 Enabler_01_250.js Show response
s0.2mdn.net/879366/ Frame D7F8 120 KB
41 KB 100ms
90ms Script
text/javascript 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31d02f43dd0c7fc5c0d95db087a23f1c2d729c93f10450884c8da6b415f7839b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Wed, 10 Jan 2024 19:54:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 73740
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42247
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 11 Jan 2024 19:54:21 GMT

GET
H3 200 gwd-events-support.1.0.js Show response
s0.2mdn.net/sadbundle/7448582456568971264/ Frame D7F8 8 KB
3 KB 77ms
67ms Script
application/x-javascript 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/gwd-events-support.1.0.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31eba576e56105b427cc5072fdf87a2334b63d15933402686268d75dd5d9c69c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:06 GMT
date: Thu, 11 Jan 2024 11:03:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19215
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2888
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 gwdpage_min.js Show response
s0.2mdn.net/sadbundle/7448582456568971264/ Frame D7F8 3 KB
1 KB 97ms
87ms Script
application/x-javascript 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/gwdpage_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

da1b1dba110f3d97894949bedfc60fe7fec3659813c957f88e51d550bc95ad88

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:06 GMT
date: Thu, 11 Jan 2024 11:03:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19215
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1308
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 gwdpagedeck_min.js Show response
s0.2mdn.net/sadbundle/7448582456568971264/ Frame D7F8 8 KB
3 KB 126ms
117ms Script
application/x-javascript 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/gwdpagedeck_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfc5afa3cbf80ed8a39987d2f4cc9215f915cfde9c83e86d5ee4a874bd69a401

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:06 GMT
date: Thu, 11 Jan 2024 11:03:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19215
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3136
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 gwdgooglead_min.js Show response
s0.2mdn.net/sadbundle/7448582456568971264/ Frame D7F8 13 KB
4 KB 116ms
107ms Script
application/x-javascript 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/gwdgooglead_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6494566919e28711a1f36d6389923dfccb4750fb9522e9e6d1967ab778ab0073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:06 GMT
date: Thu, 11 Jan 2024 11:03:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19215
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4427
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 gwdimage_min.js Show response
s0.2mdn.net/sadbundle/7448582456568971264/ Frame D7F8 5 KB
2 KB 115ms
106ms Script
application/x-javascript 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/gwdimage_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

32ab0a5c85cabdb695704b5128a8fb7c9a8dfa3242cc36ceda6bb0650a45b35f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:06 GMT
date: Thu, 11 Jan 2024 11:03:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19215
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2014
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 gwdresponsiveattributeshelper_min.js Show response
s0.2mdn.net/sadbundle/7448582456568971264/ Frame D7F8 5 KB
2 KB 118ms
109ms Script
application/x-javascript 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/gwdresponsiveattributeshelper_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f0e1a14a5e1952dfc9554516a0bac963a81c024b09dadde696d2fbd1398cde62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:06 GMT
date: Thu, 11 Jan 2024 11:03:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19215
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2142
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 gwdattached_min.js Show response
s0.2mdn.net/sadbundle/7448582456568971264/ Frame D7F8 1 KB
620 B 114ms
105ms Script
application/x-javascript 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/gwdattached_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd50ba290f74d344ad0d04ade63c55b02360bf4db99c0a2749f34deb0c8dcec9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:06 GMT
date: Thu, 11 Jan 2024 11:03:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19215
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 590
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 gwdtexthelper_min.js Show response
s0.2mdn.net/sadbundle/7448582456568971264/ Frame D7F8 4 KB
2 KB 106ms
97ms Script
application/x-javascript 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/gwdtexthelper_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

91c86e76693fc278899037d0d8a66c2fe01fc83e5cbae1a54a47fe0f61b2be15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:06 GMT
date: Thu, 11 Jan 2024 11:03:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19215
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1725
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 gwdgesture_min.js Show response
s0.2mdn.net/sadbundle/7448582456568971264/ Frame D7F8 6 KB
2 KB 106ms
98ms Script
application/x-javascript 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/gwdgesture_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8a7f4d0dace49ce143b43f43372cf0b58d479e4393523bb91ceaae407142e4cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:06 GMT
date: Thu, 11 Jan 2024 11:03:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19215
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2420
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 gwdgallerynavigation_min.js Show response
s0.2mdn.net/sadbundle/7448582456568971264/ Frame D7F8 4 KB
2 KB 102ms
95ms Script
application/x-javascript 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/gwdgallerynavigation_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fe40b8037500ad7a98967c41af17e3dda074a285b8597c9d2ae9de45bda5b287

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:06 GMT
date: Thu, 11 Jan 2024 11:03:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19215
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1838
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 gwdtransitiongallery_min.js Show response
s0.2mdn.net/sadbundle/7448582456568971264/ Frame D7F8 11 KB
5 KB 99ms
93ms Script
application/x-javascript 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/gwdtransitiongallery_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

17774266115cd205b172904b059684e1ac5eb1ffa7f3e690d53ce7264be05ef1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:06 GMT
date: Thu, 11 Jan 2024 11:03:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19215
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4620
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 gwdfade_min.js Show response
s0.2mdn.net/sadbundle/7448582456568971264/ Frame D7F8 2 KB
1018 B 98ms
92ms Script
application/x-javascript 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/gwdfade_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

676b3badd1c6d8a0ba12bfeb9233264c968aace3b80cfedf6e9b4faedd27f3ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:06 GMT
date: Thu, 11 Jan 2024 11:03:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19215
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 988
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 gwd-text-fitting.js Show response
s0.2mdn.net/sadbundle/7448582456568971264/ Frame D7F8 5 KB
2 KB 96ms
90ms Script
application/x-javascript 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/gwd-text-fitting.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b41835ad763abb366c167dab7c1fbc77a7a81e5bbc51c2ce66bfa5250bfc9a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:06 GMT
date: Thu, 11 Jan 2024 11:03:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19215
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2038
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 6CCF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMR9qeAe2S8ejhvHmQOFPMw&google_cver=1&gdpr=0

43 B
733 B

130ms
129ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMR9qeAe2S8ejhvHmQOFPMw&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKChoQIQyNKa_wEYzLbW4AEwAQ&v=APEucNUgBDJrfgEAlk74X5XXLh6Z-v5-MSNPRlAcwalrPhf2Bg9FENLLy6x3El2tH_EpFjM1s7GPlpLofBgoCGPfgZtzoKFLUcCkSBFclWIOOmfIgpvw5SM
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:22 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wrbNumqSjKdXUd9w%2Bb6Oc%2BpL9tcD%2FDQ2FhnY77tIpXXCUBQrKotAgpmNqMpdU0kHzKQI4u7HJkrBZoHjs2qr1NAn2Q6%2FOHqTqjsFBQwF6NzAs4uBmHbTGSeGtXaliIpUvSKizzHKmlngGQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 843e80fa6ef82886-MIA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:21 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMR9qeAe2S8ejhvHmQOFPMw&google_cver=1&gdpr=0
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 324
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 6CCF
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZaAV.Yn6H9c8ApF42H99cQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMR9qeAe2S8ejhvHmQOFPMw&google_cver=1&google_hm=2

43 B
734 B

78ms
77ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMR9qeAe2S8ejhvHmQOFPMw&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKChoQIQyNKa_wEYzLbW4AEwAQ&v=APEucNUgBDJrfgEAlk74X5XXLh6Z-v5-MSNPRlAcwalrPhf2Bg9FENLLy6x3El2tH_EpFjM1s7GPlpLofBgoCGPfgZtzoKFLUcCkSBFclWIOOmfIgpvw5SM
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:22 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B0mXzB2G0BnJQl7E8%2BI3SxEhapllWnLI7MgUrYHgI8UlksX%2FQp4brbtDvxFbJ%2BU9fpqeGF%2Bn%2FCqydf75fYpxaKJsbPBFucdGtGBzzJ169o1efSscQY07uMrj6G8a0J7hKLk4pTB74WdbsQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 843e80fb58562886-MIA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:22 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMR9qeAe2S8ejhvHmQOFPMw&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 6CCF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEBDqN5MH4ZuuJOLyqawEajY&google_cver=1

43 B
1012 B

63ms
63ms

Image
image/gif

68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEBDqN5MH4ZuuJOLyqawEajY&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKChoQIQyNKa_wEYzLbW4AEwAQ&v=APEucNUgBDJrfgEAlk74X5XXLh6Z-v5-MSNPRlAcwalrPhf2Bg9FENLLy6x3El2tH_EpFjM1s7GPlpLofBgoCGPfgZtzoKFLUcCkSBFclWIOOmfIgpvw5SM

Protocol

Server

68.67.160.76 Jersey City, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:22 GMT
an-x-request-uuid: 51523886-101b-493f-9bc8-0716b938200f
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 38.132.118.77; 38.132.118.77; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:22 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEBDqN5MH4ZuuJOLyqawEajY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6CCF
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDc3NDYyMTk0NDEwMzMwMzM2Nw%3D%3D

170 B
188 B

62ms
61ms

Image
image/png

172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDc3NDYyMTk0NDEwMzMwMzM2Nw%3D%3D

Requested by

Protocol

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:22 GMT
an-x-request-uuid: f01bc516-ed0e-4f07-a504-6910ff2d9591
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDc3NDYyMTk0NDEwMzMwMzM2Nw%3D%3D
x-proxy-origin: 38.132.118.77; 38.132.118.77; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 344A 38 KB
13 KB 54ms
53ms Document
text/html 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 55620
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 11 Jan 2024 00:56:21 GMT
expires: Fri, 10 Jan 2025 00:56:21 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 9E6E
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CY1L-9xWgZZXSH47wvPIPsOmg2Azyx8qddN3znJGwEezI__jbKRABIKyQlQJgyYaAgNyjxBCgAffLuMICyAEBqQKHziYVEOBJPqgDAcgDywSqBMQBT9AhsIVMPlvZtBFqMM_L3CNVKFh_TmY...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xa9fd7ae5903347ec0000000000000000%22,%222%22:%220x1dfb4d4d6ff8ac910000000000000000%22,%223%22:%220xe090e9...

