shells.red-pill.eu Open in urlscan Pro
46.150.36.137 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://shells.red-pill.eu/
Submission: On December 07 via manual (December 7th 2023, 5:17:58 pm UTC) from US — Scanned from DE

Summary HTTP 81 Redirects Links 21 Behaviour Indicators

Summary

This website contacted 23 IPs in 5 countries across 15 domains to perform 81 HTTP transactions. The main IP is 46.150.36.137, located in Skofja Vas, Slovenia and belongs to TELEMACH Broadband Access & Carrier Services, SI. The main domain is shells.red-pill.eu.
TLS certificate: Issued by R3 on September 22nd 2023. Valid for: 3 months.

This is the only time shells.red-pill.eu was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
12	46.150.36.137 46.150.36.137	3212 (TELEMACH ...) (TELEMACH Broadband Access & Carrier Services)
1	2a00:1450:400... 2a00:1450:4001:80f::200a	15169 (GOOGLE) (GOOGLE)
10	2a00:1450:400... 2a00:1450:4001:803::2002	15169 (GOOGLE) (GOOGLE)
1	2a01:4f8:c0c:... 2a01:4f8:c0c:b93a::1	24940 (HETZNER-AS) (HETZNER-AS)
1	2001:41d0:305... 2001:41d0:305:2100::4e16	16276 (OVH) (OVH)
1	2606:4700:303... 2606:4700:3035::ac43:9f36	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	81.171.28.46 81.171.28.46	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
2 11	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:81c::2008	15169 (GOOGLE) (GOOGLE)
15	2a00:1450:400... 2a00:1450:4001:81c::2001	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
1	2a02:2638:3::12 2a02:2638:3::12	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
7	2a02:2638:3::3 2a02:2638:3::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	178.250.1.6 178.250.1.6	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
4	2a02:2638:3::10 2a02:2638:3::10	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2a02:2638:3::1a 2a02:2638:3::1a	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1 2	2a00:1450:400... 2a00:1450:4001:813::2004	15169 (GOOGLE) (GOOGLE)
4	142.250.186.98 142.250.186.98	15169 (GOOGLE) (GOOGLE)
1	2a02:2638:d::c 2a02:2638:d::c	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2a00:1450:400... 2a00:1450:4001:830::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82b::2003	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
81	23

12 46.150.36.137 (Skofja Vas, Slovenia)

ASN3212 (TELEMACH Broadband Access & Carrier Services, SI)
PTR: 46-150-36-137.dynamic.telemach.net

shells.red-pill.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:803::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a01:4f8:c0c:b93a::1 (Frankfurt am Main, Germany)

ASN24940 (HETZNER-AS, DE)

blinkenshell.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:41d0:305:2100::4e16 (France)

ASN16276 (OVH, FR)

www.insomnia247.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3035::ac43:9f36 (United States)

ASN13335 (CLOUDFLARENET, US)

www.xshellz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 81.171.28.46 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)

www.bshellz.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81c::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:81c::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638:3::12 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

ads.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a02:2638:3::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.1.6 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

cat.nl3.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:2638:3::10 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

imageproxy.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638:3::1a (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

csm.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.186.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638:d::c (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

rtb.fr3.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
25	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 102 tpc.googlesyndication.com — Cisco Umbrella Rank: 148	393 KB
12	criteo.net static.criteo.net — Cisco Umbrella Rank: 631 imageproxy.eu.criteo.net — Cisco Umbrella Rank: 10143 csm.eu.criteo.net — Cisco Umbrella Rank: 9625	96 KB
12	red-pill.eu shells.red-pill.eu	93 KB
11	doubleclick.net 2 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 33	98 KB
4	gstatic.com www.gstatic.com fonts.gstatic.com	63 KB
4	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 138
3	criteo.com ads.eu.criteo.com — Cisco Umbrella Rank: 9522 cat.nl3.eu.criteo.com — Cisco Umbrella Rank: 10971 rtb.fr3.eu.criteo.com — Cisco Umbrella Rank: 16316	46 KB
3	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 206	192 KB
2	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 2	1 KB
2	google-analytics.com ssl.google-analytics.com — Cisco Umbrella Rank: 587	17 KB
2	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 340 fonts.googleapis.com — Cisco Umbrella Rank: 29	93 KB
1	bshellz.net www.bshellz.net	199 B
1	xshellz.com www.xshellz.com	16 KB
1	insomnia247.nl www.insomnia247.nl	48 KB
1	blinkenshell.org blinkenshell.org	11 KB
81	15

	Domain	Requested by
15	tpc.googlesyndication.com	googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com
12	shells.red-pill.eu	shells.red-pill.eu
11	googleads.g.doubleclick.net	2 redirects pagead2.googlesyndication.com googleads.g.doubleclick.net
10	pagead2.googlesyndication.com	shells.red-pill.eu pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
7	static.criteo.net	ads.eu.criteo.com
4	www.googleadservices.com	googleads.g.doubleclick.net
4	imageproxy.eu.criteo.net	ads.eu.criteo.com
3	fonts.gstatic.com	fonts.googleapis.com
3	www.googletagservices.com	googleads.g.doubleclick.net
2	www.google.com	1 redirects tpc.googlesyndication.com
2	ssl.google-analytics.com	shells.red-pill.eu
1	www.gstatic.com	googleads.g.doubleclick.net
1	fonts.googleapis.com	googleads.g.doubleclick.net
1	rtb.fr3.eu.criteo.com	googleads.g.doubleclick.net
1	csm.eu.criteo.net	ads.eu.criteo.com
1	cat.nl3.eu.criteo.com	ads.eu.criteo.com
1	ads.eu.criteo.com	googleads.g.doubleclick.net
1	www.bshellz.net	shells.red-pill.eu
1	www.xshellz.com	shells.red-pill.eu
1	www.insomnia247.nl	shells.red-pill.eu
1	blinkenshell.org	shells.red-pill.eu
1	ajax.googleapis.com	shells.red-pill.eu
81	22

This site contains links to these domains. Also see Links.

Domain
blinkenshell.org
signup.insomnia247.nl
www.xshellz.com
picrofo.com
www.bshellz.net
bitcoinshell.mooo.com
m-net.arbornet.org
yunix.net
netburst.org
devio.us
allamoox.wixsite.com
freeshell.de
fromhell.ee
lispshell.surge.sh
www.silvertree.org
www.arieshosting.net
www.eglide.org
www.nyx.net
red-pill.eu
www.aardvarktopsitesphp.com

Subject Issuer	Validity	Valid
red-pill.eu R3	`2023-09-22` - `2023-12-21`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
blinkenshell.org R3	`2023-11-19` - `2024-02-17`	3 months	crt.sh
*.insomnia247.nl GoGetSSL RSA DV CA	`2023-09-29` - `2024-10-29`	a year	crt.sh
xshellz.com E1	`2023-10-30` - `2024-01-28`	3 months	crt.sh
bshellz.net R3	`2023-09-28` - `2023-12-27`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.eu.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-01` - `2024-03-01`	3 months	crt.sh
*.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-09` - `2024-01-06`	3 months	crt.sh
*.nl3.eu.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-03` - `2024-02-28`	3 months	crt.sh
*.eu.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-17` - `2024-01-18`	3 months	crt.sh
*.fr3.eu.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-07` - `2023-12-30`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh

This page contains 13 frames:

Primary Page: https://shells.red-pill.eu/
Frame ID: B7BE28B375BBD78FA555390849025F5F
Requests: 25 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231205/r20190131/zrt_lookup_fy2021.html
Frame ID: 60D110795B5DEC117496673A4E017920
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&adk=1812271804&adf=3025194257&lmt=1701969474&plat=3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~4~6&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474210&bpp=2&bdt=151&idt=252&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=6824293562278&frm=20&pv=2&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=262
Frame ID: DC885F2DC736AFC8FCBE5A27B9CDF8A4
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=1720655930&adf=1779425666&pi=t.ma~as.9148949735&w=700&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=700x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474212&bpp=1&bdt=152&idt=263&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=451&ady=134&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeE%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=269
Frame ID: 9A073C733770E13A6F2C15B0A0D6A9AE
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=4210125070&adf=3359390731&pi=t.ma~as.9148949735&w=620&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=620x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474213&bpp=1&bdt=154&idt=274&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C700x280&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=491&ady=1543&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeEbr%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=275
Frame ID: BBD5FDA7BB5F02F9AAE7ECE03E303B59
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=4210125070&adf=207959090&pi=t.ma~as.9148949735&w=620&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=620x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474213&bpp=1&bdt=154&idt=276&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C700x280%2C620x280&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=491&ady=2955&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeEbr%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=277
Frame ID: A286891379A5D4B95471786E20875273
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=16&slotname=6474157215&adk=3479957199&adf=630464352&pi=t.ma~as.6474157215&w=468&lmt=1701969474&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474231&bpp=1&bdt=172&idt=260&shv=r20231205&mjsv=m202311300101&ptt=5&saldr=sd&abxe=1&prev_fmts=0x0%2C700x280%2C620x280%2C620x280&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=567&ady=3553&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeEbr%7C&abl=CA&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=262
Frame ID: 6BDC005A5AEBE1B9E92C86D14C658B31
Requests: 1 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=ZXH-QgAH68AIFUBrAANoJSJ6Ap2qisbuKo6Ftw&u=%7CG%2Bv60Ph38IplIh0i7lA2Xhe1Ty%2FaeUni6Ai1iJpEALU%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z2MBXjcXbJi6-EhecIdZLW9frBNKibvu7bNv6peVuYXNL6EIXiMKaC0MTamZ_LUSdqx58AcUOvsE-D8o_KflJTfMM5VMLWEp4zFRp7HR6TY8EYuMiPuzSvCfA0bsdSPKqQ9uKVzS0t8UPIxonNathyPii1VaTOQ55IGIAqwWzRkomB74umzKeBQ8XFURcJlh22SSmGmmawXb1PXBzEP0jWdzfgMne9MEawvtNDG75_HFCDpHnOnJcP-JkUdGoeOKIvnjnlN2fPOpgmg21wrzQLuHslidkJQDi2t3R-vQWm0AqZCI6uUqG1h_L39WSRQYKJIVKd7TsoUPSHmuSB_uX6k9Kcc6UMSHPHhQI1Cnemm3da85DXIkBp9-SW76H0Elwmahp-6QBHcUHfac1D41OQPqk4qUBxjizYZ_5GOZLQtM1vXbBeJSHw3ymra0CZBbNn1JwdUxN4CU4hVDVFRHXJNKBf4WcyqkzLkqNmkYfyCmr1xPm-PdJV4LNts_xCqTzGX7PsUA0axT7ajAAf9-Dhr3v8s5UuhXMfa2jzNpD2vDjh-ZS8YcbvYt-Z4edgQsmA&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCzo0IQv5xZcDXH-uA1fAPpdCNkAzJntKxXMWymPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTYwOTg0OTYxMjQ3NTE3MTLIAQmpAmTvV99zErI-qAMByAMCqgTPAU_Q9ng8swIRTGz710LYcqVULOJ6FUzzmLBr2oqjN0GykgE1aiHT-D2rgcOoBEjBm-_ZiZdDm57vFGuxou4LJ9VCDjFD3aXrjsZ-ndi0xg5mUYbeh5vlyEK-sGOWwFrosQM-K2Wk7eVp-MDf_Hly0Sl9V_9nSBXMNbEkm5Sl-s7emqmphVAiS3eM1wkATvY0RMCaxSDTdUQEieNCF1gl3H7KKI0tdxPghXPnCqZiAEvy5eQfJRa2Nm3dUnCrESnhIgN11XCmA0PPtbzs4O4-voAG9aedkJiV_rhwoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHQiA4YAQEAEyAqoCOgKAQEi9_cE6WLHnya_q_YID-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_3fAdm7Ayc0G8U5RVN6mgIOLDQ2Tg%26client%3Dca-pub-6098496124751712%26adurl%3D
Frame ID: 61376DC74D3D7FEABA5D5F15F8DB4BC0
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 155028FF73BB902E11902997D55BA926
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/1_7gewjyGlqcOFIguOJ5AHUn6L-zJDTVPaBHJ2ADYro.js
Frame ID: 5C439910DC2FF6AB7678E114C21CDE55
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/1_7gewjyGlqcOFIguOJ5AHUn6L-zJDTVPaBHJ2ADYro.js
Frame ID: EE28FA72538B663585EF363E936BE8F3
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 1C5F3BE5FA1C6C36A12E83E1404E961A
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 5872413E9573670070A86BF45FED695C
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Free Shell Accounts :: the biggest list on the net - Rankings - All Sites

