zvonil.octo.net Open in urlscan Pro
104.21.234.133 Public Scan

Software

sffe /

Resource Hash

3f9015c499bd1271c846320ce7319c22a88caa022a240e8c9b2cc62d3a4361a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26983
x-xss-protection: 0
server: sffe
etag: "1097 / 325 of 1000 / last-modified: 1641807575"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 10 Jan 2022 18:56:31 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 145 KB
51 KB 61ms
35ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

75f4e556e5c8d7748cc1c183c6214f67f1d9f1a81d2360a7fb0c604fb8ad2c0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51787
x-xss-protection: 0
server: cafe
etag: 9653739286974565387
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 10 Jan 2022 18:56:31 GMT

GET
H3 200 pubads_impl_2022010407.js Show response
securepubads.g.doubleclick.net/gpt/ 352 KB
118 KB 37ms
21ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022010407.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d4d964d6d34df7fde3554039d33b468b74afee14d6526a87b926688f0fc8d93c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 120967
x-xss-protection: 0
last-modified: Tue, 04 Jan 2022 16:13:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 10 Jan 2022 18:56:31 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 109 B
122 B 36ms
20ms XHR
application/json 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=zvonil.octo.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ceaa931aee8fff06c481db02405b0d173cd680ccb22d7d6a3c9ea49c5b7cef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 10 Jan 2022 18:56:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 97
x-xss-protection: 0
expires: Mon, 10 Jan 2022 18:56:31 GMT

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/ 276 KB
99 KB 52ms
35ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2979533909392588&plah=zvonil.octo.net

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9f90b1d6f886480f7a961aa071ac28fc98a8a7347812f0acd5b2d3c7a51215b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 101734
x-xss-protection: 0
server: cafe
etag: 6338342865683808284
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 10 Jan 2022 18:56:31 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220104/r20190131/ Frame 72FD 11 KB
5 KB 36ms
9ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220104/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

73271f83e0d89e09da51434a964dde15ced7b91331f3b96357eb05ee81a85567

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 10 Jan 2022 16:07:57 GMT
expires: Mon, 24 Jan 2022 16:07:57 GMT
content-type: text/html; charset=UTF-8
etag: 2196020943555189384
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4873
x-xss-protection: 0
age: 10114
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 45ms
20ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=zvonil.octo.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022010407.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 10 Jan 2022 18:56:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 49ms
24ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=zvonil.octo.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022010407.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 10 Jan 2022 18:56:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 14 KB
8 KB 530ms
530ms XHR
text/plain 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4150545889650970&correlator=1730309308246647&output=ldjh&impl=fifs&vrg=2022010407&ptt=17&sc=1&sfv=1-0-38&ecs=20220110&iu_parts=209694548%2Czvonki_top&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&cookie_enabled=1&bc=31&abxe=1&lmt=1641840991&dt=1641840991160&dlt=1641840990936&idt=196&frm=20&biw=1600&bih=1200&oid=2&adxs=277&adys=193&adks=4116272111&ucis=1&ifi=5&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fzvonil.octo.net%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=760x-1&msz=728x-1&ga_vid=1762928891.1641840991&ga_sid=1641840991&ga_hid=1646229672&ga_fc=false&fws=4&ohw=760&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022010407.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

49154456484c9d9ecb9272f75e1ea10d3f7a73c3d805f35e4a37f7742ac5d9fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:31 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7816
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://zvonil.octo.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 17 KB
9 KB 1364ms
1363ms XHR
text/plain 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4150545889650970&correlator=1730309308246647&output=ldjh&impl=fifs&vrg=2022010407&ptt=17&sc=1&sfv=1-0-38&ecs=20220110&iu_parts=209694548%2Czvonki_side_1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&cookie_enabled=1&bc=31&abxe=1&lmt=1641840991&dt=1641840991166&dlt=1641840990936&idt=196&frm=20&biw=1600&bih=1200&oid=2&adxs=1039&adys=541&adks=1556906017&ucis=2&ifi=6&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fzvonil.octo.net%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x-1&msz=300x-1&ga_vid=1762928891.1641840991&ga_sid=1641840991&ga_hid=1646229672&ga_fc=false&fws=4&ohw=300&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022010407.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f58b2f27daa63f2a07abd655a4051dc38b44ea2bfd10db46ba24e7dea2b7ce24