0
0

315ms
107ms

Fetch
text/css

172.253.115.155

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xa9fd7ae5903347ec0000000000000000%22,%222%22:%220x1dfb4d4d6ff8ac910000000000000000%22,%223%22:%220xe090e9fa9135d53b0000000000000000%22,%224%22:%220xd911e83a3e6e5eb0000000000000000%22,%225%22:%220xc847bfca177f9bbd0000000000000000%22},%22debug_key%22:%228174411223427533127%22,%22debug_reporting%22:true,%22destination%22:%22https://manageengine.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22676210167%22],%2222%22:[%22true%22],%224%22:[%2201-11%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%228528035573150701793%22}&andc=true

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Server

172.253.115.155 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:22 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0xa9fd7ae5903347ec0000000000000000","2":"0x1dfb4d4d6ff8ac910000000000000000","3":"0xe090e9fa9135d53b0000000000000000","4":"0xd911e83a3e6e5eb0000000000000000","5":"0xc847bfca177f9bbd0000000000000000"},"debug_key":"8174411223427533127","debug_reporting":true,"destination":"https://manageengine.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["676210167"],"22":["true"],"4":["01-11"],"6":["true"]},"priority":"500","source_event_id":"8528035573150701793"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 11 Jan 2024 16:23:22 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 11 Jan 2024 16:23:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0xa9fd7ae5903347ec0000000000000000","2":"0x1dfb4d4d6ff8ac910000000000000000","3":"0xe090e9fa9135d53b0000000000000000","4":"0xd911e83a3e6e5eb0000000000000000","5":"0xc847bfca177f9bbd0000000000000000"},"debug_key":"8174411223427533127","debug_reporting":true,"destination":"https://manageengine.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["676210167"],"22":["true"],"4":["01-11"],"6":["true"]},"priority":"500","source_event_id":"8528035573150701793"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5C7D
Redirect Chain

https://px.owneriq.net/ecmg?google_gid=CAESEKmxCjqaX6Dy8xcyE7CCzuY&google_cver=1&google_push=AXcoOmTsZOxk1A_ekBVhhd_gLJOMg4xYaXIunE-WVqQOCF6kwWNX9AXZ9ljlTVYYBSGGCKxZcGYOMGHLlnpgPuFok2ibidCR5O1JiCo
https://px.owneriq.net/ecc?redir=https%3a%2f%2fcm.g.doubleclick.net%2fpixel%3fgoogle_nid%3downeriq1%26google_sc%26google_push%3dAXcoOmTsZOxk1A_ekBVhhd_gLJOMg4xYaXIunE-WVqQOCF6kwWNX9AXZ9ljlTVYYBSGGC...
https://cm.g.doubleclick.net/pixel?google_nid=owneriq1&google_sc&google_push=AXcoOmTsZOxk1A_ekBVhhd_gLJOMg4xYaXIunE-WVqQOCF6kwWNX9AXZ9ljlTVYYBSGGCKxZcGYOMGHLlnpgPuFok2ibidCR5O1JiCo&google_cver=1&go...

170 B
188 B

68ms
67ms

Image
image/png

172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=owneriq1&google_sc&google_push=AXcoOmTsZOxk1A_ekBVhhd_gLJOMg4xYaXIunE-WVqQOCF6kwWNX9AXZ9ljlTVYYBSGGCKxZcGYOMGHLlnpgPuFok2ibidCR5O1JiCo&google_cver=1&google_gid=CAESEKmxCjqaX6Dy8xcyE7CCzuY&google_hm=UTc1ODI3NjYwMjE5NTAzNDEzMDU=

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 11 Jan 2024 16:23:22 GMT
Server: Apache/2.4.6 (CentOS)
X-Powered-By: PHP/7.3.33
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://cm.g.doubleclick.net/pixel?google_nid=owneriq1&google_sc&google_push=AXcoOmTsZOxk1A_ekBVhhd_gLJOMg4xYaXIunE-WVqQOCF6kwWNX9AXZ9ljlTVYYBSGGCKxZcGYOMGHLlnpgPuFok2ibidCR5O1JiCo&google_cver=1&google_gid=CAESEKmxCjqaX6Dy8xcyE7CCzuY&google_hm=UTc1ODI3NjYwMjE5NTAzNDEzMDU=
Content-Type: text/html
Cache-Control: max-age=68802
Connection: keep-alive
Content-Length: 154

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5C7D
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEKjTBl5EYuR9xtg65F-PBNA&google_push=AXcoOmSLFcHR_o0nWQpsw1YBo00mDrGGFhbVMX0mroe9We_K27DRLTw9-g...

170 B
188 B

67ms
65ms

Image
image/png

172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEKjTBl5EYuR9xtg65F-PBNA&google_push=AXcoOmSLFcHR_o0nWQpsw1YBo00mDrGGFhbVMX0mroe9We_K27DRLTw9-gNjHRwwbVSNGZv6akX78jGDavfyoyQX1db-mjb9H7zcP8Q

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-mia-kmia1760076-MIA
pragma: no-cache
date: Thu, 11 Jan 2024 16:23:22 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1704990202.338277,VS0,VE26
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEKjTBl5EYuR9xtg65F-PBNA&google_push=AXcoOmSLFcHR_o0nWQpsw1YBo00mDrGGFhbVMX0mroe9We_K27DRLTw9-gNjHRwwbVSNGZv6akX78jGDavfyoyQX1db-mjb9H7zcP8Q
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5C7D
Redirect Chain

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAXcoOmS1_T5non4d3Ix7uonedETIUQnszOP165KJtmxWwJHxoNpAVIpx0gT3F6vWwptvO493fMXL0cqL4Zj3RgkPjqJ3IA6ry4AVDrg&google_gid=CAESEIH7qyhJIGYh-dTcZ7OTD2Q&...
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCPqrgK0GEgUI6AcQAEIASnNnb29nbGVfcHVzaD1BWGNvT21TMV9UNW5vbjRkM0l4N3VvbmVkRVRJVVFuc3pPUDE2NUtKdG14V3dKSHhvTnBBVklweDBnVDNGNnZXd3B0dk80OTNmTVhMMGNxTDRaajNSZ2...
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcweFBiZVhzaUE1Q0VuTWF6SEdDb0RoWWhKdEF6N3FYcjRBMXNfbFZZeXE3bw==&google_push

170 B
188 B

61ms
61ms

Image
image/png

172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcweFBiZVhzaUE1Q0VuTWF6SEdDb0RoWWhKdEF6N3FYcjRBMXNfbFZZeXE3bw==&google_push

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 11 Jan 2024 16:23:22 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcweFBiZVhzaUE1Q0VuTWF6SEdDb0RoWWhKdEF6N3FYcjRBMXNfbFZZeXE3bw==&google_push
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 5C7D 43 B
363 B 311ms
49ms Image
image/gif 74.119.119.150

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmT21Lcn3v7NqzftBU8STQ8C_L_-oF63xooPJKQZgvy7TReLQ8HNDwkLSMyn40JtN8nRna7putFm6-mm0aty_95BeE6yXoauUg&google_gid=CAESELGW4sgCsasPeoI7beJ-8oE&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-2614556310778759&output=html&h=90&adk=2743202993&adf=1893186479&pi=t.aa~a.1977423791~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1704990200&rafmt=1&to=qs&pwprc=2480099511&format=1200x90&url=https%3A%2F%2Fbitly.ws%2F%3Fbanned%3D1&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1704990200434&bpp=1&bdt=1762&idt=-M&shv=r20240109&mjsv=m202401020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x200%2C1200x280%2C1200x280&nras=4&correlator=557443233933&frm=20&pv=1&ga_vid=2262019.1704990199&ga_sid=1704990199&ga_hid=1335102134&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2393&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079266%2C31079715%2C31080265%2C42532523%2C44809531%2C44807405%2C31079717%2C95320894&oid=2&pvsid=130113169792481&tmod=925275663&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=34

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.150 -, , ASN (),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:22 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 389904
expires: Thu, 11 Jan 2024 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5C7D
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEEfzY_PJVqFTbdnRTwelqKQ&google_cver=1&google_push=AXcoOmTPza0IwaSb-hAEl0IemLX75YHvHUijlygldz5SGyFSnsUuLR_ddT0Y6frKAOByRptzg2Ft2rRDnCFEHY2...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=8MRf7x0jVxh0e86Ka1U9ZCaEdk0&google_push=AXcoOmTPza0IwaSb-hAEl0IemLX75YHvHUijlygldz5SGyFSnsUuLR_ddT0Y6frKAOByRptzg2Ft2rRDnCFEHY...