Detected technologies

DoubleClick Ad Exchange (AdX) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/pagead/show_ads\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

81
Requests

98 %
HTTPS

82 %
IPv6

15
Domains

22
Subdomains

23
IPs

5
Countries

1167 kB
Transfer

2468 kB
Size

12
Cookies

21 Outgoing links

These are links going to different origins than the main page.

URL: http://blinkenshell.org/wiki/Start
Title: Blinkenshell - Free UNIX shell accounts

Search URL Search Domain Scan URL

URL: https://signup.insomnia247.nl/
Title: Insomnia 24/7

Search URL Search Domain Scan URL

URL: https://www.xshellz.com/
Title: xShellz.com - Free Shell Account Provider

Search URL Search Domain Scan URL

URL: http://picrofo.com/clinux
Title: Picrofo's Linux Shell

Search URL Search Domain Scan URL

URL: http://www.bshellz.net/
Title: Bshellz.net

Search URL Search Domain Scan URL

URL: http://bitcoinshell.mooo.com/
Title: Bitcoin Shells

Search URL Search Domain Scan URL

URL: http://m-net.arbornet.org/
Title: M-Net

Search URL Search Domain Scan URL

URL: http://yunix.net/
Title: Yunis Shell Server

Search URL Search Domain Scan URL

URL: http://netburst.org/
Title: netburst.org Free Shell Accounts & Support

Search URL Search Domain Scan URL

URL: http://devio.us/
Title: The Owned Networks

Search URL Search Domain Scan URL

URL: https://allamoox.wixsite.com/ashellz
Title: Ashellz - Free linux shell

Search URL Search Domain Scan URL

URL: http://freeshell.de/
Title: Nic.Nac.Project

Search URL Search Domain Scan URL

URL: https://fromhell.ee/
Title: Estonia Free Linux Shell Service

Search URL Search Domain Scan URL

URL: https://devio.us/
Title: Devio.us Free OpenBSD Shell Provider

Search URL Search Domain Scan URL

URL: http://lispshell.surge.sh/
Title: Lispshell

Search URL Search Domain Scan URL

URL: http://www.silvertree.org/
Title: www.silvertree.org

Search URL Search Domain Scan URL

URL: http://www.arieshosting.net/
Title: Eggdropshell Free Shell Account

Search URL Search Domain Scan URL

URL: http://www.eglide.org/
Title: Eglide

Search URL Search Domain Scan URL

URL: http://www.nyx.net/
Title: Nyx - The Spirit of the Night

Search URL Search Domain Scan URL

URL: https://red-pill.eu/contact/
Title: an email

Search URL Search Domain Scan URL

URL: http://www.aardvarktopsitesphp.com/
Title: Aardvark Topsites

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 51

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 52

https://googleads.g.doubleclick.net/pagead/adview?ai=CeMSaQv5xZcuoH6ms1fAP5LSZkA-Pyc_6crjxgN66EQoQASCFv7oVYJXikIKgB6AB7LPywAHIAQKoAwHIA8kEqgTYAU_QvRGGvOizrnjx2RxLmdr37bOQ7ANMtZc_-yxcbFRRka7egyOQ4sr8OPrvDx11eqbkqY9PJClaJn5ToxZK6iSXm1LpvZ8XsjoxKw22Uv7HqPAxhVhXaZBF-riLCxLySwue9H1ze1TlNIst_I9H2pBs7cE8FwwKAGSS10COK3rfL0uH28BbSJT2DfaNhhYHhiNhMU6gf0Vg_rPCkRLINYjbT8Yz3vPe1DzFxguZku23bQPy5OhO96sTFLoTaI8ITrI-VzaDjggJCLzWnfeiGwy9ZiAc-_eWicAE09_ctpwEiAWUudWySJIFBAgEGAGSBQQIBRgEoAYCgAf8y42_AqgH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcEEPv6AtIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpYhLbJr-r9ggOaCSBodHRwczovL21hZG11c2NsZXMuY29tL3N0ZXAtZ29hbIAKAcgLAaIMGCoWChTktLEC7rWxArW4sQKsurECu7uxAtgTDNAVAZgWAYAXAbIXHAoaCAASFHB1Yi02MDk4NDk2MTI0NzUxNzEyGAA&sigh=zzXc2eOAMIw&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTwDICaaNrbeMrxDeOttb6dfAbDIt_3gYlsXVRQc3Tg4jiobUBGLmBiYhHZ04kGgnzNnoizZvys1IdDmLUAKtfDlJDnGfbxaoRLaRaSr2ZnoYAQ&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%227678341205630548965%22,%22debug_reporting%22:true,%22destination%22:%22https://madmuscles.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22404527596%22],%224%22:[%2212-07%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%221369965594388838689%22}&andc=true

Request Chain 71

https://googleads.g.doubleclick.net/pagead/adview?ai=CMhAYQv5xZdmDH7W71fAPu9aWkAelueXXdKbjjbPfEdrZHhABIIW_uhVgleKQgqAHoAHg3ryJKsgBCakCZO9X33MSsj6oAwHIA8sEqgTPAU_QW70zaQbv8XIbcLPTK4bPmvpYxcDblN4q27L4IyvELGwBCcqyjVXlhuESo12zGMvVazY8smSn2GoFCG9c5UzTEMVFiY_pgCLwXJfQCzoFZatAyRc2l6ojbve6cZC78Una_7ay7_7QV5JWlfZAHlKPVkDPKVkO-CfwXJ2YQ1go1CyMKIs5rzJUkXWFAzeqS0Q0gf8G5r98GpXYTv1gqe8sjbIymQdjh-4sFP4safMnbknJMIQGI6HnGBO6o0XQ4LlbYAMaoVTX3yiMOagSQMAEk5umnMwEiAX31fWTTJIFBAgEGAGSBQQIBRgEoAYugAfglo3pBKgH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcA8gcEEPP2QtIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpYqY3Jr-r9ggOaCZkBaHR0cHM6Ly93d3cuc3Bhcmthc3Nlbi1sZWFzaW5nLmRlL2RlL2Zpcm1lbmt1bmRlbi9lbmVyZ2llZXJ6ZXVndW5nP3V0bV9jYW1wYWlnbj0yMjIzLVNVTV9UUkFGT0ZJLTAxLUwmdXRtX21lZGl1bT1nZG4mdXRtX3NvdXJjZT1nb29nbGUmdXRtX2NvbnRlbnQ9ZjAyYTAzgAoByAsBogwcKhoKGOS0sQLutbECtbixAuS0sQLutbECu7uxArgT5APYEw2IFALQFQGYFgGAFwGyFxwKGggAEhRwdWItNjA5ODQ5NjEyNDc1MTcxMhgA&sigh=FbADOyzWNNs&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTwDICaaNe-6Kaa6nFNVmSKcBzsgjraeTjbtAepzcXfvQfxzCb1vdWBzO_P-f31UXJG4GAx5osaSUY4HGrpNdT4JurjuGQPLFDr0LDGVhwj0YAQ&template_id=484&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2218386006282586202541%22,%22debug_reporting%22:true,%22destination%22:%22https://sparkassen-leasing.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211294158688%22],%224%22:[%2212-07%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2212976546612498687137%22}&andc=true

81 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
shells.red-pill.eu/ 31 KB
31 KB 151ms
47ms Document
text/html 46.150.36.137
TELEMACH Broadban...

General

Check archive.org

Show headers Download Go to

Full URL: https://shells.red-pill.eu/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 46.150.36.137 Skofja Vas, Slovenia, ASN3212 (TELEMACH Broadband Access & Carrier Services, SI),
Reverse DNS: 46-150-36-137.dynamic.telemach.net
Software: Apache / PHP/7.4.33
Resource Hash: 6e9e6a7af8feff441b57e350db4439938555bddf8a2c374b20af674b1e562fac

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-type: text/html; charset=UTF-8
date: Thu, 07 Dec 2023 17:17:53 GMT
server: Apache
x-powered-by: PHP/7.4.33

GET
H2 200 screen.css
shells.red-pill.eu/skins/fusion/ 3 KB
4 KB 26ms
25ms Stylesheet
text/css 46.150.36.137
TELEMACH Broadban...