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:33 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9559
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://zvonil.octo.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 17 KB
9 KB 1044ms
1044ms XHR
text/plain 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4150545889650970&correlator=1730309308246647&output=ldjh&impl=fifs&vrg=2022010407&ptt=17&sc=1&sfv=1-0-38&ecs=20220110&iu_parts=209694548%2Czvonki_side_300x600&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x600&cookie_enabled=1&bc=31&abxe=1&lmt=1641840991&dt=1641840991167&dlt=1641840990936&idt=196&frm=20&biw=1600&bih=1200&oid=2&adxs=1039&adys=1914&adks=3260532487&ucis=3&ifi=7&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fzvonil.octo.net%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x-1&msz=300x-1&ga_vid=1762928891.1641840991&ga_sid=1641840991&ga_hid=1646229672&ga_fc=false&fws=4&ohw=300&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022010407.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4e5af090b6e6ae68aad9c61464351c668cf1768e536cb1d5e1d9b5239420654

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:34 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9319
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://zvonil.octo.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 44FB 6 KB
4 KB 78ms
16ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022010407.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/

Response headers

cross-origin-resource-policy: cross-origin
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 10 Jan 2022 18:56:34 GMT
expires: Tue, 10 Jan 2023 18:56:34 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 1DDC 6 KB
3 KB 75ms
16ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022010407.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/

Response headers

cross-origin-resource-policy: cross-origin
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 10 Jan 2022 18:56:34 GMT
expires: Tue, 10 Jan 2023 18:56:34 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame C231 6 KB
3 KB 73ms
17ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022010407.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/

Response headers

cross-origin-resource-policy: cross-origin
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 10 Jan 2022 18:56:34 GMT
expires: Tue, 10 Jan 2023 18:56:34 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 212 B
415 B 15ms
14ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=zvonil.octo.net&callback=_gfp_s_&client=ca-pub-2979533909392588&cookie=ID%3Dce6fdd0735d9541c%3AT%3D1641840993%3AS%3DALNI_MapIh1wIk4CQkuJU4LU2MggxokXJQ

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2979533909392588&plah=zvonil.octo.net

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

537.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

cafe /

Resource Hash

97311d5ae6e328ec4164fa479ef7d92a0b5ce992d6b9cab913f7d6da8b32f0dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 199
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 33ms
16ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=zvonil.octo.net

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 10 Jan 2022 18:56:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 34ms
17ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=zvonil.octo.net

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 10 Jan 2022 18:56:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 68F2 25 KB
11 KB 657ms
641ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=4170394609&adk=2715274491&adf=2671285577&pi=t.ma~as.4170394609&w=728&lmt=1641840994&psa=0&format=728x90&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641840991077&bpp=3&bdt=141&idt=3097&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dce6fdd0735d9541c%3AT%3D1641840993%3AS%3DALNI_MapIh1wIk4CQkuJU4LU2MggxokXJQ&correlator=1873363329958&frm=20&pv=2&ga_vid=1762928891.1641840991&ga_sid=1641840991&ga_hid=1646229672&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=477&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063858&oid=2&pvsid=4150545889650970&pem=438&tmod=427&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=FgoanG4k2O&p=https%3A//zvonil.octo.net&dtd=3108

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

26b92002c1690a9128ec84cc0ba214018a3b356384173aa9582bbf88a59d58ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 10 Jan 2022 18:56:34 GMT
server: cafe
content-length: 11283
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 37E1 25 KB
11 KB 414ms
404ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=7096521402&adk=2342716466&adf=3252783458&pi=t.ma~as.7096521402&w=728&lmt=1641840994&psa=0&format=728x90&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641840991080&bpp=1&bdt=145&idt=3108&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dce6fdd0735d9541c%3AT%3D1641840993%3AS%3DALNI_MapIh1wIk4CQkuJU4LU2MggxokXJQ&prev_fmts=728x90&correlator=1873363329958&frm=20&pv=1&ga_vid=1762928891.1641840991&ga_sid=1641840991&ga_hid=1646229672&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=1133&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063858&oid=2&pvsid=4150545889650970&pem=438&tmod=427&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=cZVS1rX0el&p=https%3A//zvonil.octo.net&dtd=3112