170 B
188 B

62ms
60ms

Image
image/png

172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=8MRf7x0jVxh0e86Ka1U9ZCaEdk0&google_push=AXcoOmTPza0IwaSb-hAEl0IemLX75YHvHUijlygldz5SGyFSnsUuLR_ddT0Y6frKAOByRptzg2Ft2rRDnCFEHY2N1lLA1nwfvyvTUuc

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=8MRf7x0jVxh0e86Ka1U9ZCaEdk0&google_push=AXcoOmTPza0IwaSb-hAEl0IemLX75YHvHUijlygldz5SGyFSnsUuLR_ddT0Y6frKAOByRptzg2Ft2rRDnCFEHY2N1lLA1nwfvyvTUuc
Date: Thu, 11 Jan 2024 16:23:22 GMT
Connection: keep-alive
Content-Length: 245
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5C7D
Redirect Chain

https://ius.ctnsnet.com/int/cm?exc=1&acc=crimtan_holdings_limited&google_gid=CAESEGobCHrMfWt1mYzT8kBC1vU&google_cver=1&google_push=AXcoOmTXktLUPGC27gjTGyxCACvNxPHUMDUQ6b_ieeXlJq-6TIm4jYwYcP_34t2nK5...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AXcoOmTXktLUPGC27gjTGyxCACvNxPHUMDUQ6b_ieeXlJq-6TIm4jYwYcP_34t2nK5Dfgw0-K-bXYBCN4lIWuuTgjrA1P7DLPftX5RM&google_hm=...

170 B
188 B

64ms
62ms

Image
image/png

172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AXcoOmTXktLUPGC27gjTGyxCACvNxPHUMDUQ6b_ieeXlJq-6TIm4jYwYcP_34t2nK5Dfgw0-K-bXYBCN4lIWuuTgjrA1P7DLPftX5RM&google_hm=dxQNFjq9TPmmA940Qfgwok0

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:21 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AXcoOmTXktLUPGC27gjTGyxCACvNxPHUMDUQ6b_ieeXlJq-6TIm4jYwYcP_34t2nK5Dfgw0-K-bXYBCN4lIWuuTgjrA1P7DLPftX5RM&google_hm=dxQNFjq9TPmmA940Qfgwok0
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5C7D
Redirect Chain

https://www.temu.com/api/adx/cm/pixel?google_gid=CAESENn4P5HCvLfuMRJs3UXbtJk&google_cver=1&google_push=AXcoOmQzV59nDUQ3KEn2Z6LuLR_HBcRZp3_HY9F8WtORV9C9_tnwcjK6ol3W3csIz1Q9BKrD-SwIGthdrxGKD_qvEY2zPD...
https://cm.g.doubleclick.net/pixel?google_nid=1371970550&google_push=AXcoOmQzV59nDUQ3KEn2Z6LuLR_HBcRZp3_HY9F8WtORV9C9_tnwcjK6ol3W3csIz1Q9BKrD-SwIGthdrxGKD_qvEY2zPDOlpoXv5rM

170 B
188 B

70ms
69ms

Image
image/png

172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1371970550&google_push=AXcoOmQzV59nDUQ3KEn2Z6LuLR_HBcRZp3_HY9F8WtORV9C9_tnwcjK6ol3W3csIz1Q9BKrD-SwIGthdrxGKD_qvEY2zPDOlpoXv5rM

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 11 Jan 2024 16:23:22 GMT
strict-transport-security: max-age=2592000
server: nginx
content-security-policy-report-only: default-src 'none';script-src 'report-sample';report-uri /api/sec-csp/110000007/sec-gif
content-language: en-US
location: https://cm.g.doubleclick.net/pixel?google_nid=1371970550&google_push=AXcoOmQzV59nDUQ3KEn2Z6LuLR_HBcRZp3_HY9F8WtORV9C9_tnwcjK6ol3W3csIz1Q9BKrD-SwIGthdrxGKD_qvEY2zPDOlpoXv5rM
x-yak-request-id: 1704990202352-3b4871a2995efdf8b5c3e7d7b405c8a6
yak-timeinfo: 1704990202352|1
cip: 38.132.118.77
alt-svc: h3=":443"; ma=604800
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 5C7D 0
12 B 88ms
87ms Image
text/html 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JTHS385JcMz3HsWPeGuIoMDq07jUaMO3OdFq-q6RWdKGV6lL1nWfpjTt4u9Nb6dj-DFCQwbEk

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-2614556310778759&output=html&h=90&adk=2743202993&adf=1893186479&pi=t.aa~a.1977423791~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1704990200&rafmt=1&to=qs&pwprc=2480099511&format=1200x90&url=https%3A%2F%2Fbitly.ws%2F%3Fbanned%3D1&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1704990200434&bpp=1&bdt=1762&idt=-M&shv=r20240109&mjsv=m202401020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x200%2C1200x280%2C1200x280&nras=4&correlator=557443233933&frm=20&pv=1&ga_vid=2262019.1704990199&ga_sid=1704990199&ga_hid=1335102134&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2393&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079266%2C31079715%2C31080265%2C42532523%2C44809531%2C44807405%2C31079717%2C95320894&oid=2&pvsid=130113169792481&tmod=925275663&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=34

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:22 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 VucML-pZXNsV9Bio95In_Vy1g44u5uVv1Eq8Y-LPojk.js Show response
pagead2.googlesyndication.com/bg/ Frame 6179 50 KB
19 KB 82ms
82ms Script
text/javascript 2607:f8b0:4004:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/VucML-pZXNsV9Bio95In_Vy1g44u5uVv1Eq8Y-LPojk.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

56e70c2fea595cdb15f418a8f79227fd5cb5838e2ee6e56fd44abc63e2cfa239

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Mon, 08 Jan 2024 16:26:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 259025
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19703
x-xss-protection: 0
last-modified: Wed, 03 Jan 2024 11:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 07 Jan 2025 16:26:17 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 206B 42 B
64 B 256ms
85ms Fetch
image/gif 2607:f8b0:4004:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss9x1wsBr4qgNgPvGLnED3i9XkZo5YWTU36dlvU8h1WIqDYk_W9e0c5BeGqvZiYOH8XUh7G2lwhzjSq-1UkLiAFvytkfzQx2h0ndIPI1IILVyfGxxa690XWNRqauphtYMb5kwZdYZ7qDPb227Ob8_DWwbpd&sai=AMfl-YRpg7ejA9Jskn8q4yWa1CYLlT4-fLwQ3LmU2Qck1_taGnIg-m8pT9Ne6yq5zbkJPw8FSqhq8xY_z25B9clYuSth2m4bmaz6Rl9Vbx6rb8R-LAuamBQ1B0Aq-1MmorMgs8v8b3Zf2fTKe1O2InDi&sig=Cg0ArKJSzI0Vf1v6yK45EAE&cid=CAQSTgAvHhf_ioZgZNh_vs845nin4rc7o1p_loAPK4HaatlhX_beR6e6eQ6fCxzP4igrl37Tr9HXhDtVzzPGRo6RGzaVR8P2eWQ3TxhZ0RFLZxgB&id=lidar2&mcvt=1049&p=0,0,90,728&mtos=252,907,1049,1049,1049&tos=252,655,142,0,0&v=20240110&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1704990200784&rpt=258&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 VucML-pZXNsV9Bio95In_Vy1g44u5uVv1Eq8Y-LPojk.js Show response
pagead2.googlesyndication.com/bg/ Frame CA5E 50 KB
19 KB 62ms
52ms Script
text/javascript 2607:f8b0:4004:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/VucML-pZXNsV9Bio95In_Vy1g44u5uVv1Eq8Y-LPojk.js

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

56e70c2fea595cdb15f418a8f79227fd5cb5838e2ee6e56fd44abc63e2cfa239

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Mon, 08 Jan 2024 16:26:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 259025
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19703
x-xss-protection: 0
last-modified: Wed, 03 Jan 2024 11:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 07 Jan 2025 16:26:17 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 285ms
105ms Preflight
text/html 172.253.115.155