General

Check archive.org

Show headers Download Go to

Full URL: https://shells.red-pill.eu/skins/fusion/screen.css
Requested by: Host: shells.red-pill.eu
URL: https://shells.red-pill.eu/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 46.150.36.137 Skofja Vas, Slovenia, ASN3212 (TELEMACH Broadband Access & Carrier Services, SI),
Reverse DNS: 46-150-36-137.dynamic.telemach.net
Software: Apache /
Resource Hash: c9634d0e4698e2f2f45ea005722ad4fd57b98845dbcf25fc2d1bed4163034d7e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://shells.red-pill.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:54 GMT
last-modified: Sun, 04 Sep 2011 15:41:57 GMT
server: Apache
accept-ranges: bytes
etag: "db9-4ac1f6f3bdb40"
content-length: 3513
content-type: text/css

GET
H2 200 jquery.cookiebar.css
shells.red-pill.eu/eucookie/ 686 B
791 B 25ms
25ms Stylesheet
text/css 46.150.36.137
TELEMACH Broadban...

General

Check archive.org

Show headers Download Go to

Full URL: https://shells.red-pill.eu/eucookie/jquery.cookiebar.css
Requested by: Host: shells.red-pill.eu
URL: https://shells.red-pill.eu/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 46.150.36.137 Skofja Vas, Slovenia, ASN3212 (TELEMACH Broadband Access & Carrier Services, SI),
Reverse DNS: 46-150-36-137.dynamic.telemach.net
Software: Apache /
Resource Hash: e664acc7bbabe41ea64e8517e2af2e0d426f719f32c72b911402f0ab40c35546

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://shells.red-pill.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:54 GMT
last-modified: Mon, 08 Jun 2015 10:12:42 GMT
server: Apache
accept-ranges: bytes
etag: "2ae-517fee1dc5a80"
content-length: 686
content-type: text/css

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.8.3/ 91 KB
92 KB 28ms
8ms Script
text/javascript 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js

Requested by

Host: shells.red-pill.eu
URL: https://shells.red-pill.eu/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://shells.red-pill.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 16:37:27 GMT
x-content-type-options: nosniff
age: 2427
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 93636
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 06 Dec 2024 16:37:27 GMT

GET
H2 200 jquery.cookiebar.js Show response
shells.red-pill.eu/eucookie/ 8 KB
8 KB 26ms
25ms Script
application/javascript 46.150.36.137
TELEMACH Broadban...

General

Check archive.org

Show headers Download Go to

Full URL: https://shells.red-pill.eu/eucookie/jquery.cookiebar.js
Requested by: Host: shells.red-pill.eu
URL: https://shells.red-pill.eu/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 46.150.36.137 Skofja Vas, Slovenia, ASN3212 (TELEMACH Broadband Access & Carrier Services, SI),
Reverse DNS: 46-150-36-137.dynamic.telemach.net
Software: Apache /
Resource Hash: f16e8128eca1d20ddb6e1f2d5e93d552679880773674779357afc9afa6253866

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://shells.red-pill.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:54 GMT
last-modified: Fri, 23 Oct 2015 11:48:20 GMT
server: Apache
accept-ranges: bytes
etag: "2131-522c43021a900"
content-length: 8497
content-type: application/javascript

GET
H2 200 header.jpg
shells.red-pill.eu/skins/fusion/ 44 KB
45 KB 27ms
27ms Image
image/jpeg 46.150.36.137
TELEMACH Broadban...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://shells.red-pill.eu/skins/fusion/header.jpg
Requested by: Host: shells.red-pill.eu
URL: https://shells.red-pill.eu/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 46.150.36.137 Skofja Vas, Slovenia, ASN3212 (TELEMACH Broadband Access & Carrier Services, SI),
Reverse DNS: 46-150-36-137.dynamic.telemach.net
Software: Apache /
Resource Hash: 3f132006efbbe99ecee57b78c8987716800533afca00d8011350560040fc3e00

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://shells.red-pill.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:54 GMT
last-modified: Mon, 14 Jan 2013 11:39:00 GMT
server: Apache
accept-ranges: bytes
etag: "b0d0-4d33e17593d00"
content-length: 45264
content-type: image/jpeg

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 150 KB
51 KB 81ms
60ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6098496124751712

Requested by

Host: shells.red-pill.eu
URL: https://shells.red-pill.eu/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d58af67992b3222ebe8357316eaa6b3f44b6816044f00e0ce6032ad9904e8f7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://shells.red-pill.eu/
Origin: https://shells.red-pill.eu
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:54 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51973
x-xss-protection: 0
server: cafe
etag: 3089248917237832689
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 07 Dec 2023 17:17:54 GMT

GET
H2 200 bs_logo_20091209-01.png
blinkenshell.org/static/ 11 KB
11 KB 243ms
18ms Image
image/png 2a01:4f8:c0c:b93a::1
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blinkenshell.org/static/bs_logo_20091209-01.png

Requested by

Host: shells.red-pill.eu
URL: https://shells.red-pill.eu/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a01:4f8:c0c:b93a::1 Frankfurt am Main, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

nginx /

Resource Hash

02e82b0c6573f49da9969ec1d9076059957b9ad313aea5ed0335d910bb930d22

Security Headers

Name	Value
Content-Security-Policy	default-src https: 'unsafe-inline'; script-src 'self' https://webstats.blinkenshell.org; object-src 'none'; frame-ancestors 'self'
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://shells.red-pill.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:54 GMT
strict-transport-security: max-age=63072000
content-security-policy: default-src https: 'unsafe-inline'; script-src 'self' https://webstats.blinkenshell.org; object-src 'none'; frame-ancestors 'self'
last-modified: Sat, 27 Feb 2021 17:00:18 GMT
server: nginx
age: 20902
etag: "2b7e-5bc5451c40c0b"
content-type: image/png
x-varnish: 5284115 15111307
cache-control: max-age=86400
accept-ranges: bytes
content-length: 11134
expires: Fri, 08 Dec 2023 11:29:31 GMT

GET
H2 200 neutral.png
shells.red-pill.eu/skins/fusion/ 92 B
161 B 27ms
25ms Image
image/png 46.150.36.137
TELEMACH Broadban...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://shells.red-pill.eu/skins/fusion/neutral.png
Requested by: Host: shells.red-pill.eu
URL: https://shells.red-pill.eu/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 46.150.36.137 Skofja Vas, Slovenia, ASN3212 (TELEMACH Broadband Access & Carrier Services, SI),
Reverse DNS: 46-150-36-137.dynamic.telemach.net
Software: Apache /
Resource Hash: c5fcbbed83baac508ee6ba358593a03a385fa46b7887af2450b9502d8a633980

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://shells.red-pill.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:54 GMT
last-modified: Sat, 10 Sep 2005 15:01:52 GMT
server: Apache
accept-ranges: bytes
etag: "5c-4006c2ca01800"
content-length: 92
content-type: image/png

GET
H2 200 rate_3.png
shells.red-pill.eu/skins/fusion/ 1 KB
1 KB 27ms
25ms Image
image/png 46.150.36.137
TELEMACH Broadban...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://shells.red-pill.eu/skins/fusion/rate_3.png
Requested by: Host: shells.red-pill.eu
URL: https://shells.red-pill.eu/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 46.150.36.137 Skofja Vas, Slovenia, ASN3212 (TELEMACH Broadband Access & Carrier Services, SI),
Reverse DNS: 46-150-36-137.dynamic.telemach.net
Software: Apache /
Resource Hash: a01c07907aef447d1dc58a508f416ce9c1ae3a695e4961ae6512e159660934b8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://shells.red-pill.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:54 GMT
last-modified: Sun, 28 Feb 2010 00:22:32 GMT
server: Apache
accept-ranges: bytes
etag: "53a-4809e20e66200"
content-length: 1338
content-type: image/png

GET
H/1.1 200
OK resized.php
www.insomnia247.nl/images/ 47 KB
48 KB 297ms
72ms Image
image/png 2001:41d0:305:2100::4e16
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.insomnia247.nl/images/resized.php

Requested by

Host: shells.red-pill.eu
URL: https://shells.red-pill.eu/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2001:41d0:305:2100::4e16 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Apache/2.4 / Phusion Passenger 5.0.30

Resource Hash

73273e64c93401c8c6c1d667e089c2fc958d7c783b10facc1f17f4e1124f2f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://shells.red-pill.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Thu, 07 Dec 2023 17:17:54 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Referrer-Policy: origin-when-cross-origin
Server: Apache/2.4
X-Powered-By: Phusion Passenger 5.0.30
Upgrade: h2,h2c
Status: 200 OK
Content-Type: image/png
Cache-Control: public, max-age=3600
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 48253
Expires: Thu, 07 Dec 2023 18:17:54 GMT

GET
H2 200 rate_5.png
shells.red-pill.eu/skins/fusion/ 791 B
862 B 26ms
25ms Image
image/png 46.150.36.137
TELEMACH Broadban...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://shells.red-pill.eu/skins/fusion/rate_5.png
Requested by: Host: shells.red-pill.eu
URL: https://shells.red-pill.eu/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 46.150.36.137 Skofja Vas, Slovenia, ASN3212 (TELEMACH Broadband Access & Carrier Services, SI),
Reverse DNS: 46-150-36-137.dynamic.telemach.net
Software: Apache /
Resource Hash: af26eb6093f6b16b8d0d2fe29bcd0eaa5fe68e8cd369e603ff6fc8cffdf0b78d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://shells.red-pill.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:54 GMT
last-modified: Sun, 28 Feb 2010 00:22:42 GMT
server: Apache
accept-ranges: bytes
etag: "317-4809e217ef880"
content-length: 791
content-type: image/png