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

82d33239227a65cd1ecceb5ca2b2023445affd39d7e233e7de3a0509897cedd1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 10 Jan 2022 18:56:34 GMT
server: cafe
content-length: 11469
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 7891 25 KB
11 KB 260ms
256ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=250&slotname=0787847652&adk=665242438&adf=3866777003&pi=t.ma~as.0787847652&w=300&lmt=1641840994&psa=0&format=300x250&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641840991081&bpp=1&bdt=145&idt=3113&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dce6fdd0735d9541c%3AT%3D1641840993%3AS%3DALNI_MapIh1wIk4CQkuJU4LU2MggxokXJQ&prev_fmts=728x90%2C728x90&correlator=1873363329958&frm=20&pv=1&ga_vid=1762928891.1641840991&ga_sid=1641840991&ga_hid=1646229672&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1039&ady=1319&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063858&oid=2&pvsid=4150545889650970&pem=438&tmod=427&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeopEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=tyYckT3vCd&p=https%3A//zvonil.octo.net&dtd=3117

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

887f3541052961e79a9baae338d0b392c200d2c98f1290e58ada59aaf66fc54e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 10 Jan 2022 18:56:34 GMT
server: cafe
content-length: 11748
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 6AA9 0
16 B 20ms
20ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&adk=1812271804&adf=3025194257&lmt=1641840994&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fzvonil.octo.net%2F&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641840991090&bpp=1&bdt=154&idt=3110&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dce6fdd0735d9541c%3AT%3D1641840993%3AS%3DALNI_MapIh1wIk4CQkuJU4LU2MggxokXJQ&prev_fmts=728x90%2C728x90%2C300x250&nras=1&correlator=1873363329958&frm=20&pv=1&ga_vid=1762928891.1641840991&ga_sid=1641840991&ga_hid=1646229672&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063858&oid=2&pvsid=4150545889650970&pem=438&tmod=427&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=4&uci=a!4&fsb=1&dtd=3114

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 10 Jan 2022 18:56:34 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 4DBB 624 B
297 B 19ms
18ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQlL6EARi8q9a9ATAB&v=APEucNVBbJ7gjJtMXtcuZQ1x2kaYrJcRJwW8_b3kZqaWAaJUfFcaDoB8U9bszkjknELV-FxgJvCTFST4vhgTgd4zIBhdC7k4qvItMGmr08FHJhhpY0gwhE3wxBtCf60e0oNkt-gAZpN4oJ_CIcC3FggDIQXtozG8x1_CwcY6GO9Dc6WWrGbC4f8