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.155 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 11 Jan 2024 16:23:22 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 AGSKWxXTC8aXmCtUWSCovQuVLoVubgUAay_ElS_WUidA2tuZd-NZOnu5HTxsRrvrY8EwDkZ86hqC-s7WqmK34SE0Og2U8b9Xg4SQyiRdf5Y8isPkR7X1Zs7zUGxAFnzGzEol3mpRqEdUBw== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 140ms
139ms XHR
text/html 2607:f8b0:4004:c06::65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXTC8aXmCtUWSCovQuVLoVubgUAay_ElS_WUidA2tuZd-NZOnu5HTxsRrvrY8EwDkZ86hqC-s7WqmK34SE0Og2U8b9Xg4SQyiRdf5Y8isPkR7X1Zs7zUGxAFnzGzEol3mpRqEdUBw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-9IrhL2Q6YU2cSD5LcLQt-A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://bitly.ws/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 11 Jan 2024 16:23:22 GMT
content-security-policy: script-src 'report-sample' 'nonce-9IrhL2Q6YU2cSD5LcLQt-A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://bitly.ws
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxUzyJBoN0xEyxgp4feJvr3YSq3VUN0E376HqqQI65s-qpr4N-kEVOZRq__zTgBGDTHeA9kBKW8dd2zPuyy-6Q2shSWF8F9PiO3njWk9v8g8CC3-UCYPlVRQYUMUdlHJeRLE55v-ug== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 136ms
134ms Script
application/javascript 2607:f8b0:4004:c06::65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUzyJBoN0xEyxgp4feJvr3YSq3VUN0E376HqqQI65s-qpr4N-kEVOZRq__zTgBGDTHeA9kBKW8dd2zPuyy-6Q2shSWF8F9PiO3njWk9v8g8CC3-UCYPlVRQYUMUdlHJeRLE55v-ug==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzA0OTkwMjAyLDE2ODAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMF0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vYml0bHkud3MvIixudWxsLFtbOCwiMGdOTm1kTzN2Z1EiXSxbOSwiZW4tVVMiXSxbMTksIjIiXSxbMTgsIltbWzBdXV0iXV1d

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e8ac930f3f5af6602d691cceca2121a1bb7e6742df19e64e353f9ddcc2d13f62

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-1n-OOykB-bsZ0TX_Ix3JHA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:22 GMT
content-security-policy: script-src 'report-sample' 'nonce-1n-OOykB-bsZ0TX_Ix3JHA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 MCFrRHZE15CKjvM6RLwmjguI7mqh03m56A7oA9GJNi8.js Show response
pagead2.googlesyndication.com/bg/ Frame 344A 39 KB
15 KB 97ms
94ms Script
text/javascript 2607:f8b0:4004:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/MCFrRHZE15CKjvM6RLwmjguI7mqh03m56A7oA9GJNi8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30216b447644d7908a8ef33a44bc268e0b88ee6aa1d379b9e80ee803d189362f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 15:37:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2757
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15229
x-xss-protection: 0
last-modified: Wed, 03 Jan 2024 11:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 10 Jan 2025 15:37:25 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ Frame D7F8 47 KB
47 KB 59ms
55ms Font
font/woff2 2607:f8b0:4004:c1d::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto+Condensed:300,300italic,regular,italic,700,700italic|Roboto:100,100italic,300,300italic,regular,italic,500,500italic,700,700italic,900,900italic|Montserrat:100,200,300,regular,500,600,700,800,900,100italic,200italic,300italic,italic,500italic,600italic,700italic,800italic,900italic|Poppins:100,100italic,200,200italic,300,300italic,regular,italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic|Open+Sans:300,regular,500,600,700,800,300italic,italic,500italic,600italic,700italic,800italic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::5e Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://s0.2mdn.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Wed, 10 Jan 2024 09:15:40 GMT
x-content-type-options: nosniff
age: 112062
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48236
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 09 Jan 2025 09:15:40 GMT

GET
H3 200 Proxima%20Nova%20Bold.ttf
s0.2mdn.net/sadbundle/7448582456568971264/assets/ Frame D7F8 86 KB
37 KB 98ms
95ms Font
font/ttf 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/assets/Proxima%20Nova%20Bold.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f98d53c3c3a2b4eb912b7013284a9e2f148c5ef1c34433cdadd1372960f3ea08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:07 GMT
date: Thu, 11 Jan 2024 11:03:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19215
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37649
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 Proxima%20Nova%20Light.ttf
s0.2mdn.net/sadbundle/7448582456568971264/assets/ Frame D7F8 129 KB
51 KB 98ms
96ms Font
font/ttf 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/assets/Proxima%20Nova%20Light.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de99107f47082162344c66c65af6050bb394de148e68803d31dc4d6ce362748a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:07 GMT
date: Thu, 11 Jan 2024 11:03:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19215
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52138
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame 206B 0
0 70ms
66ms Fetch
image/gif 142.251.167.148

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjssigM0PpF0RGuMs-gdCDMIxPb3GJdBwiDtx_CpaBXNzFYk1jZzldN3sxLDhcRcnv2lBj1mpGDsRX2JEjbIr7Es-fApnE9yVsa_RKanGMxxFfh1hHLvbqPK4ICJmMyr1UqHXlXVsCh6VmGsiuF6UgeMb4NvCfXZt13LS6AezfmKnoSsXP1s2U1Kq5LEesycwb-zyZt_5_SsvoArLcIyPfY8GDs9ITxNtecTUJW4cMvDAOD91WpG_rEhmx4-w-YXvmtIWshdqzUcoUdZOc3b5TgYupBhir0bVMXf12KLg4Pjht6bhNAu-01rj7tiVv7Y_e1hIZuq-_BDAK1OaMSS6QV1upMhbEx20ByCc1wTJ-_1b9Hvwwu5ue4cYg9VbW4HiGNMg4EmevAw-fLN6F-cWn2SNycsak4mgMV4CRH7LKCXc84hEz-MhVZvW0a38C65-bKS6hK5nvIOTPT9fBpKHJF0yBBLl3Xbg-Eb6ZqKZE0moG6p8jT_crc1bHHRp5T7lyMqqp3E5JYfr2jBSuaVo0AViYdZULleFFwDzhAJdwQMKVUlgEhBew4mjNKe61s6bwNWnpb4UINjQBDklysz5Xa0iQd4LzMyoXXZS-4M-7Pa6W3d5ureB-5ymvpjdzlZ-skmJOtyS9BMdxOFOeBVroAIbIZfG1Ok73qxFuLZtHLFIuzy6fDCL9gNDfQfigrr01OoRY4wiFDEhUGXyjHUjQPlp2m-G0GQ7P2ZPH6-tQ_B8nFb4g3OqK04UWqxF5UgtC_xl0ywVN5uEsetxQ0uVlzMWHIPxfpPpVJ8s_-APPOAwBFlpG0ZDOO1ENZoDCfL752NW6wOYHtO6X13lXhDifevNYOZVtYaW9WVA-03xQBdRlbD9rk7Hhy5FtecT9oM1PyncPagNGvTNavM47SB21XZcT-BipUP9mJxjYYEDGz5mLoOK-MbS1sdqPHpHpI-m1JJ0Fo-gmiw6r0Q9nR7Gmxy_oY8Rfr1QlBIkjbcsJhO8rlyFAI5iS-17CykHSaRYTn36D94oK1RHTFi2QWNpm4o937-PzJZ7hZcXourWsBL5PR6OZ9z3Oi90miE1zSrNKRghbGw2W6_shO9tQ-0TZ65LdpfAv_BhlThagEodMpGQSF2JbZ-4iGtshvUC9Az_bVurnBhr_iwU6smXP1UNxiizVXUJ_WGAYPPku6BgkR7OLM3Tc7CUX8S52LcKb90DT-6NfDXA64CU7erzIF5wKl8YXts5mM7O8VchGRQgMVJh4iQVFjz3G1Id7jMRABjOcQin2nYZLKbCfXrj42a2UAGYEGa52rHv3wAiT-21Y9DAxyPNRUCqFR6gzHCS&sai=AMfl-YQMNKCjwZoDOcp-AGLa468Y1CiQKj-xE33058tIgTS3SuzyZWxJeZkSMEj7Sche4kxqW4TC6dzXAmEXgrMmJXqTF7ghwXGX3mP0TEtNyhGF3wFbMlXb8HppnKDHWc1pWu9xOzY_I85KWIdDbJk_k4vJsmBFW1kfYmdvvvg2ixq08RoAVo2XjE8BH8TpuD4bFSIhpBVMlmVpSZgzDAg2YWcBoVOFztcVs0dHq39X9IIcsQDk0NZIBSxZVb-eK7TMH9Jhn3cvW0Nj-1OcfZdLZT5lYO9u5bP5V7PfoQmciZ37UqKFniwXZjLBoc6GSy6bJAJRiOqAo5zcs4EjQBs305V4FI1jznnRpmCghzkGX7nhNHma2x_80GB6fLZhKKqLQ22GKsPQtQMkh9Y1Q5pMQuKsueeIhQYE6XQLod-GpKMdcPwIG5ILz4uNiy2xeRS5kSYYY6dTWl0LkZyiIXx897Ooefo_DZkAkQWciEL1j0bVAPRUBQHkHP0yH8EReM0Ka1x_LsQ&sig=Cg0ArKJSzK_D1g1jdwVDEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9idWlsZC5jb20&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1529&vt=11&dtpt=1039&dett=3&cstd=477&cisv=r20240109.22606&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.148 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:22 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame D7F8 8 KB
6 KB 73ms
72ms XHR
application/json 2607:f8b0:4004:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_250&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b7b5b015854468976f123e00c7481249c212303cbcfc54666909280fbd7947c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5883
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame D7F8 17 KB
6 KB 54ms
54ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 11 Jan 2024 16:23:22 GMT