GET
H2 200 logo.png
www.xshellz.com/img/ 15 KB
16 KB 86ms
28ms Image
image/png 2606:4700:3035::ac43:9f36
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.xshellz.com/img/logo.png
Requested by: Host: shells.red-pill.eu
URL: https://shells.red-pill.eu/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:9f36 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e16f7579677fa60f9f16f525fe622fd6fcdb65368fc2c2357129f0bc176d93d0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://shells.red-pill.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:54 GMT
cf-cache-status: HIT
last-modified: Sun, 30 Apr 2017 10:05:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4837
etag: "5905b6d9-3c8b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I7ITwQsBFIV1G8GXX%2BM%2FgiiAx58xf6CCsogsm9NJpA7VNZQ2LKe7N7zHghl7ZUdvmmgrKksTqs6bLme%2FwQae70vrwXWMPFKhygd6CRrv2lqAhMSd4wJm7djpgTHv2mVllzw3EG0a43JTgiP3GBo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 831e6cbd9dfc0be4-AMS
alt-svc: h3=":443"; ma=86400
content-length: 15499

GET
H2 200 button.png
shells.red-pill.eu/images/ 802 B
881 B 25ms
25ms Image
image/png 46.150.36.137
TELEMACH Broadban...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://shells.red-pill.eu/images/button.png
Requested by: Host: shells.red-pill.eu
URL: https://shells.red-pill.eu/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 46.150.36.137 Skofja Vas, Slovenia, ASN3212 (TELEMACH Broadband Access & Carrier Services, SI),
Reverse DNS: 46-150-36-137.dynamic.telemach.net
Software: Apache /
Resource Hash: 444723672c8b2bad428845277cef13c3863fb7a6236e7937605de327994aba10

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://shells.red-pill.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:54 GMT
last-modified: Sun, 29 Nov 2009 19:30:34 GMT
server: Apache
accept-ranges: bytes
etag: "322-479878f072a80"
content-length: 802
content-type: image/png

GET
H2 200 rate_4.png
shells.red-pill.eu/skins/fusion/ 1 KB
1 KB 27ms
26ms Image
image/png 46.150.36.137
TELEMACH Broadban...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://shells.red-pill.eu/skins/fusion/rate_4.png
Requested by: Host: shells.red-pill.eu
URL: https://shells.red-pill.eu/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 46.150.36.137 Skofja Vas, Slovenia, ASN3212 (TELEMACH Broadband Access & Carrier Services, SI),
Reverse DNS: 46-150-36-137.dynamic.telemach.net
Software: Apache /
Resource Hash: 5130be9edd4412823495b4e795c7b1565638670bb2d803e11233c9cfd8d7d48d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://shells.red-pill.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:54 GMT
last-modified: Sun, 28 Feb 2010 00:22:38 GMT
server: Apache
accept-ranges: bytes
etag: "502-4809e2141ef80"
content-length: 1282
content-type: image/png

GET
H2 404 logo.jpg
www.bshellz.net/ 9 B
199 B 72ms
17ms Image
text/plain 81.171.28.46
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bshellz.net/logo.jpg
Requested by: Host: shells.red-pill.eu
URL: https://shells.red-pill.eu/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.171.28.46 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: Cowboy /
Resource Hash: 907ba78b4545338d3539683e63ecb51cf51c10adc9dabd86e92bd52339f298b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://shells.red-pill.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:53 GMT
cache-control: max-age=0, private, must-revalidate
server: Cowboy
content-length: 9

GET
H2 200 stats.png
shells.red-pill.eu/skins/fusion/ 444 B
514 B 26ms
26ms Image
image/png 46.150.36.137
TELEMACH Broadban...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://shells.red-pill.eu/skins/fusion/stats.png
Requested by: Host: shells.red-pill.eu
URL: https://shells.red-pill.eu/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 46.150.36.137 Skofja Vas, Slovenia, ASN3212 (TELEMACH Broadband Access & Carrier Services, SI),
Reverse DNS: 46-150-36-137.dynamic.telemach.net
Software: Apache /
Resource Hash: 4ca532668f4a9157dde5a5a8c00ff50c11b32c97e48e05b84ca86c316b9ec583

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://shells.red-pill.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:54 GMT
last-modified: Mon, 12 Sep 2005 21:47:18 GMT
server: Apache
accept-ranges: bytes
etag: "1bc-4009a12402580"
content-length: 444
content-type: image/png

GET
H2 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ 25 KB
10 KB 98ms
77ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: shells.red-pill.eu
URL: https://shells.red-pill.eu/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6d5820b4b9f0e3e1e5f3445d1836a3dd71544c07ea32255753a3a6af59172381

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://shells.red-pill.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:54 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10285
x-xss-protection: 0
server: cafe
etag: 11443243917677497499
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 07 Dec 2023 17:17:54 GMT

GET
H2 200 title.png
shells.red-pill.eu/skins/fusion/ 231 B
300 B 25ms
25ms Image
image/png 46.150.36.137
TELEMACH Broadban...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://shells.red-pill.eu/skins/fusion/title.png
Requested by: Host: shells.red-pill.eu
URL: https://shells.red-pill.eu/skins/fusion/screen.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 46.150.36.137 Skofja Vas, Slovenia, ASN3212 (TELEMACH Broadband Access & Carrier Services, SI),
Reverse DNS: 46-150-36-137.dynamic.telemach.net
Software: Apache /
Resource Hash: 418655ed8adf3d9b6767395ede2509b31756f5cd672e0e203e5d30cf80fd326a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://shells.red-pill.eu/skins/fusion/screen.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:54 GMT
last-modified: Sat, 10 Sep 2005 15:01:56 GMT
server: Apache
accept-ranges: bytes
etag: "e7-4006c2cdd2100"
content-length: 231
content-type: image/png

GET
H2 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311300101/ 398 KB
135 KB 101ms
101ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311300101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6098496124751712&plah=shells.red-pill.eu

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6098496124751712

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

081050fe628141e892b0bf8664bb4aae75a6c0e1e6af549299a7f6da3dee465b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://shells.red-pill.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:54 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 137570
x-xss-protection: 0
server: cafe
etag: 586092259583670738
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Thu, 07 Dec 2023 17:17:54 GMT

GET
H2 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231205/r20190131/ Frame 60D1 9 KB
4 KB 26ms
6ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231205/r20190131/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6098496124751712

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://shells.red-pill.eu/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 80064
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 19:03:30 GMT
etag: 5585625838579639069
expires: Wed, 20 Dec 2023 19:03:30 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 26ms
6ms Script
text/javascript 2a00:1450:4001:81c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: shells.red-pill.eu
URL: https://shells.red-pill.eu/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://shells.red-pill.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 07 Dec 2023 15:54:56 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 4978
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17168
expires: Thu, 07 Dec 2023 17:54:56 GMT

GET
H2 200 __utm.gif
ssl.google-analytics.com/r/ 35 B
197 B 14ms
14ms Image
image/gif 2a00:1450:4001:81c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=16808392&utmhn=shells.red-pill.eu&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Free%20Shell%20Accounts%20%3A%3A%20the%20biggest%20list%20on%20the%20net%20-%20Rankings%20-%20All%20Sites&utmhid=1511016103&utmr=-&utmp=%2F&utmht=1701969474267&utmac=UA-36817813-1&utmcc=__utma%3D132252620.685840076.1701969474.1701969474.1701969474.1%3B%2B__utmz%3D132252620.1701969474.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=954834054&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~

Requested by

Host: shells.red-pill.eu
URL: https://shells.red-pill.eu/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://shells.red-pill.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Dec 2023 17:17:54 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame DC88 0
188 B 244ms
244ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&adk=1812271804&adf=3025194257&lmt=1701969474&plat=3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~4~6&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474210&bpp=2&bdt=151&idt=252&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=6824293562278&frm=20&pv=2&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=262

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311300101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6098496124751712&plah=shells.red-pill.eu

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://shells.red-pill.eu/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 07 Dec 2023 17:17:54 GMT
expires: Thu, 07 Dec 2023 17:17:54 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 9A07 118 KB
40 KB 1407ms
1406ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=1720655930&adf=1779425666&pi=t.ma~as.9148949735&w=700&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=700x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474212&bpp=1&bdt=152&idt=263&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=451&ady=134&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeE%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=269

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bce84ba90761294f6a75287d6433780b16a182c3bbe7ccf132be8aca5e268915

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://shells.red-pill.eu/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 41067
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 07 Dec 2023 17:17:55 GMT
expires: Thu, 07 Dec 2023 17:17:55 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame BBD5 103 KB
38 KB 510ms
510ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=4210125070&adf=3359390731&pi=t.ma~as.9148949735&w=620&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=620x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474213&bpp=1&bdt=154&idt=274&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C700x280&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=491&ady=1543&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeEbr%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=275

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

75bd10be9aa4d302459bc8219cc4c4d82dd08bd33fc7e111116b60ccb2654f7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://shells.red-pill.eu/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 39057
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 07 Dec 2023 17:17:54 GMT
expires: Thu, 07 Dec 2023 17:17:54 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame A286 36 KB
14 KB 423ms
418ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=4210125070&adf=207959090&pi=t.ma~as.9148949735&w=620&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=620x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474213&bpp=1&bdt=154&idt=276&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C700x280%2C620x280&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=491&ady=2955&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeEbr%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=277

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5b99f360a281f5fcb829b2e9991fc681cf7027dc908cf80acf0e68d48049ff09

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://shells.red-pill.eu/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 14661
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 07 Dec 2023 17:17:54 GMT
expires: Thu, 07 Dec 2023 17:17:54 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 6BDC 603 B
68 B 41ms
41ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=16&slotname=6474157215&adk=3479957199&adf=630464352&pi=t.ma~as.6474157215&w=468&lmt=1701969474&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474231&bpp=1&bdt=172&idt=260&shv=r20231205&mjsv=m202311300101&ptt=5&saldr=sd&abxe=1&prev_fmts=0x0%2C700x280%2C620x280%2C620x280&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=567&ady=3553&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeEbr%7C&abl=CA&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=262

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://shells.red-pill.eu/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 07 Dec 2023 17:17:54 GMT
expires: Thu, 07 Dec 2023 17:17:54 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231205/r20110914/client/ Frame A286 3 KB
1 KB 30ms
8ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231205/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=4210125070&adf=207959090&pi=t.ma~as.9148949735&w=620&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=620x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474213&bpp=1&bdt=154&idt=276&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C700x280%2C620x280&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=491&ady=2955&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeEbr%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=277

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 12:17:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 18052
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 21 Dec 2023 12:17:02 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231205/r20110914/client/ Frame A286 20 KB
9 KB 28ms
6ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231205/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 15:41:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5812
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 21 Dec 2023 15:41:02 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame A286 202 KB
64 KB 81ms
59ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a04fa6af32e77548f1c3e27b7014f3520c7494f317fa80b58f8704de83e4b821