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 10 Jan 2022 18:56:34 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 44FB 78 KB
31 KB 73ms
72ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D_vt2dqOvoN6lrq_I-phRRiq5zMyXikhCjkCrxJDKliRiWZo4CgErvbk4Y9pXJyt7bLCFLaqIXKN-XHQIvhZsFLLr57XPtiK8DJScRkjX_ARscECyPrybfIqzLsqmZo83-i-c6e6fSeCkteT7hzD9SGFd6Dw&dbm_d=AKAmf-AAaNvnYxH_u8XldKdaMteafbx3chJn2zaYsk_mZTgnnfYAmzeQX_FOxAbJioqfXWB1NzODVStCxxEUd3ie9zIOoM1_SoFC5xKhlH2gFj8NwkKiG2MXxH3f7c4so3qtnwxCrB1kd4IE-BN9Ei-nvqdfomgUmoelcgRdxNZRmOMldI5HyaA3aBzZSbeJ7i8P-9Z6EElFM5WtIaY_QH_SAkK8Xqk0UjJNziDzZTWelVtsJ5tGluyb50PBWF3Yk-v1TO_q9Jlp9fpT98njl0iGHwoX3MKi8G_y8xun6oi1xa1wm0hTQ_qKS0vmI38diiWFqtxjT2Tg8cy2ErgRPoo1XPsp6E3RQdd3_wg8qGHHYsbjq1xSLBrgmGiV6uO-hAimLgfm0WbZ_YJztDoizKwrTzFNlaKdIysuaxUJOIBPJofME46N-Yg0wLk29QHlLNYWtubCoHeWRl42TLVegRlRcYYW1DQF1iwu6d138bAoB1eqo1QY7Q3c2JUcO0UDTOQdL517qhB4Hgl626OBjw2xFP_UhTy0R7zpUuygOstH-8bWmi_zxCoamliLCWplkr2eBdMYlfde2yfja_E6qb8tiVdabfE4aHjUa-BCu6dMdmI0dd2pEw_2wzGrw9Uxp9FkQ1WTVnS_xcD6g5SA6rIrF4WeQ0CxrY8KxzDRpcJI0CbFaf9IZb6pdKqvW0Px-UgF1H5zZd6BhXz8lJTFsMqWpb1Odnf6U93HQHpMx0zyU5uQTBchrCTIsn5Iov_kyt5Hn__C9jdYTgoHTVjWOWm1zOOdz4UsmgiCkyHIn6-gApm3FZ9HDVBbtlY4YsGg9pjKoRCNbr7jLQmlryl8pbnqRWRXYePwgj0fHSes5Rtz3wCCxX_s8C3BknTOcgSV2ExSWZhjoMj4g3ZtRjE4U4AGyHFDldXOmvO7S8hQLQDKcDay-lOkK3fb6ks5-omsRIY6deL3T88rKlhRyMRgoFdQAzvGWlWsxk3pMObQd4PoCNTlJf4ai-rrrnvWkxQoAIWoUgdc2pAuPZGfx_5_MR8Dvkgg_Zs5QBXCaKsjON0xXvT4vMNbPP-5duNDydR-Dul_PswqGEFum_B52yJ0doHG5XhRS5Nf4iKs9QiWpzcslxHVfXoOb9OKN0N2JVJMrIeQ90tfu8btZwWDpd3ZuWdHj1dpPgUPn4F_ExqJUAIY6k5zQQQMRvW-U1vUXNATUZa3PLoww_cuybgFJjPVhkEDYGM9vmefrM8b2rt6EsswjdBIiCm3iW0k6EzzsVz0YfbIs6YApt281nLmHMq_X5Xvy2poVt3HmbySpOzTiBUNhm-cmaORE5NJQhq24UU8b9N9zGsAh6ae93Uaq4tIp6HGwuIm9BdFj-jkZ4KszJxxEwxTF4fRbqBQE3MuBW7qmZa5xiG2Zv_BzqhrfCduZPNfMVXo6W31I2D0hEAQ7D3Rd0CvVSUhbD6WNeSWPsL8-_OJNLVflC7RSTS72tw9JNNRHIzgCtvmhTWs3GFt0_1p5uU4uAQg0jHIkaVWRQQo2MBvSW9HbE_597dkDH6UEr13sAXVKr68Zkc9AP1jvVsZ5KSRveN8aZcm1DX3EZkApEfCPJqFAzIZPyK7hPrEYYcE3hr4RMsJzy5io774oQuw6smrJ0Cdki--01lS-7BKMLWi5PY1lSp3EDNBVE0XARooIoa5s0jcNIN42uiT64lgk5t13D62LVD4NoP5HhuK2LdymmlmTppdUX-L66o6B7u0Znp6OHbQv9XOlz21RI0qg0IxIk-pUl3wefB7QDlw7KgMWRgH0hp-qr4Ssp4uqqkOqzYxcqOZ0_6F4WHBhbInwfUBFQ8DyYR54llUPKbV_LOfQqBqARbCYBHhVmDgfpNEFOMEoHRY_u9q3gbKUMcEOKOjSlwOGZTjrNhZiiZ56bpmpMy4BIkx5gFj_R2jfBdG96deIwrAOyLNeg_eMiT7Aiz1tCDA8CWyclXcw6PjAY9cjzvdIER7UgNvBkZeoEtwT3Jh2Gf8mvj6nj8ms_iGMi7dDj64vBVlTlh_Ih4PT3U_ph3P37hJ4UhfCOoEBG65-K6f2iWcMmgw48NYZg0Aq8ysadw5OkZV4jwVv77La5XD7V_MJzZY-1P7l5HKuDBQRLm84O1o41RnQHHoS3CUv7dzsZbHBwx-Goz4Hl2aF_wULksnyULfN9lx6agsdJbDCH1naH2QkTAgRQS3y4jzDzLYh9gltP8ro9VyIAGgLQvR8MtWiU7Ixk-t2ji8Vof6MCzUh399WRBQPC5u5fGJbcc0t_1q5asS1I4qU3WJWobdeldfo1_ckEO0uu-FDafQwmKXtm8zyVsZ3hEqgMaOEMzDqfrpM9nh47Ouf-NP-XVoGFis1Ie2ZEjNyiDSYbNBZ9KK-Tlb-SUlNKXELM76_wBceBQ4wzg2MaTnkXDvfyBVzRCqg7jjsPeFEaADuMLhnPYk2ucqjfnE-AjwWl2u22A5LaA-FIOVNGNk4RxPRjsAVm_Pz5DXWyV5yWcQZYokz4IQSpuSWL6aLKfL05N9nQEeWx2BW5I_62KHl1EvSCOwbGP5I3jaDdQsufWP9HzCmfmCbz1iilsJEi-U9_snaqZH1MZRbjZcib7s87PVxSK_FfpfWopGrZ7r_ETt1c9kI_o7xTaiPIiEA_yajkVOO7JjD7Hx0QfMDwuWLxO363gADxWCR92VbgbF1GtAl25Sl8G7ZhinpVa9_bGoc28083_56DRmpWWvHauXxy3im5CggEVEXzoT71Pt1QvTHyeIaK6kjPAgFy1x45I2ZlMkvctQvAemCN8FWnE0CEpOqFrUm_rS6C5n8UjYnkrFB7U6FXnIb9fj0L04_F69JtDzUOKjJpCtoSmSOeQblT1gllFhrtxAHeoIND6Xcb-ZMxEwLlR1_cfgJj4topfo0YldpnowVz5DL3uzN9uzcjhj5F8ZJpZZ4cJbStTiIAqMfeEsTrh8eJiD5mP0ZHtLh0yBhDLVnxH30GWiSUpIRltxhUefzD5n4kHObQoOqvpVTajbuGDCkit8uXAgU9RYua8p91NWSAcBdioQXRv1l1V9lbxojGt9KxQs9mws8SED7UrcaXkTdZLCpsIc4VPElxHus6C6tF8qDCsGSf50i-B_TozJ3FFRUcPAI2scH2YwjZvrSl7URqo05I--_1vwWlQLjEPHsL6mCRiFXOMX6Amo2sCcX78lHcnroQwQ8AiLxOL9RygHtMNU1dUu3BBWLQ2Zvc95wGtGuCawllAc_FQMR3dSuvIeG8E1tSXI3d2VYfCGusf7TE5SeQ&cid=CAASFeRoLPVrTp_I1jzFzLu0g3RpbP6New&rfl=1%2Chttps%253A%252F%252Fzvonil.octo.net%252F%240