GET
H3 200 build-logo-white.svg
s0.2mdn.net/sadbundle/7448582456568971264/assets/ Frame D7F8 5 KB
2 KB 54ms
54ms Image
image/svg+xml 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/assets/build-logo-white.svg

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

64da77a7b7cb797fe8572834e798427dbb6102d10c8deed66ee1fea6049d2059

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:10 GMT
date: Thu, 11 Jan 2024 11:03:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19212
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1994
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 bottom%20gradient.png
s0.2mdn.net/sadbundle/7448582456568971264/assets/ Frame D7F8 46 KB
46 KB 55ms
55ms Image
image/png 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/assets/bottom%20gradient.png

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ed0344ab957cf3b3fcb5eacc95d0c68be162171559de7cc8c9bd3c353c8f9cdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:10 GMT
date: Thu, 11 Jan 2024 11:03:10 GMT
x-content-type-options: nosniff
age: 19212
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 47128
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 widerimage-8.jpg
s0.2mdn.net/sadbundle/7448582456568971264/assets/ Frame D7F8 49 KB
49 KB 62ms
61ms Image
image/jpeg 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/assets/widerimage-8.jpg

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9f8dc37da6743b52693004f714e7dfb5e33cd5c0969d23f13061d0b5fe1b542f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:10 GMT
date: Thu, 11 Jan 2024 11:03:10 GMT
x-content-type-options: nosniff
age: 19212
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50529
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 widerimage-1b.jpg
s0.2mdn.net/sadbundle/7448582456568971264/assets/ Frame D7F8 52 KB
52 KB 64ms
64ms Image
image/jpeg 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/assets/widerimage-1b.jpg

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eaa593d421974011848eee99bd7974e539d551ba35f58ffa50121fac22e041c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:10 GMT
date: Thu, 11 Jan 2024 11:03:10 GMT
x-content-type-options: nosniff
age: 19212
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52853
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 widerimage-10.jpg
s0.2mdn.net/sadbundle/7448582456568971264/assets/ Frame D7F8 45 KB
45 KB 70ms
70ms Image
image/jpeg 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/assets/widerimage-10.jpg

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0ffc768a89a4b9bd02bfc264672ec109d084e960c85f7297895cdf831a4ceeed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:10 GMT
date: Thu, 11 Jan 2024 11:03:10 GMT
x-content-type-options: nosniff
age: 19212
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 45659
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 AGSKWxXHYC4lbygCW5WIH9D1hAIw6_LL_5b7HZDRLjtzyXK_ByLa6sEPDB2n17wUBg8_tRl5I3OpyneD8Fk1oikGGIzZa1ch356BsVl_G98n-ZFeiK-N3wmJGALAgvaNJrzB-BnmFZqxRw== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 91ms
91ms Script
application/javascript 2607:f8b0:4004:c06::65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXHYC4lbygCW5WIH9D1hAIw6_LL_5b7HZDRLjtzyXK_ByLa6sEPDB2n17wUBg8_tRl5I3OpyneD8Fk1oikGGIzZa1ch356BsVl_G98n-ZFeiK-N3wmJGALAgvaNJrzB-BnmFZqxRw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzA0OTkwMjAyLDY0NzAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMCw5XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9iaXRseS53cy8iLG51bGwsW1s4LCIwZ05ObWRPM3ZnUSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxOCwiW1tbMF1dXSJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3ea2b57232d5c37d2ed7e26067c092c4ba98c523cb2d7d6f71880727bf7e0994

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-xPnI-fXtaDpJQG7p_TR_VA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:22 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-xPnI-fXtaDpJQG7p_TR_VA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame D7F8 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3 200 build-logo-white.svg
s0.2mdn.net/sadbundle/7448582456568971264/assets/ Frame D7F8 5 KB
2 KB 53ms
53ms Image
image/svg+xml 2607:f8b0:4004:c08::95
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7448582456568971264/assets/build-logo-white.svg

Requested by

Host: bitly.ws
URL: https://bitly.ws/?banned=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::95 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

64da77a7b7cb797fe8572834e798427dbb6102d10c8deed66ee1fea6049d2059

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7448582456568971264/5326842_BLD_Display_singlemessage_v1.html?e=69&leftOffset=0&topOffset=0&c=dnfvMuqiVw&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

expires: Fri, 10 Jan 2025 11:03:10 GMT
date: Thu, 11 Jan 2024 11:03:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19212
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1994
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:35:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 MCFrRHZE15CKjvM6RLwmjguI7mqh03m56A7oA9GJNi8.js Show response
pagead2.googlesyndication.com/bg/ Frame ED49 39 KB
15 KB 53ms
53ms Script
text/javascript 2607:f8b0:4004:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/MCFrRHZE15CKjvM6RLwmjguI7mqh03m56A7oA9GJNi8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30216b447644d7908a8ef33a44bc268e0b88ee6aa1d379b9e80ee803d189362f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 15:37:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2757
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15229
x-xss-protection: 0
last-modified: Wed, 03 Jan 2024 11:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 10 Jan 2025 15:37:25 GMT

POST
H3 204 AGSKWxXVzkGxZo9eOZVkxVsRquxzgSgohYmQsMwKOd8D773CIQm71sjzXg2bVc_DUrXs2W-_0VHXaOegEe7vKFFiSqr8NlpMIjazi7MVggCuvfe4xGCJAhpSNzElev_163pfAxlyBcmYTA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 78ms
78ms XHR
text/html 2607:f8b0:4004:c06::65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXVzkGxZo9eOZVkxVsRquxzgSgohYmQsMwKOd8D773CIQm71sjzXg2bVc_DUrXs2W-_0VHXaOegEe7vKFFiSqr8NlpMIjazi7MVggCuvfe4xGCJAhpSNzElev_163pfAxlyBcmYTA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-O91aGaP7kD7oTXU9x9nEEA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://bitly.ws/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 11 Jan 2024 16:23:22 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-O91aGaP7kD7oTXU9x9nEEA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://bitly.ws
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxXTC8aXmCtUWSCovQuVLoVubgUAay_ElS_WUidA2tuZd-NZOnu5HTxsRrvrY8EwDkZ86hqC-s7WqmK34SE0Og2U8b9Xg4SQyiRdf5Y8isPkR7X1Zs7zUGxAFnzGzEol3mpRqEdUBw== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 79ms
79ms XHR
text/html 2607:f8b0:4004:c06::65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXTC8aXmCtUWSCovQuVLoVubgUAay_ElS_WUidA2tuZd-NZOnu5HTxsRrvrY8EwDkZ86hqC-s7WqmK34SE0Og2U8b9Xg4SQyiRdf5Y8isPkR7X1Zs7zUGxAFnzGzEol3mpRqEdUBw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-6fzZsVVwaxrXmZVdAaKx4Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://bitly.ws/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 11 Jan 2024 16:23:22 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-6fzZsVVwaxrXmZVdAaKx4Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://bitly.ws
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 80ms
80ms XHR
application/json 2607:f8b0:4004:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20240109&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401020101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a083351975039932a4a2f136474185e7e4590b7243659d2c20e164712e855689