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65145
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701866768669483"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 07 Dec 2023 17:17:54 GMT

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 6137 130 KB
46 KB 84ms
55ms Document
text/html 2a02:2638:3::12
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=ZXH-QgAH68AIFUBrAANoJSJ6Ap2qisbuKo6Ftw&u=%7CG%2Bv60Ph38IplIh0i7lA2Xhe1Ty%2FaeUni6Ai1iJpEALU%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z2MBXjcXbJi6-EhecIdZLW9frBNKibvu7bNv6peVuYXNL6EIXiMKaC0MTamZ_LUSdqx58AcUOvsE-D8o_KflJTfMM5VMLWEp4zFRp7HR6TY8EYuMiPuzSvCfA0bsdSPKqQ9uKVzS0t8UPIxonNathyPii1VaTOQ55IGIAqwWzRkomB74umzKeBQ8XFURcJlh22SSmGmmawXb1PXBzEP0jWdzfgMne9MEawvtNDG75_HFCDpHnOnJcP-JkUdGoeOKIvnjnlN2fPOpgmg21wrzQLuHslidkJQDi2t3R-vQWm0AqZCI6uUqG1h_L39WSRQYKJIVKd7TsoUPSHmuSB_uX6k9Kcc6UMSHPHhQI1Cnemm3da85DXIkBp9-SW76H0Elwmahp-6QBHcUHfac1D41OQPqk4qUBxjizYZ_5GOZLQtM1vXbBeJSHw3ymra0CZBbNn1JwdUxN4CU4hVDVFRHXJNKBf4WcyqkzLkqNmkYfyCmr1xPm-PdJV4LNts_xCqTzGX7PsUA0axT7ajAAf9-Dhr3v8s5UuhXMfa2jzNpD2vDjh-ZS8YcbvYt-Z4edgQsmA&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCzo0IQv5xZcDXH-uA1fAPpdCNkAzJntKxXMWymPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTYwOTg0OTYxMjQ3NTE3MTLIAQmpAmTvV99zErI-qAMByAMCqgTPAU_Q9ng8swIRTGz710LYcqVULOJ6FUzzmLBr2oqjN0GykgE1aiHT-D2rgcOoBEjBm-_ZiZdDm57vFGuxou4LJ9VCDjFD3aXrjsZ-ndi0xg5mUYbeh5vlyEK-sGOWwFrosQM-K2Wk7eVp-MDf_Hly0Sl9V_9nSBXMNbEkm5Sl-s7emqmphVAiS3eM1wkATvY0RMCaxSDTdUQEieNCF1gl3H7KKI0tdxPghXPnCqZiAEvy5eQfJRa2Nm3dUnCrESnhIgN11XCmA0PPtbzs4O4-voAG9aedkJiV_rhwoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHQiA4YAQEAEyAqoCOgKAQEi9_cE6WLHnya_q_YID-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_3fAdm7Ayc0G8U5RVN6mgIOLDQ2Tg%26client%3Dca-pub-6098496124751712%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::12 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

c45ad6b0f981d54497fe6f7d5ce7316fbc418d12641e1c8b01d464426553a216

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Thu, 07 Dec 2023 17:17:54 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=eyvfYdOlZv-3W18_M7gAyoQGtNpGP40tTqYm4MGd2AgwgN-y2xdGkf5G-haQV6qlbXF7Puw4o73F-NuCmz1OyZc7R59IqPzdWh4XRQS-XqFUz7p64VbUj5S_dXPqgkRxTJba07OcsUd1ouTer_7fFjLCYwraC1ue3NHvyJlcp4VfdXduFY4RaRbbOiTSRqGVYI_Fi6kENUidvjDokygW6R4Bo1pKdCyXA3ELhMueIXUTIFuUBus5xLKv5CUGKpOp2DP-zQ"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 39783840
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 8630533118166429816
tpc.googlesyndication.com/simgad/ Frame BBD5 30 KB
30 KB 10ms
10ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/8630533118166429816?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qmXDD5moRwpcQAg-OqTczSXwt3ZUg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=4210125070&adf=3359390731&pi=t.ma~as.9148949735&w=620&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=620x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474213&bpp=1&bdt=154&idt=274&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C700x280&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=491&ady=1543&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeEbr%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=275

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c95ad98b97165cc2132b0d6b30be2dac0c043b2cf39b5768e3c21b199c238cc7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 05:19:51 GMT
x-content-type-options: nosniff
age: 561484
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30711
x-xss-protection: 0
last-modified: Thu, 09 Feb 2023 23:14:03 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 30 Nov 2024 05:19:51 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231205/r20110914/ Frame BBD5 24 KB
9 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231205/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=4210125070&adf=3359390731&pi=t.ma~as.9148949735&w=620&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=620x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474213&bpp=1&bdt=154&idt=274&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C700x280&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=491&ady=1543&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeEbr%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=275

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 15:41:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5813
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9318
x-xss-protection: 0
server: cafe
etag: 3562968281324141506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 21 Dec 2023 15:41:02 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231205/r20110914/client/ Frame BBD5 3 KB
1 KB 11ms
11ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231205/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=4210125070&adf=3359390731&pi=t.ma~as.9148949735&w=620&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=620x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474213&bpp=1&bdt=154&idt=274&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C700x280&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=491&ady=1543&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeEbr%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=275

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 12:17:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 18053
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 21 Dec 2023 12:17:02 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231205/r20110914/client/ Frame BBD5 20 KB
8 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231205/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=4210125070&adf=3359390731&pi=t.ma~as.9148949735&w=620&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=620x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474213&bpp=1&bdt=154&idt=274&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C700x280&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=491&ady=1543&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeEbr%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=275

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 15:41:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5813
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 21 Dec 2023 15:41:02 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame BBD5 202 KB
64 KB 30ms
30ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=4210125070&adf=3359390731&pi=t.ma~as.9148949735&w=620&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=620x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474213&bpp=1&bdt=154&idt=274&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C700x280&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=491&ady=1543&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeEbr%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=275

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a04fa6af32e77548f1c3e27b7014f3520c7494f317fa80b58f8704de83e4b821

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65145
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701866768669483"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 07 Dec 2023 17:17:55 GMT

GET
H2 200 one_click_handler_one_afma_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231205/r20110914/client/ Frame BBD5 36 KB
15 KB 12ms
12ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231205/r20110914/client/one_click_handler_one_afma_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=4210125070&adf=3359390731&pi=t.ma~as.9148949735&w=620&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=620x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474213&bpp=1&bdt=154&idt=274&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C700x280&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=491&ady=1543&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeEbr%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=275

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8a59ccc1c7a1e76d7ffaf0060fb58afe91f3cb65123aa88f5461530141999e6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 16:26:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3083
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14803
x-xss-protection: 0
server: cafe
etag: 9007827061540559791
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 21 Dec 2023 16:26:32 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 1550 143 B
166 B 7ms
6ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=4210125070&adf=3359390731&pi=t.ma~as.9148949735&w=620&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=620x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474213&bpp=1&bdt=154&idt=274&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C700x280&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=491&ady=1543&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeEbr%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=275

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=4210125070&adf=3359390731&pi=t.ma~as.9148949735&w=620&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=620x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474213&bpp=1&bdt=154&idt=274&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C700x280&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=491&ady=1543&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeEbr%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=275
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 815
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 07 Dec 2023 17:04:20 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame A286 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ca0a414ba11f94c3dd8c9adef01b4cc73bebaa44cbb80a43d02f6e6f317952ee

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 6137 2 KB
1 KB 44ms
16ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=ZXH-QgAH68AIFUBrAANoJSJ6Ap2qisbuKo6Ftw&u=%7CG%2Bv60Ph38IplIh0i7lA2Xhe1Ty%2FaeUni6Ai1iJpEALU%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z2MBXjcXbJi6-EhecIdZLW9frBNKibvu7bNv6peVuYXNL6EIXiMKaC0MTamZ_LUSdqx58AcUOvsE-D8o_KflJTfMM5VMLWEp4zFRp7HR6TY8EYuMiPuzSvCfA0bsdSPKqQ9uKVzS0t8UPIxonNathyPii1VaTOQ55IGIAqwWzRkomB74umzKeBQ8XFURcJlh22SSmGmmawXb1PXBzEP0jWdzfgMne9MEawvtNDG75_HFCDpHnOnJcP-JkUdGoeOKIvnjnlN2fPOpgmg21wrzQLuHslidkJQDi2t3R-vQWm0AqZCI6uUqG1h_L39WSRQYKJIVKd7TsoUPSHmuSB_uX6k9Kcc6UMSHPHhQI1Cnemm3da85DXIkBp9-SW76H0Elwmahp-6QBHcUHfac1D41OQPqk4qUBxjizYZ_5GOZLQtM1vXbBeJSHw3ymra0CZBbNn1JwdUxN4CU4hVDVFRHXJNKBf4WcyqkzLkqNmkYfyCmr1xPm-PdJV4LNts_xCqTzGX7PsUA0axT7ajAAf9-Dhr3v8s5UuhXMfa2jzNpD2vDjh-ZS8YcbvYt-Z4edgQsmA&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCzo0IQv5xZcDXH-uA1fAPpdCNkAzJntKxXMWymPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTYwOTg0OTYxMjQ3NTE3MTLIAQmpAmTvV99zErI-qAMByAMCqgTPAU_Q9ng8swIRTGz710LYcqVULOJ6FUzzmLBr2oqjN0GykgE1aiHT-D2rgcOoBEjBm-_ZiZdDm57vFGuxou4LJ9VCDjFD3aXrjsZ-ndi0xg5mUYbeh5vlyEK-sGOWwFrosQM-K2Wk7eVp-MDf_Hly0Sl9V_9nSBXMNbEkm5Sl-s7emqmphVAiS3eM1wkATvY0RMCaxSDTdUQEieNCF1gl3H7KKI0tdxPghXPnCqZiAEvy5eQfJRa2Nm3dUnCrESnhIgN11XCmA0PPtbzs4O4-voAG9aedkJiV_rhwoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHQiA4YAQEAEyAqoCOgKAQEi9_cE6WLHnya_q_YID-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_3fAdm7Ayc0G8U5RVN6mgIOLDQ2Tg%26client%3Dca-pub-6098496124751712%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:55 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 01 Dec 2024 17:17:55 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 6137 2 KB
1 KB 54ms
26ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:55 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 01 Dec 2024 17:17:55 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 6137 308 B
637 B 38ms
13ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:55 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sun, 01 Dec 2024 17:17:55 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 6137 293 B
621 B 41ms
17ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:55 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sun, 01 Dec 2024 17:17:55 GMT