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3e8c47bf41cfa6c514149f7a4f8f5f543829d47d276347fb1ec8a2cb3a1882e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31429
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 44FB 42 B
63 B 40ms
40ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BVp_PjxNmG487ODIFgdVcEuoVDIC7AEgWxPJFOX4-Y4scvR-dDF9s7SOTbSzOqthvrzjVMaH4UhQ5wmYzqKpBaUBY-4sL4Cs0CjtLg0GihA-dFdV0

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/ Frame 44FB 2 KB
1 KB 45ms
15ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/window_focus_fy2019.js

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a00a06d39ece4f2816e75b2e577c3b05a51ba196e19bd103d1124567f0c54f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 17
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1210
x-xss-protection: 0
server: cafe
etag: 9753579932288205849
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 18:56:17 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 44FB 120 KB
37 KB 68ms
37ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e78bac7c2d4ad157ca2d43d12d1cdc08ab7943d3535287108ed9e6b8ff9da523

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37632
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641385868096614"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 10 Jan 2022 18:56:34 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/ Frame 44FB 15 KB
7 KB 36ms
6ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e979dfe4d55dc019e062fbce71ec0821c8abeabd94f7490deedf56ee2712d2ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:51:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 330
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6485
x-xss-protection: 0
server: cafe
etag: 13366392639478751132
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 18:51:04 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame D28D 624 B
297 B 20ms
19ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJHlswIQ8KXioQIY7OOSmgEwAQ&v=APEucNX46gaTmB1N_j5V8obb1pkT0GToIEmKbg4weKxtB5MhCKswdE7gQA63BuSbLVvlSetXfHPWXXtLYmw3SePIWthl1SwmxdhEH-UFQdWSal76w9RX7PeujW8XNxIX9jU_Drs6aZFkZssXQcsKtfaPwQKMgWujeRhFCEff-OMgF6_Gz2K0GuU