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12259
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D36A 0
20 B 83ms
79ms Image
image/gif 2607:f8b0:4004:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=Bbw_k9xWgZb_LH7jRxtYP2cq0uAQAAAAAOAHgBAI&bg=!TE-lTwDNAAaumcC-jpk7ADQBe5WfOOOymMXGTLaMZCouFHgL3Q8sTKixCdCIBiCW3DeaSLrmGFqrIRu4fD3XBoHwuumjAgAABMVSAAAABWgBB5kDAB5F9-AKep5QtWIcb-N5BiqFbR2OlyEUfN-6ybb2pA-XoaHp0LB0CQ5O7750TcFpyiOF60cSLGdXghWo9U4dO6UM2Kke0ACks1Q6RM3OfU1uZm_zhOTuUhJhdIaO0jAZ0B28vyV6OIJbb1sCV8zyCS8aTeuVlyqCxrhacJRpqrU-W3Y8dgI78jE2xrTAhGYH0a17u9sSpj64xrvGXwPx6A5iDG2rW-8w5rrvKh5jQteWZelFXnKv3P4rg0S3T252Y0zngHfN4O9KrvUScaGQNzET_dJ3e9rqRlH5GPkuOyipU6xj7up3DOCzRgZWMND_xy-G_Xcja78F1zgrelY1FEc-SSfUM_ulLTTqeCgybH_vIrNTmfQ1Uc9AegX9vbJ7SGYJXSAbJ2Yiu7FtwbayoPfmKPt5AAPiKddaBiDw2PX5c9c7vTo6XT7HJyQBItZUAjaVl-C9fpeDXdpB3EmYFPRua2LXIbBqx2UPSRBcCffzzbTVfhEHrIcPPCjj-wIgw3ucFO-HfhSvAlyz2d1ZGSK63tkjinamVzIH1kI8qfVK-9WDBic-ukePLLEPtTNojz5V0W2ZDIn1lrz-AToC-nAZv_VItD6YdhmL0qmVzrvR7h_xrFQJjhl4VIjvnfXc0KgQjaR6BnHzrGi42dZqpth_LQB7iy2a7ALNxnZoJtr51uAkSDn7EJQveToNLb_juD-XNBBC-k5_I94_liLq_vWtnN9Xg6iFzbPW7WBHXxt_arLQwBKeTWgK30MNOt_goO2GKovSxPer68sRf-ADWh4F5BUvU_7cmKzFTPWe2urqWEYKroahMtmvy5x9UlSIWbWvvSL9numi-E-Ivv6hrNQkd1j_I9BSUFvmer1doMG1Yzx5HJBK3Psp1W7Z63z1Z5QVHkU2uVIXv2wd8e3WWHmdNMflWkxSbpRhPD2u_AXxDEI41QecNWm9Xq3viuZUIB-qqn_Gz3Z2F3ouCKQnbJiF5JLWzgu6OP8hRBjUaPiemrFFEmHp76uCPb-Jqjjlog

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 56ms
55ms Script
text/javascript 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401020101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 11 Jan 2024 16:23:22 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 9E6E 42 B
64 B 116ms
115ms Fetch
image/gif 2607:f8b0:4004:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsswzFRqECimRUlN49C3YnxsTOswX6F8cI0m0_XD7X8l-cfeGUf7L-lkx_CI5vPvsgGOAAR5gsmCnl92YhVqg6iJ-Q_KoR8QeJOPENrTYIaIYWXK4aa6SAvHKmZCgjOaFJmDBMOhoQZX0nGWkCo2tHStukCH&sai=AMfl-YQ2BPadQbLpLwesvcErVCG3bq-HkPzG2bRMUk1E_VR0296mjuHr3bO6oICWjDIzY5oW_bTs52TM8MDc1R5xc-GHZtQAxAFBzfBPJ8jfV2qOg4doJusOwlW_vA_9PWMKphiM72XA_06Gsy_zoaRP&sig=Cg0ArKJSzK9oau3k4udmEAE&cid=CAQSTgAvHhf_QHIoYXSdp6hmu4ZRT6K_Mk8ll07HIwqevYuqD6yYW_lTW2S0M2vKovPsAt5sRV62pQYcFszCiiLmPmPQAcbwXbY6CsCxjzdBmhgB&id=lidar2&mcvt=1012&p=0,0,200,1200&mtos=1012,1012,1012,1012,1012&tos=1012,0,0,0,0&v=20240110&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=624732521&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1704990199341&rpt=2595&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 344A 0
20 B 81ms
80ms Image
image/gif 2607:f8b0:4004:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=Bmoai-BWgZcj3H-fqvPIPvL21wAgAAAAAOAHgBAI&bg=!1dal1pnNAAaumcC-jpk7ADQBe5WfOFkYy68rG54YKKc9suiCNTMesjyQTjaICuFugSPXcTy06qJ_6C1tsgR5O5lF3KjEAgAAAaFSAAAAB2gBB5kC_UidU8uln_wOXba3n08tr41iChgvR8SmFqhm9jIglrMpIh-TrVm3uOSdT3pGexz3_GlHWGHk06GLmJhvM1v9Qa716RzynllfxrfVzBYVJDlnrngOePMNURhPWm8bclzEBD3A3wYha5KvQq9XmOz40qcun0iOEZLU1tYJ76EdlUV8FtGgeOpFLnz0AbxIsrjYV-dYs5Ui8WOtgfSpxFAvCN_lfujpP25yeuWRw_rT2bz6KZ0BmVzSCU884RNG_w-qW5YI4c_AimalZPsgK8J9vs_LgJOBIJoXbrfQo6xr8uaTgMMehTUajHbhfTNANbmoFE70xHXleaJ8GnHs6UKCAATe0WyfxnE09SRK-m_KCLsfI_xZHi2RxQrDRpEqZc-kwtjt_nlUxOw8o3GVTym5wR1x7NVicvGa6HpwVWnuaGc47jFRlQmLiuEiwwvR_EaOrNkirIjQ2KkyIgcMabN5ejuEVi98LgrC-EGfVTCi2mEk_F84fgBxd7uqbMsTp2Y8PtXskPZhowN96W04icnakohdliGoG3HafjdKP31wuimyxthUBNgvFI1iuO4RobHlE4_Dq4L_RYRgus3n0XypN2tA0r98QOUKob1C01yOoHtpEyWLNFsgS4ZMUghL_iMA-PEe8k0-DcVWqrIjqZuFv2509M9FSPTWdbMhoUlZkHdJysCWnXzBvpJIoBr36Ju1yVTIs2pdn-S-pLPjg6nijmhQvLlBJfxpSXd9cHyAUPSIs1jBbmBkbj92_nKqSZ4aeQGs0-2G3eS0Aq93f7_T_rOmvksiicM6tzhwvqe3_fRq_7PXpQg0Gx6vPXAultFB4ikPwfJyD5IL_x9lUBFqoi9jyl55BOoISiURaft7mx9fwKO7T36tOFwNsGpxaOdcJWQgE78_OCP8XywrLuZoq5detN3fnAYUTu28W9amgFdFw436O5biwcu7enkWa5qCZjfKpwsApgmDW6rvMJTzHIf82CtgvQt3tgKvB8WEXu6J1GYsiD3wqsm6ZkPa2A

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Jan 2024 16:23:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame A84D 13 KB
5 KB 55ms
54ms Document
text/html 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bitly.ws/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 650
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 11 Jan 2024 16:12:33 GMT
expires: Fri, 10 Jan 2025 16:12:33 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 0F99 829 B
558 B 72ms
70ms Document
text/html 2607:f8b0:4004:c1d::93
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1d::93 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

ca83881ffd0e4555df986404a91bc1e028fabf300453de928b5b9a9c5668040e

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-cBG0i9tWFmn_vc1wn1yH_A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://bitly.ws/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-cBG0i9tWFmn_vc1wn1yH_A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 11 Jan 2024 16:23:23 GMT
expires: Thu, 11 Jan 2024 16:23:23 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 MCFrRHZE15CKjvM6RLwmjguI7mqh03m56A7oA9GJNi8.js Show response
pagead2.googlesyndication.com/bg/ Frame A84D 39 KB
15 KB 56ms
55ms Script
text/javascript 2607:f8b0:4004:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/MCFrRHZE15CKjvM6RLwmjguI7mqh03m56A7oA9GJNi8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30216b447644d7908a8ef33a44bc268e0b88ee6aa1d379b9e80ee803d189362f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 15:37:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2758
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15229
x-xss-protection: 0
last-modified: Wed, 03 Jan 2024 11:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 10 Jan 2025 15:37:25 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 0F99 0
0 109ms
108ms Image
text/html 2607:f8b0:4004:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20240109&jk=130113169792481&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c0b::9a Ashburn, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame A84D 0
10 B 53ms
52ms Image
text/plain 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?zaNkTQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c09::84 Ashburn, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 16:23:23 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 113ms
112ms Image
text/html 2607:f8b0:4004:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20240109&jk=130113169792481&bg=!_v2l_bLNAAaumcC-jpk7ADQBe5WfOLhgv2SvKn8LmjmqXDinqxhw8dxUV1H9ZUar0DYAi4AG8qBmjlpPKE2UwyvZYdfrAgAAAHVSAAAABGgBBwoAWd3qStQWc4g-QVf96ekhmQfJ2ejMD74ARZKRaf4H0TBfrJ1YPMWbFnJSEMyU9NC7y-2hOeh8v90TTa5198iTBi75FWtPT8UNk-DQthzNj8d9FtHT6Vk40dCPmQK6AZAIpHaRup71ezs9ZDrdCyzJvWrFqN2YWmMRxk1XNZBb62jV02FumoYY_xvgdYtMMzKuTn5HAs80c1uddNnV3l78Lv-HiLGeErHMsjS-WvG20GFvM1eQsLhZr8_5HaFMRoD3jBOzx19Lc5USETwW9uaM368WJrNj7m42QPSj0ls1NDMyZ4oDjdJozDB46ANeSKxWe8kUJNStIGetLdVX4l5Gm8iywwOfXycx_XDnyeOofZ3Zk--EjJTkGatxEUC-DAJAtErUtLPGIFG-Q8Wqe1ujqeu7UOrKkmnlqeFY89DT7UaufvaL0ZUlcE8Xw6RtP-BFmbmwsY6yIy8LDaFBYIyJBe90YwQhSGqhpGtm5qRCp0nJfE5U10WnEeSPRR5MaB1o31tnDgfEV8c50plqtJ7ef-Az-qyXuY-zGQh0s3zsAcJCNt56gGk92-WMxZ9_MUkqfBUpRv4KCDd88CPU55iiw9SL7ihsoMKVUAugKt8OoafIxzTFfPt-m8M5TxQoW09exiZTRfDDgVbrgkA5ULecbdCZNiyXgTNE6iOkopKRPLKHu2ZLpa7bO9dAy9dr3mtnge2LnmpWVBbP8nfuKiQs-t-PufN_D1C0cuyNO_TlyqwrosrvI2gydeo54Gdk7eF84ZB0Th9ePzTlJLUdvvz7WOvw2iEmYpqg8EFDz9xwgM0n4qov5aBbmkKPIxFn3lgloqSfKhjVqwg9-VIj98uEoYHrGetQAqUWWHdioIzw6uHUQTC_ZXakgU82BIg6k2dLbE8vpLkElBiF3kB9umPly1BdSZSchKCUGILErPx58QlWOW0IuelOKzj86_7IRZB1HvMxLktvNp-xC-hOq7_ugBOFKMPJCrE4MQYLKSNIeilG0Bm0sOKfPfhA42_nio_6879NMkMgBgYuuVG1OypEiUbNqoQThVk
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c0b::9a Ashburn, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Verdicts & Comments Add Verdict or Comment