GET
H2 200 lg.php
cat.nl3.eu.criteo.com/delivery/ Frame 6137 43 B
348 B 49ms
15ms Image
image/gif 178.250.1.6
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.nl3.eu.criteo.com/delivery/lg.php?cppv=3&cpp=8ith2QB3cOPJ_eb1F5zrQD6CbvthvGvx3_CxptEMYmoNf7M1wMU30RHC8xm4fYB1hwhWaebzUCdq5jEacCeANTws8T7Y2VcVzQcJjxKqPwiNRHmHAUdyrGs-CH-R-YGRw-OoTbtvj4IkuU892SwHdBn39snhozTMBUKTo_PMIggP0rSI5uFOgf5gYWBAa0RyNPorMcefjXu9KBqqp6lUqNNxpCo7Kueum9VtPNOnR0yqgbCuOoQP2abt4fd4f7-Fhg7i1fTs-A4o217LviogtyUA8QXiOMARzqrZeOMLwxK9bi4vwnqHbib8uKg9HOkJKJkLRRwCM7nHIXSt9nqrqQSjrkDpPI4UibshI0u9W0ApEaV_D4sOHGw1mGFYRJ_eb7XII0NPUc3-P4El5-PSNpw6kAsFUMI7ta9z3Z_HFpPHoxDo96ffKZ2LwzJNMzo_WkovTg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.6 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Dec 2023 17:17:54 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1509933
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 6137 12 KB
6 KB 35ms
14ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:55 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 01 Dec 2024 17:17:55 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 6137 31 KB
31 KB 56ms
24ms Image
image/png 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?h=556&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.nl3.eu.criteo.net%2Fdesign%2Fdt%2F105623%2F5022139%2Ffc5b2532e4ff4326a459f87c7b9b521f_eu_oveckarna_vertikalni_hneda.png&v=3&w=336&rid=4&s=MyjIiXAwbo7MGZ64BUS-vP4l

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

0826260f5fb0377aeeca90c10c79d1d192ee369634d18d488be744d49753e42d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:54 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 31957
expires: Sun, 03 Nov 2024 03:20:08 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 6137 10 KB
11 KB 65ms
32ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F3%2F4123_102.jpg%3F1635951174_2&v=3&w=800&rid=4&s=EMf7Q7icODySE6pGeqSq5Vg9&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

68af3635b0864e3ca5567570ace0d6bbd54e363290e31f5ad4d821b8ad1ebb41

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:54 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 10566
expires: Wed, 03 Jan 2024 21:55:53 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 6137 0
128 B 45ms
13ms Ping
text/plain 2a02:2638:3::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=eyvfYdOlZv-3W18_M7gAyoQGtNpGP40tTqYm4MGd2AgwgN-y2xdGkf5G-haQV6qlbXF7Puw4o73F-NuCmz1OyZc7R59IqPzdWh4XRQS-XqFUz7p64VbUj5S_dXPqgkRxTJba07OcsUd1ouTer_7fFjLCYwraC1ue3NHvyJlcp4VfdXduFY4RaRbbOiTSRqGVYI_Fi6kENUidvjDokygW6R4Bo1pKdCyXA3ELhMueIXUTIFuUBus5xLKv5CUGKpOp2DP-zQ&sds=2&rev=89682&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 07 Dec 2023 17:17:55 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 6137 2 KB
1 KB 28ms
15ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:55 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 01 Dec 2024 17:17:55 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 6137 2 KB
1 KB 14ms
13ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:55 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 01 Dec 2024 17:17:55 GMT

GET
DATA 200
OK truncated
/ Frame BBD5 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b023576c8b8fe9227c003708be27bc17b0c22cdc5d2d7b3343544a6a829fcda4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 1550
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

22ms
22ms

Document
text/html

2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=4210125070&adf=3359390731&pi=t.ma~as.9148949735&w=620&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=620x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474213&bpp=1&bdt=154&idt=274&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C700x280&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=491&ady=1543&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeEbr%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=275

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 07 Dec 2023 17:17:55 GMT
expires: Thu, 07 Dec 2023 17:17:55 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 07 Dec 2023 17:17:55 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame BBD5
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CeMSaQv5xZcuoH6ms1fAP5LSZkA-Pyc_6crjxgN66EQoQASCFv7oVYJXikIKgB6AB7LPywAHIAQKoAwHIA8kEqgTYAU_QvRGGvOizrnjx2RxLmdr37bOQ7ANMtZc_-yxcbFRRka7egyOQ4sr...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%227678341205630548965%22,%22debug_reporting%22:true,%22destination%22:%22https://madmuscles.com%22,%22event_report_window%22...

0
0

57ms
42ms

Fetch
text/css

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%227678341205630548965%22,%22debug_reporting%22:true,%22destination%22:%22https://madmuscles.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22404527596%22],%224%22:[%2212-07%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%221369965594388838689%22}&andc=true

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=4210125070&adf=3359390731&pi=t.ma~as.9148949735&w=620&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=620x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474213&bpp=1&bdt=154&idt=274&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C700x280&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=491&ady=1543&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeEbr%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=275

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:55 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"7678341205630548965","debug_reporting":true,"destination":"https://madmuscles.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["404527596"],"4":["12-07"],"6":["true"]},"priority":"500","source_event_id":"1369965594388838689"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 07 Dec 2023 17:17:55 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 07 Dec 2023 17:17:55 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"7678341205630548965","debug_reporting":true,"destination":"https://madmuscles.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["404527596"],"4":["12-07"],"6":["true"]},"priority":"500","source_event_id":"1369965594388838689"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 6137 31 KB
31 KB 16ms
15ms Image
image/png 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

0826260f5fb0377aeeca90c10c79d1d192ee369634d18d488be744d49753e42d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:55 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 31957
expires: Sun, 03 Nov 2024 03:20:08 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 6137 10 KB
11 KB 16ms
16ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

68af3635b0864e3ca5567570ace0d6bbd54e363290e31f5ad4d821b8ad1ebb41

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:55 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 10566
expires: Wed, 03 Jan 2024 21:55:53 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame A286 0
23 B 51ms
50ms Image
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=COk10Qv5xZcDXH-uA1fAPpdCNkAzJntKxXMWymPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTYwOTg0OTYxMjQ3NTE3MTLIAQmpAmTvV99zErI-qAMByAMCqgTMAU_Q9ng8swIRTGz710LYcqVULOJ6FUzzmLBr2oqjN0GykgE1aiHT-D2rgcOoBEjBm-_ZiZdDm57vFGuxou4LJ9VCDjFD3aXrjsZ-ndi0xg5mUYbeh5vlyEK-sGOWwFrosQM-K2Wk7eVp-MDf_Hly0Sl9V_9nSBXMNbEkm5Sl-s7emqmphVAiS3eM1wkATvY0RMCaxSDTdUQEieNCF1gl3H7KKI0tdxOih1J1ijWyPe0iwj6TBf8SOErX5HqFCatV6j7TJ8-4L1tXfyjMCYAG9aedkJiV_rhwoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHQiA4YAQEAEyAqoCOgKAQEi9_cE6WLHnya_q_YIDgAoB-gsCCAGADAHQFQGAFwGyFxoKGBIUcHViLTYwOTg0OTYxMjQ3NTE3MTIYAA&sigh=XFtkQ48cbaA&uach_m=%5BUACH%5D&cid=CAQSTwDICaaNl8u9Kiq-BGq6JX1Qhqvo2ZO5pW24YYUYiwwH0CLHWayOwrGVgdB8ClrSIcG9SJj4jMj9_MToAVPcsg6IWsIPyOn6cgvx9GFeTHQYAQ&cbvp=2&vis=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=4210125070&adf=207959090&pi=t.ma~as.9148949735&w=620&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=620x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474213&bpp=1&bdt=154&idt=276&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C700x280%2C620x280&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=491&ady=2955&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeEbr%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=277
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 07 Dec 2023 17:17:55 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 07 Dec 2023 17:17:55 GMT

GET
H2 200 notify
rtb.fr3.eu.criteo.com/google/auction/ Frame A286 0
126 B 51ms
19ms Image
text/plain 2a02:2638:d::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rtb.fr3.eu.criteo.com/google/auction/notify?profile=14&payload=kI7EGLr5ROwEmAKdg2ICAgAAAKDPndMiRDpnEEH-cWUGS_wqGbq_Iha5AAASAAAKCkFRVUREd0VCRHc&wp=ZXH-QgAH68AIFUBrAANoJSJ6Ap2qisbuKo6Ftw&cbvp=2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:d::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:55 GMT
strict-transport-security: max-age=31536000; preload;
server-processing-duration-in-ticks: 216125
server: Kestrel
content-length: 0

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 68ms
41ms Preflight
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 07 Dec 2023 17:17:55 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 1_7gewjyGlqcOFIguOJ5AHUn6L-zJDTVPaBHJ2ADYro.js Show response
pagead2.googlesyndication.com/bg/ Frame 5C43 51 KB
19 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/1_7gewjyGlqcOFIguOJ5AHUn6L-zJDTVPaBHJ2ADYro.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=4210125070&adf=3359390731&pi=t.ma~as.9148949735&w=620&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=620x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474213&bpp=1&bdt=154&idt=274&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C700x280&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=491&ady=1543&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeEbr%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=275

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7fee07b08f21a5a9c385220b8e279007527e8bfb32434d53da04727600362ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 19:43:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 77637
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19719
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 05 Dec 2024 19:43:58 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 9A07 6 KB
1 KB 37ms
16ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=1720655930&adf=1779425666&pi=t.ma~as.9148949735&w=700&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=700x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474212&bpp=1&bdt=152&idt=263&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=451&ady=134&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeE%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=269