74 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

28 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.bitly.ws/	1970-01-21 03:12:30	Name: _ga_8Q1W6PKNCX Value: GS1.1.1704990199.1.0.1704990199.0.0.0
.bitly.ws/	1970-01-21 03:12:30	Name: _ga Value: GA1.1.2262019.1704990199
.bitly.ws/	1970-01-21 02:58:06	Name: __gads Value: ID=3929c70fa9b2d5f8:T=1704990199:RT=1704990199:S=ALNI_MbAmfHEUadIcooKUzOXMqiGpElkIw
.bitly.ws/	1970-01-21 02:58:06	Name: __gpi Value: UID=00000db654b972d4:T=1704990199:RT=1704990199:S=ALNI_MZ5RfcPNrvSfzheRJ-hBJ15SMYmYw
.doubleclick.net/	1970-01-21 03:12:30	Name: IDE Value: AHWqTUnxWGn1WsUcLzMZ0E3RBmen6YoIsO3JrSkJlzJAjLPRfaRMErN12aNlI33KBbY
.casalemedia.com/	1970-01-21 02:22:06	Name: CMID Value: ZaAV.Yn6H9c8ApF42H99cQAA
.casalemedia.com/	1970-01-20 19:46:06	Name: CMPS Value: 2787
.casalemedia.com/	1970-01-20 19:46:06	Name: CMPRO Value: 2787
.doubleclick.net/	1970-01-20 17:36:33	Name: DSID Value: NO_DATA
.adnxs.com/	1970-01-20 19:46:06	Name: uuid2 Value: 4774621944103303367
.adnxs.com/	1970-01-21 03:12:30	Name: XANDR_PANID Value: 3HDWHDgKM8qxGsS2sunwGPzsJiGVF6CQagRDwRi_4o6ilFfgwN_YwPBr8Sxgl5oAYxQyGLcNSXYhtoZlYU7iG89VByIt8HyGN9gvnjIpyew.
.adnxs.com/	1970-01-20 19:46:06	Name: anj Value: dTM7k!M41.D>6NRF']wIg2In:LKd@Y!A#F9.TOKKnyW<U1`VROYQM-:TAvYE[RZ*O@/(AzcNEIPDd%<e@n!S:jMC@M/X%W#.wL4W1Qw1k^sp]h
.everesttech.net/	1970-01-21 02:22:06	Name: everest_g_v2 Value: g_surferid~ZaAV_gANwJaTAwBd
.owneriq.net/	1970-01-21 03:12:30	Name: si Value: Q7582766021950341305P
.owneriq.net/	1970-01-20 17:50:54	Name: p2 Value: gguuid
.owneriq.net/	1970-01-20 17:50:54	Name: gguuid Value: 1
.ctnsnet.com/	1970-01-21 02:22:06	Name: cid_77140d163abd4cf9a603de3441f830a2 Value: 1
.ctnsnet.com/	1970-01-21 02:22:06	Name: gid_CAESEGobCHrMfWt1mYzT8kBC1vU Value: 1
.rlcdn.com/	1970-01-21 02:22:06	Name: rlas3 Value: qwyu6I2J9NQSNZjLuO96tmthOAOQM7fpR4g4a15G3V4=
sync.srv.stackadapt.com/	1970-01-21 02:22:06	Name: sa-user-id Value: s%3A0-f0c45fef-1d23-5718-747b-ce8a6b553d64.wJgCWDXNYP%2FrabBCegauWCToyzliZz6yKGgTGIU7Rbw
.srv.stackadapt.com/	1970-01-21 02:22:06	Name: sa-user-id Value: s%3A0-f0c45fef-1d23-5718-747b-ce8a6b553d64.wJgCWDXNYP%2FrabBCegauWCToyzliZz6yKGgTGIU7Rbw
sync.srv.stackadapt.com/	1970-01-21 02:22:06	Name: sa-user-id-v2 Value: s%3A8MRf7x0jVxh0e86Ka1U9ZCaEdk0.I8B0Wtg9H6pi%2BfyE6kwEkZh1XxVYA866CNvA2TBqK9Y
.srv.stackadapt.com/	1970-01-21 02:22:06	Name: sa-user-id-v2 Value: s%3A8MRf7x0jVxh0e86Ka1U9ZCaEdk0.I8B0Wtg9H6pi%2BfyE6kwEkZh1XxVYA866CNvA2TBqK9Y
sync.srv.stackadapt.com/	1970-01-21 02:22:06	Name: sa-user-id-v3 Value: s%3AAQAKINs5fA_N9ZazmHCppWCJXnHta0A5oSbX6bDrSDnxLdeTEHwYBCD6q4CtBjABOgRvD7diQgRsK1mR.i%2FYDQz%2Bv5kx%2FtzLFWBh%2FotYg6Hhp%2BX5hNU2wIDuzNw4
.srv.stackadapt.com/	1970-01-21 02:22:06	Name: sa-user-id-v3 Value: s%3AAQAKINs5fA_N9ZazmHCppWCJXnHta0A5oSbX6bDrSDnxLdeTEHwYBCD6q4CtBjABOgRvD7diQgRsK1mR.i%2FYDQz%2Bv5kx%2FtzLFWBh%2FotYg6Hhp%2BX5hNU2wIDuzNw4
.rlcdn.com/	1970-01-20 19:02:54	Name: pxrc Value: CPqrgK0GEgUI6AcQABIGCOndKhAA
.googleadservices.com/	1970-01-20 19:46:06	Name: ar_debug Value: 1
.bitly.ws/	1970-01-21 02:22:06	Name: FCNEC Value: %5B%5B%22AKsRol9eym9Og-s1TiiW4ZxmNkbvpEQsREfRLnA5lgaGOF6bRw_qS6Fuk82hU_Hp4GM4wZrZ0-p9CZNXWJyLp9MEEFSlEfugm-x2lBPrdq4ighH5TQFRaxD0uXxtLel8OqqSdJITA9ouWv3byWSgHfEXHP2oWckf4Q%3D%3D%22%5D%5D

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.doubleclick.net
bitly.ws
cm.g.doubleclick.net
dis.criteo.com
dsum-sec.casalemedia.com
fonts.googleapis.com
fonts.gstatic.com
fundingchoicesmessages.google.com
googleads.g.doubleclick.net
ib.adnxs.com
id.rlcdn.com
ius.ctnsnet.com
mp.org.pl
pagead2.googlesyndication.com
px.owneriq.net
s.cdnsynd.com
s0.2mdn.net
sync-tm.everesttech.net
sync.srv.stackadapt.com
tpc.googlesyndication.com
www.google-analytics.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.paypalobjects.com
www.temu.com
104.18.36.155
104.66.251.81
142.251.167.148
151.101.2.49
172.253.115.155
172.253.63.154
185.11.100.204
192.229.210.155
20.121.97.20
2607:f8b0:4004:c06::61
2607:f8b0:4004:c06::65
2607:f8b0:4004:c08::5f
2607:f8b0:4004:c08::95
2607:f8b0:4004:c08::9b
2607:f8b0:4004:c09::5e
2607:f8b0:4004:c09::84
2607:f8b0:4004:c0b::9a
2607:f8b0:4004:c17::8a
2607:f8b0:4004:c1d::5e
2607:f8b0:4004:c1d::93
35.186.193.173
35.244.154.8
52.23.209.187
54.210.237.164
68.67.160.76
74.119.119.150
0059cb4ff0a271382c38af8a7367aaf45cbeb31449637d3928d25317401e2828
09ae30740d7efa16807978e7afbd2e6367bad9098fd863390ba2476d8a6cbc13
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0ffc768a89a4b9bd02bfc264672ec109d084e960c85f7297895cdf831a4ceeed
17774266115cd205b172904b059684e1ac5eb1ffa7f3e690d53ce7264be05ef1
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1ae6619173f92af4f0201b7204322213c714b56df437aa7d6482a1c141d5337c
1ff2fb733c2070049712d4395073deb3840a78737f80db8a4ae9a20bd6aa0d09
21ee655039db952f817a7f32a080a0e198ff8d0e568d0fda13ba14602efd283c
2afb3cf38deea01d461f29b961c8aab0da4f121a84a9c843f49dc7cced99b6a5
2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
30216b447644d7908a8ef33a44bc268e0b88ee6aa1d379b9e80ee803d189362f
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
31d02f43dd0c7fc5c0d95db087a23f1c2d729c93f10450884c8da6b415f7839b
31eba576e56105b427cc5072fdf87a2334b63d15933402686268d75dd5d9c69c
32ab0a5c85cabdb695704b5128a8fb7c9a8dfa3242cc36ceda6bb0650a45b35f
369ee07f1efb77d297d3bce2b4aaf066c676255b2e9d026d9d3768d63a150499
3974624ff80521dbd81d3ed32f8ec10c7baef11c272f46626a6284538e90e44b
3b4e4807190e52f7c1968c62069645480cd7b9562a4a949e865f418369b75bde
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
3ea2b57232d5c37d2ed7e26067c092c4ba98c523cb2d7d6f71880727bf7e0994
41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd
428f4d59e61cdf9887ad4cd7c4592a24b214d2d9c0ba09db01c4cfde66a3cd11
435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f
49e66fa1a3b9c0e5f45eb825c648e14da1bb0aa7163c05fb167f43ceebee6a24
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e17f25a33727defde4f0e88b24844c00e48ed88484c4440d978025a82567287
5176454ff2b23ffbdbc2d7a4415779612c7f1d26743a816df984044421159673
54339f1c8cb089c05773b2b18fd5da6e702956decbf7dea6ef0348a64203c657
559ed27b48f52ad1c65466a95a120b8264f7dea4a23d31f2ebb3b5beca3321f6
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
56e70c2fea595cdb15f418a8f79227fd5cb5838e2ee6e56fd44abc63e2cfa239
5c47674d2d9f45991f5aad3960ec96163fcd71f0c55f188ae25c22bfda5cf3b7
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
6494566919e28711a1f36d6389923dfccb4750fb9522e9e6d1967ab778ab0073
64da77a7b7cb797fe8572834e798427dbb6102d10c8deed66ee1fea6049d2059
65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98
675f6b6dc673aae01f8ef949697ee544c8df8574ca090a4dd690776ec6e442ea
676b3badd1c6d8a0ba12bfeb9233264c968aace3b80cfedf6e9b4faedd27f3ea
7a519c62e734157227e61ce5209158e1b7b484b5f2b68e3ccaed1ffe444de36d
7ad9ba0ea59d8d692e78af538e8a4d25c67db0c58f702dca9ed0830a0e04ca74
7d07a2bad8c5739b856dc542d79740e0b73dacd426419c488119e8438c17d136
86ee0e760c043b495df32283b44ba844e416df4ac5189fe6a0d801c781e35125
8a7f4d0dace49ce143b43f43372cf0b58d479e4393523bb91ceaae407142e4cf
91c86e76693fc278899037d0d8a66c2fe01fc83e5cbae1a54a47fe0f61b2be15
92d0d73346c5979ecc715fb56b82d9467b8b227feb7a554115e01615a3812888
972f7a26f860f2f122dcf2a4c5cae616df3a4a83e0c8318a1afb824c766fb651
97c530c44249746307c2b01b37eed0f53757d139bc4243798f468c71da9844da
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9f8dc37da6743b52693004f714e7dfb5e33cd5c0969d23f13061d0b5fe1b542f
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a083351975039932a4a2f136474185e7e4590b7243659d2c20e164712e855689
a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45
a577e10a3a46838e76353daf77921010aef6fbaf01fbd4867ad39b7a2466f9c5
a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678
aacb998495fd8dbb90f9a3297e6545b3bc62f9380fdb4e5b2594ee3544805801
aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed
adce4b2a52b21394dde912da1339a634858804494faade9cab2b7fa67333606f
b11dc47889de3326bebc34326b08c225799df4a275b28db686c6e3482b3f4bd7
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b41835ad763abb366c167dab7c1fbc77a7a81e5bbc51c2ce66bfa5250bfc9a00
b56fa83d9b2a2533d3111a4b1ff790588ceef64fbe3cb03bb0120f2719d1c5d4
b7b5b015854468976f123e00c7481249c212303cbcfc54666909280fbd7947c1
b8214bd5cbd9197f329d1df98d908dc7a1cd38c28e8010b92e49b3f35dd9986a
b8e20420db3d0e7e5ac332949e7ca3d380edeea32cfadf677b25944362011dc7
ba02e591f3b8d15e9361017c112d3b461218191b09e96f7b3660d07df1738804
bca23272d45ca793486169369bdcde8ff1258b0b932c86ebc0f2fad2556c990b
bddbf7e9ab14ce92ecc37640bf54fcb90d8a02da52d87ec12e252cfde4432e66
c28530634cdfc14bb5c068fc74a7071f9e27fc97f9aa03a1258f5b33f9c8ab6d
c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146
ca83881ffd0e4555df986404a91bc1e028fabf300453de928b5b9a9c5668040e
caccd85a1282fd19360b2d465363a858ccfbf9146c3663ab602e03ec0280b481
cca91000f734b29920238acfd5b89ad375215a5dae2cf669dcf81fc318313842
cd21760834bc90538beefd492d28298f5b2232c200b3b7dc288d35facfbfdbe5
cfc5afa3cbf80ed8a39987d2f4cc9215f915cfde9c83e86d5ee4a874bd69a401
d58acf16b5e4521c9eb24fe9fd97308e5f8be1297e4b63a547e5b610611799ae
da1b1dba110f3d97894949bedfc60fe7fec3659813c957f88e51d550bc95ad88
dd50ba290f74d344ad0d04ade63c55b02360bf4db99c0a2749f34deb0c8dcec9
de1b97b2acff4d32e41cff57769e87f175e01ba52dbc8448f82172eea2969e54
de99107f47082162344c66c65af6050bb394de148e68803d31dc4d6ce362748a
e13459782d7fc46c73821602bedc17cc2b3a2dc5ec07e91e30ed715193698a94
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e52ad60cf8269c44381d5e0833e69b9b8f3b9f9346b7066b1dc5a52b390feedc
e6b20a1535a6d3ca3d7a611ae199a6f4b464e0b67b450379ed43a7ef3e66957c
e8a46037aede54df0aa9423e7beda6f4f46522d2df33f21cd48aa9b5eddc39a0
e8ac930f3f5af6602d691cceca2121a1bb7e6742df19e64e353f9ddcc2d13f62
e93b8c0ae5b5910b7107c8b455eda029935c56efa8de0be2443d8eabba207197
eaa593d421974011848eee99bd7974e539d551ba35f58ffa50121fac22e041c3
eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987
ed0344ab957cf3b3fcb5eacc95d0c68be162171559de7cc8c9bd3c353c8f9cdc
ed88d5a1c97dc43c114c0b289b3b5abf077be44e8e8765a9ad777f94af433411
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f058ecc947d0bc01e2855afaff0be17a2e30ae1e067ad3a5389b986a62225e26
f0e1a14a5e1952dfc9554516a0bac963a81c024b09dadde696d2fbd1398cde62
f2f3806a938e3c386f41670b854e5e10f7e5f5382727ec8e601f1909f7072087
f98d53c3c3a2b4eb912b7013284a9e2f148c5ef1c34433cdadd1372960f3ea08
fe40b8037500ad7a98967c41af17e3dda074a285b8597c9d2ae9de45bda5b287
fffa14e9a3c576087a9202af54e8f11669f29c37617df0c6f728ca24d95f60bc

bitly.ws Open in urlscan Pro 185.11.100.204 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

166 Requests

91 %HTTPS

42 %IPv6

23 Domains

28 Subdomains

21 IPs

3 Countries

1871 kBTransfer

4905 kBSize

28 Cookies

4 Outgoing links

Page URL History

Redirected requests

166 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

bitly.ws Open in urlscan Pro
185.11.100.204 Public Scan

Screenshot
Live screenshot

Full Image

166
Requests

91 %
HTTPS

42 %
IPv6

23
Domains

28
Subdomains

21
IPs

3
Countries

1871 kB
Transfer

4905 kB
Size

28
Cookies

166 HTTP transactions
4 data transactions