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9a4eb2c9445287c34cb0a9ed5cc673460362483f0855bc91f8230dfa46a955e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 07 Dec 2023 17:17:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 07 Dec 2023 16:10:54 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 07 Dec 2023 17:17:55 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231205/r20110914/client/ Frame 9A07 2 KB
822 B 7ms
6ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231205/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=1720655930&adf=1779425666&pi=t.ma~as.9148949735&w=700&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=700x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474212&bpp=1&bdt=152&idt=263&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=451&ady=134&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeE%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=269

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 15:41:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5813
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 21 Dec 2023 15:41:02 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231205/r20110914/ Frame 9A07 24 KB
9 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231205/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=1720655930&adf=1779425666&pi=t.ma~as.9148949735&w=700&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=700x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474212&bpp=1&bdt=152&idt=263&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=451&ady=134&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeE%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=269

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 15:41:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5813
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9318
x-xss-protection: 0
server: cafe
etag: 3562968281324141506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 21 Dec 2023 15:41:02 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231205/r20110914/client/ Frame 9A07 3 KB
1 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231205/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=1720655930&adf=1779425666&pi=t.ma~as.9148949735&w=700&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=700x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474212&bpp=1&bdt=152&idt=263&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=451&ady=134&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeE%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=269

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 12:17:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 18053
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 21 Dec 2023 12:17:02 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231205/r20110914/client/ Frame 9A07 20 KB
8 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231205/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=1720655930&adf=1779425666&pi=t.ma~as.9148949735&w=700&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=700x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474212&bpp=1&bdt=152&idt=263&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=451&ady=134&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeE%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=269

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 15:41:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5813
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 21 Dec 2023 15:41:02 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9A07 202 KB
64 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=1720655930&adf=1779425666&pi=t.ma~as.9148949735&w=700&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=700x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474212&bpp=1&bdt=152&idt=263&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=451&ady=134&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeE%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=269

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a04fa6af32e77548f1c3e27b7014f3520c7494f317fa80b58f8704de83e4b821

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65145
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701866768669483"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 07 Dec 2023 17:17:55 GMT

GET
H2 200 7a8419aef3683f04c437bd15cecf843d.js Show response
www.gstatic.com/mysidia/ Frame 9A07 37 KB
16 KB 30ms
8ms Script
text/javascript 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/7a8419aef3683f04c437bd15cecf843d.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=1720655930&adf=1779425666&pi=t.ma~as.9148949735&w=700&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=700x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474212&bpp=1&bdt=152&idt=263&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=451&ady=134&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeE%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=269

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

949b3cde1a46caf4f55bb496f58a44af641a4b9fed64f95057bb5eeff142170b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 05:25:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 215550
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15452
x-xss-protection: 0
last-modified: Wed, 29 Nov 2023 19:10:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 04 Mar 2024 05:25:25 GMT

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/1143190697739387787/ Frame 9A07 27 KB
27 KB 7ms
7ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/1143190697739387787/14763004658117789537?w=600&h=314&tw=1&q=75

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=1720655930&adf=1779425666&pi=t.ma~as.9148949735&w=700&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=700x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474212&bpp=1&bdt=152&idt=263&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=451&ady=134&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeE%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=269

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9a47f64d80567c50934ff990849168e708b9dd8e212a2d639ed4cdb8530eab94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 11:55:34 GMT
x-content-type-options: nosniff
age: 19341
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27673
x-xss-protection: 0
last-modified: Wed, 09 Aug 2023 19:07:05 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 06 Dec 2024 11:55:34 GMT

GET
DATA 200
OK truncated
/ Frame 9A07 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 013726d581ea143481ff6784faf267ac69cf27250a6b7c37897c415bc7c1f76a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 9A07 15 KB
16 KB 26ms
7ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 16:39:21 GMT
x-content-type-options: nosniff
age: 520715
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 30 Nov 2024 16:39:21 GMT

GET
H2 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 9A07 15 KB
15 KB 32ms
13ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 03:15:52 GMT
x-content-type-options: nosniff
age: 223324
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15740
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 04 Dec 2024 03:15:52 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 9A07 15 KB
15 KB 27ms
8ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 23:12:30 GMT
x-content-type-options: nosniff
age: 237926
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 03 Dec 2024 23:12:30 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 9A07
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CMhAYQv5xZdmDH7W71fAPu9aWkAelueXXdKbjjbPfEdrZHhABIIW_uhVgleKQgqAHoAHg3ryJKsgBCakCZO9X33MSsj6oAwHIA8sEqgTPAU_QW70zaQbv8XIbcLPTK4bPmvpYxcDblN4q27L...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2218386006282586202541%22,%22debug_reporting%22:true,%22destination%22:%22https://sparkassen-leasing.de%22,%22event_report_w...

0
0

43ms
43ms

Fetch
text/css

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2218386006282586202541%22,%22debug_reporting%22:true,%22destination%22:%22https://sparkassen-leasing.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211294158688%22],%224%22:[%2212-07%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2212976546612498687137%22}&andc=true

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:56 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"18386006282586202541","debug_reporting":true,"destination":"https://sparkassen-leasing.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11294158688"],"4":["12-07"],"6":["true"]},"priority":"500","source_event_id":"12976546612498687137"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 07 Dec 2023 17:17:56 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 07 Dec 2023 17:17:56 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"18386006282586202541","debug_reporting":true,"destination":"https://sparkassen-leasing.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11294158688"],"4":["12-07"],"6":["true"]},"priority":"500","source_event_id":"12976546612498687137"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 57ms
56ms XHR
application/json 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20231205&st=env

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

21d76cffc0153d20cf89f500ea5c1bc9aa9729f6415a20927af1ca53b864f73a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://shells.red-pill.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:56 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12165
x-xss-protection: 0

GET
H3 200 1_7gewjyGlqcOFIguOJ5AHUn6L-zJDTVPaBHJ2ADYro.js Show response
pagead2.googlesyndication.com/bg/ Frame EE28 51 KB
19 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/1_7gewjyGlqcOFIguOJ5AHUn6L-zJDTVPaBHJ2ADYro.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=1720655930&adf=1779425666&pi=t.ma~as.9148949735&w=700&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=700x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474212&bpp=1&bdt=152&idt=263&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=451&ady=134&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeE%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=269

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7fee07b08f21a5a9c385220b8e279007527e8bfb32434d53da04727600362ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 19:43:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 77637
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19719
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 05 Dec 2024 19:43:58 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 43ms
42ms Preflight
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 07 Dec 2023 17:17:56 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://shells.red-pill.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 07 Dec 2023 17:17:56 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 1C5F 13 KB
5 KB 7ms
6ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://shells.red-pill.eu/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 14179
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 07 Dec 2023 13:21:37 GMT
expires: Fri, 06 Dec 2024 13:21:37 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 5872 829 B
997 B 18ms
17ms Document
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

b2824092990b29f44b0ce03526347089735179ccada3ae7046fef87bf2469b66

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-1PBa210dRH4r45m_p4hjPw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://shells.red-pill.eu/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-1PBa210dRH4r45m_p4hjPw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 07 Dec 2023 17:17:56 GMT
expires: Thu, 07 Dec 2023 17:17:56 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 1C5F 39 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 09:57:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 26421
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 06 Dec 2024 09:57:35 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 5872 0
0 45ms
44ms Image
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20231205&jk=1373949010449336&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 1C5F 0
10 B 15ms
7ms Image
text/plain 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?Dh3nUA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:17:56 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 43ms
43ms Image
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20231205&jk=1373949010449336&bg=!CAulC0TNAAY3kmNgF5I7ADQBe5WfOA5g9UKo6o5ZRcnSva2LgkS-s3NLTvRbHoCFNlGKH1P-u4fPEhvgTBhEtPlGcgCaAgAAADtSAAAAAmgBB5kDDmXXEWlw2m6wNkDlt4vPHY09pJnaqS2GrDv4fvs7N9xIBjB1zWLEpzT0ZbSQBYXt58JX89eV0pk1acZtuSX321JFOcUFE2jYJWt0dKrNT41hdQodQ8o58SVuzXvF3bmeTaEhqiLBxJ1b6TpZOpVWXc4xHfXGafOiQU-TszjHT2N0Pou-W7PwHMnxTTjh3CRH9OXrOxmYmel6ZhVG7R2el3TFkEjqbq2g0Jrn9QX7l6yBcJRW9V27qaW8vkPkh6cAfqYihDpPg3DV8DVKMW4YELaOktQKp5X5I78JpkNsFJeqY8ENOuUti6rcyMjPb42BurhtKVGpWVSIGra9bIG1Dj-RVyp6I_okepumdZTU7jN7GY4EO4bnozQHQAOGAd1mamZZFKubG2uMxqrwrVBq6jJoDe-65Pr-0Gy2BXcf46jIx8c8BYrOFKiYXr-WRPmF3NF5CE1od9kCAuVbQLj3lHDVflqSungaVIw9Dn1zjFGVZrnx8X33vvIHn1Lr2Kz7NLnKN2mIqcFRCr_3Bd6NO6ud6ALVOWSBgFfU_51yqEo2dGMp9SXe7bIlUWA_KwaY4jsrrchtXVGhfavC3zsB4O-jBMLk_4DYtJcFghCH-u7DOK-_-U9-TjYnipPZOK8Euq8uMbz72r9fS_kPT2P_AQQlNXNsjOWu8fL0wy24F9pGOW5cZhgr7yH81tsYUUP5kjVob_XbMC22ObbxjexF9Q0Vno2t2rM9zlYRK93T4ZgNcPDPey8fYePWEzcX3nSgGE6DD1wkb7xzMUDx0nkq93cFJYda_CffEiHpNx-11Zk-Xwj8YuWkvflY87-Ud3BjOVBBBcemvbxvWYVbeAKc8pVjlJpC5akmXAn8DBayey3xP6AIcyxlaJz4iZRVvJk2Trp6tpNwrpJ5LfHN3_nR55Wo1J60hKy955uW1TJ_fQ7KRhlStWnN3cz9w3XeKuy7nJx7nQpyd9B03afPrxJnytd7B-kS8ZaX6SMiCNquWu9OdeaJ2y3IMVVmwB6trpJhiLj4vltVFggZeaOcerbj
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://shells.red-pill.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 9A07 42 B
64 B 45ms
45ms Fetch
image/gif 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuZnWGAm8AY5zfLiHFfLJBxVr_W8dywJ67xHvOxmQvm8p4XMiK3Rjn6yeBTW0tkof7EqT-GqIHjHkTQBbaLU_EtMHC2ocD5qZS516MCLLbUUBvSMFdV-KM-hf_zdhMkQWMtPOSJTw6VNGSfXYJXlmdJrQyB4PdylsNuV6ZsQHE&sai=AMfl-YSGSv8A7JtsGS10PmzKQic-4SxBzHCTZRl3ckGEo_EphY13W-8WAZaMwhHE9FKKHMDts0uP_tmYSqJxAAyN9i7G-HB30ISZ7P8Ec_SH5WDetJ1eAHVusB1T6nBtdObZT_loUhS1hhQhwLpMuJ27f4vbHedPPBGvg0Qu&sig=Cg0ArKJSzH0khD3rs1WqEAE&cid=CAQSTwDICaaNe-6Kaa6nFNVmSKcBzsgjraeTjbtAepzcXfvQfxzCb1vdWBzO_P-f31UXJG4GAx5osaSUY4HGrpNdT4JurjuGQPLFDr0LDGVhwj0YAQ&id=lidar2&mcvt=1000&p=0,0,280,700&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231206&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1720655930&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701969474481&rpt=1502&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Dec 2023 17:17:57 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

185 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

12 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
shells.red-pill.eu/	1970-01-21 01:31:45	Name: cb-enabled Value: enabled
.shells.red-pill.eu/	1970-01-21 02:22:09	Name: __utma Value: 132252620.685840076.1701969474.1701969474.1701969474.1
.shells.red-pill.eu/	1969-12-31 23:59:59	Name: __utmc Value: 132252620
.shells.red-pill.eu/	1970-01-20 21:08:57	Name: __utmz Value: 132252620.1701969474.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.shells.red-pill.eu/	1970-01-20 16:46:10	Name: __utmt Value: 1
.shells.red-pill.eu/	1970-01-20 16:46:11	Name: __utmb Value: 132252620.1.10.1701969474
.red-pill.eu/	1970-01-21 02:07:45	Name: __gads Value: ID=bb4c68fa34a78418:T=1701969474:RT=1701969474:S=ALNI_MbYaxBtrftG-oXkqwEcgtmaPk1fuw
.red-pill.eu/	1970-01-21 02:07:45	Name: __gpi Value: UID=00000ce4391d8025:T=1701969474:RT=1701969474:S=ALNI_MaB__gXqVROfPDVf4_tDw1Ljbo1Ng
.doubleclick.net/	1970-01-20 16:46:13	Name: DSID Value: NO_DATA
.doubleclick.net/	1970-01-21 02:07:45	Name: IDE Value: AHWqTUlDAdA3DSJnzsqiViaE8bC551T25dCefERfDc3D5rfPtWP65RDNh7z4RBUmbhU
.googleadservices.com/	1970-01-20 18:55:45	Name: ar_debug Value: 1
.doubleclick.net/	1970-01-20 16:46:10	Name: test_cookie Value: CheckForPermission

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://shells.red-pill.eu/ Message: Mixed Content: The page at 'https://shells.red-pill.eu/' was loaded over HTTPS, but requested an insecure element 'http://www.bshellz.net/logo.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://shells.red-pill.eu/(Line 230) Message: Mixed Content: The page at 'https://shells.red-pill.eu/' was loaded over HTTPS, but requested an insecure element 'http://www.bshellz.net/logo.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
network	error	URL: https://www.bshellz.net/logo.jpg Message: Failed to load resource: the server responded with a status of 404 ()
other	warning	URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6098496124751712&output=html&h=280&slotname=9148949735&adk=4210125070&adf=207959090&pi=t.ma~as.9148949735&w=620&fwrn=4&fwrnh=100&lmt=1701969474&rafmt=1&format=620x280&url=https%3A%2F%2Fshells.red-pill.eu%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701969474213&bpp=1&bdt=154&idt=276&shv=r20231205&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C700x280%2C620x280&nras=1&correlator=6824293562278&frm=20&pv=1&ga_vid=685840076.1701969474&ga_sid=1701969474&ga_hid=1511016103&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=491&ady=2955&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079920%2C31079928%2C42531705%2C42532523%2C44798934%2C44807751%2C44807763%2C44808148%2C44808284&oid=2&pvsid=1373949010449336&tmod=671657430&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaeEbr%7C&abl=CA&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=277 Message: Origin trial controlled feature not enabled: 'attribution-reporting'.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.eu.criteo.com
ajax.googleapis.com
blinkenshell.org
cat.nl3.eu.criteo.com
csm.eu.criteo.net
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
imageproxy.eu.criteo.net
pagead2.googlesyndication.com
rtb.fr3.eu.criteo.com
shells.red-pill.eu
ssl.google-analytics.com
static.criteo.net
tpc.googlesyndication.com
www.bshellz.net
www.google.com
www.googleadservices.com
www.googletagservices.com
www.gstatic.com
www.insomnia247.nl
www.xshellz.com
142.250.186.98
178.250.1.6
2001:41d0:305:2100::4e16
2606:4700:3035::ac43:9f36
2a00:1450:4001:803::2002
2a00:1450:4001:80e::2002
2a00:1450:4001:80f::200a
2a00:1450:4001:813::2003
2a00:1450:4001:813::2004
2a00:1450:4001:81c::2001
2a00:1450:4001:81c::2008
2a00:1450:4001:827::2002
2a00:1450:4001:82b::2003
2a00:1450:4001:830::200a
2a01:4f8:c0c:b93a::1
2a02:2638:3::10
2a02:2638:3::12
2a02:2638:3::1a
2a02:2638:3::3
2a02:2638:d::c
46.150.36.137
81.171.28.46
00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce
013726d581ea143481ff6784faf267ac69cf27250a6b7c37897c415bc7c1f76a
02e82b0c6573f49da9969ec1d9076059957b9ad313aea5ed0335d910bb930d22
081050fe628141e892b0bf8664bb4aae75a6c0e1e6af549299a7f6da3dee465b
0826260f5fb0377aeeca90c10c79d1d192ee369634d18d488be744d49753e42d
095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6
0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea
21d76cffc0153d20cf89f500ea5c1bc9aa9729f6415a20927af1ca53b864f73a
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
3f132006efbbe99ecee57b78c8987716800533afca00d8011350560040fc3e00
418655ed8adf3d9b6767395ede2509b31756f5cd672e0e203e5d30cf80fd326a
41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd
444723672c8b2bad428845277cef13c3863fb7a6236e7937605de327994aba10
4ca532668f4a9157dde5a5a8c00ff50c11b32c97e48e05b84ca86c316b9ec583
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
5130be9edd4412823495b4e795c7b1565638670bb2d803e11233c9cfd8d7d48d
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5b99f360a281f5fcb829b2e9991fc681cf7027dc908cf80acf0e68d48049ff09
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf
68af3635b0864e3ca5567570ace0d6bbd54e363290e31f5ad4d821b8ad1ebb41
6d5820b4b9f0e3e1e5f3445d1836a3dd71544c07ea32255753a3a6af59172381
6e9e6a7af8feff441b57e350db4439938555bddf8a2c374b20af674b1e562fac
725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a
73273e64c93401c8c6c1d667e089c2fc958d7c783b10facc1f17f4e1124f2f3b
75bd10be9aa4d302459bc8219cc4c4d82dd08bd33fc7e111116b60ccb2654f7a
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8a59ccc1c7a1e76d7ffaf0060fb58afe91f3cb65123aa88f5461530141999e6e
8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579
8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395
907ba78b4545338d3539683e63ecb51cf51c10adc9dabd86e92bd52339f298b9
949b3cde1a46caf4f55bb496f58a44af641a4b9fed64f95057bb5eeff142170b
9a47f64d80567c50934ff990849168e708b9dd8e212a2d639ed4cdb8530eab94
9a4eb2c9445287c34cb0a9ed5cc673460362483f0855bc91f8230dfa46a955e1
a01c07907aef447d1dc58a508f416ce9c1ae3a695e4961ae6512e159660934b8
a04fa6af32e77548f1c3e27b7014f3520c7494f317fa80b58f8704de83e4b821
a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553
a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6
a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37
af26eb6093f6b16b8d0d2fe29bcd0eaa5fe68e8cd369e603ff6fc8cffdf0b78d
b023576c8b8fe9227c003708be27bc17b0c22cdc5d2d7b3343544a6a829fcda4
b2824092990b29f44b0ce03526347089735179ccada3ae7046fef87bf2469b66
bce84ba90761294f6a75287d6433780b16a182c3bbe7ccf132be8aca5e268915
c45ad6b0f981d54497fe6f7d5ce7316fbc418d12641e1c8b01d464426553a216
c5fcbbed83baac508ee6ba358593a03a385fa46b7887af2450b9502d8a633980
c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1
c95ad98b97165cc2132b0d6b30be2dac0c043b2cf39b5768e3c21b199c238cc7
c9634d0e4698e2f2f45ea005722ad4fd57b98845dbcf25fc2d1bed4163034d7e
ca0a414ba11f94c3dd8c9adef01b4cc73bebaa44cbb80a43d02f6e6f317952ee
d58af67992b3222ebe8357316eaa6b3f44b6816044f00e0ce6032ad9904e8f7d
d7fee07b08f21a5a9c385220b8e279007527e8bfb32434d53da04727600362ba
e16f7579677fa60f9f16f525fe622fd6fcdb65368fc2c2357129f0bc176d93d0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e664acc7bbabe41ea64e8517e2af2e0d426f719f32c72b911402f0ab40c35546
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f16e8128eca1d20ddb6e1f2d5e93d552679880773674779357afc9afa6253866
f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

shells.red-pill.eu Open in urlscan Pro 46.150.36.137 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

81 Requests

98 %HTTPS

82 %IPv6

15 Domains

22 Subdomains

23 IPs

5 Countries

1167 kBTransfer

2468 kBSize

12 Cookies

21 Outgoing links

Redirected requests

81 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

shells.red-pill.eu Open in urlscan Pro
46.150.36.137 Public Scan

Screenshot
Live screenshot

Full Image

81
Requests

98 %
HTTPS

82 %
IPv6

15
Domains

22
Subdomains

23
IPs

5
Countries

1167 kB
Transfer

2468 kB
Size

12
Cookies

81 HTTP transactions
3 data transactions