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 10 Jan 2022 18:56:34 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 1DDC 75 KB
30 KB 53ms
52ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AGvMLPo6tPnpXkEU0Q1GyVs6FsF6BjZj10OubSfWev8XWY3xH1_Xy2I1I2Sl4qaoKymJWgUZ_VS5TJ5tNi0Q7HkKxZequHDBlNd9P3z_Rsm-iEu3C3FAyr20GRPRGTnvjpxBfz-4X5XwMXirYDrEgUq2CluA&dbm_d=AKAmf-BVv9lkZMAssZOKDIZhZ-uQgA4H1VmlKXXU4ztnZQaBS9LAAsKVQZr4fSFiMcj3XEtENrf7TVmEcji0lPMhHMQrIZg8bVpXHIYzj3KYz5g6EdLXZwRtlIKeaqeGjm4qw4da_KPLfkKqUvGrpZAwyOm83RMunCOI8Q91Y8m4LdbMe-kDijH-0hv-irhHLwakk9-udNowlCFK8D9UsUMYbfZXnW4snNl9fjUxZc-CqrHqyj6qjkslE4ooobYMaiL_fvxuG9WTY2-CcgstLBqNz-SohU7Jl2uD27JM7qMQsnunfiETa-m2S8iOWEm_qZXyEdyYZixosbFkNDU6vOVQLCYzkgDYkLsu9DdjNBkxBUy708CYTVxsIPo53b-OpcaUCQE5cmCuEaAl5rKuNt3Dx0S4mPbQ4pKvOJRclarGefwFxmhdC8R1kq5K1gaOcsPMxQjPPDCGfOTvN6KRuLsVacl3OETp0kfknzohMgkF7KXexU9fTm-zroZUUpTnnZjTXwxgFPxK3kNvBk8-3EGH9Y7iM3r3MQaIVG7p1T3a2lsckE45yBM8MiefT0e-5V3vlXYef6-KIRtuV_yRfeGYUeQ_5gzX2c7sEU_Ei0UkiDjNRx8RBbznxEdVr3bJcWcQfKRPG9r5f8BU8dQLBv8-4FNMpjgKogGyQ0a5OzIJqWw5Mdi-yYSfQVDkK5Qd98B4f1AbEb551HHT4UCAaqHQlDoe5kerqqopglRztK5PsEwVr9BaKScesBZihBlkISQZyFtg61f7Af0M3zD2lhrVHoxhgYhmClT1Fw8_xYaXUuFRWFG5Q-c4P6DGoHw4VOkC7BVzkeFKfWb0yYmq9S-ZdQFEB06ugRZ9bxd3-g6vV06nE7luzr7Z3M2gO3wAoSEmshbN2Smd_iTCVDBLC-E-LoFzatKe9s_E3LKBJytLr0F4-qkxOzIfStkc8kNOWdCoJBTOrjNaBsLlNy7MIzPVLq1N8p-wVGZzG9K24DZQtSNd3psHNSP-Gvvi1ht-FecDDBo1d1a_bgwkYVMzpYuCnz9TunI6j2z2WbeMjLBvEBkT26xlaDdQ2JnTX4jf5MNixY0jgcOX6fo60TcfT_GjbxsfkKo7oW7nduFVg7sIgIfWZGciw370bJw8L08M7Rp_KQ8spG9yrA5Vu-gJFUny9IIw7pz1-sYhpNeyPAo5W39KI7HSxdg6d20G0z-rIeVvBr0b7Ts-Uv9ntkcjga17gs59gzGUqvoJ0AN1XFr9fwNjPvzBbDHBLLvx0G7BKfXZ2iaQFmN7DAqH9pUe3vmVgaVZ2JkXYZL437-Ep_rhRnYNORSBWjQgvy-_3YvwVd96-YAQhOxkPyjcUPXphaIdfIQ8q23R6DgjenmqaMz_mHqqWNaKR3jscOkOmfOjWirEnsnZc2l07kslZv926vMV67k1JwMsWr-pZoOAvF4uVT-2_EX4zfpNrGN_Jbt7W_Ka2lD8-gM17w7spSnK1b7tF-W1HXkCBaTnncN2DpZarJxgrmlxNkCZgNw7bB-WrDGvfCmW8a6z7PC8BPhm4deIhuZD7az7IgRA00Nv7qG2x4BCr3UhIe4XCnXOe9RWsQacVF2KM_zT6KrySLh-lQIHmT2DG3bo0ZLREnTCqWeR7K51YQ6B1bPR9Cqotj7LfsRN2Td7IBIT-d_RIfjG86y1QSSh9-unl4Oj9BHOEzzjUGzKdWOdSgDzwyOuLkrKFLHVJfNK46hZi78T4j2USZzw_rJmUYg3Ugd2L-YxffjaQ9JryHrQzCEdp5qky7f8vT8jhbEVZeSYvqRaUCh1Mx5bmlG9kiRJYBGxO9T0Cm3g4i-suhywu0BE3JLVKbWMwNcE9NVUcQUWvGWfYPQ3sVTOchSy80uLRKUsd-i-7txk-vXYcZPkQlSAiVJWzmSWaIJaw1IZkY4T8St6GozvLBgLifFkxLe7AdpP9UyRTnqn0suALsE0M3uFwPZfDeEP6_SwikwNmkPf1li7K84B3kFLoxXh4dOiC7uzOE67aCSfRzNCof8oMK8dmvK9MyqljDxuJNLdpfVPLCz0ELTf1DgQsWvfCnadQ09h5VZYDvRXDz5Zgv20C69H3ObRfAxBwS2oPwFLa3AvDQ0AVp1FoQ1juxP7whBcB7D3EhMIEMu473sLZ470mIV5O3NAOZxL73omz-6FkNJXiTAsmxfnUtsXMIS0S6s_3QAizol0Sk38ywMCaiLeCLSZK6arOQT33NXu8n4L_ewebq4p2ZWy4QbK9XkP74pAdQpniLtXmG5eDC8X5GkjL0CXndJzoPl4dkgonCTGRCLFRoxWTjJVEDhGvd8201AL1UH6FViV1uD0-WcVXIhfU3fIv0eYMua-tTARrCHKZaLER5sVQPjuCNkvQOtrOBVynUUqhRYDuRKFp_BK67JyZOZqGtgAbf5_JTmPDKAx8NiDojRejpwhABSVt_KdZQg2PKznd4V1wcZ1OQF6K8MvOldPKy8R0L1pI8JwMB9KCRrus4kaaAZn1GulhLH9Z8ilALa9QRcziGNhYhbOHayVfQ-tP_Gy1Mf2PSFflAl8RsVFOGe2ScWrAysucrIHTkspAwdxLsTdLr_eihCP9RYKhJWOwtNPH0t6gkgetRTR0yPWxAN0cj0d-UoN5H5aVnlQCbpr9M6t6dfGgYXDQhYOQcO3v4LKhIdWdcTCx7atY1Un9TeUts18GyQYnNJekwYMETaEDZqlOo28PBTUPOG_rVf2_X9Smo_4_U6o4dX9gC7vgHyvbimQ5P6zgxRBz_0Wt0YlKYcXCFVnk7yI1UK64PXQfF24aJXGVIe0k7Pbn2ct9oq2HOi4rQ1mVTgqjFJEVFVRsno_4lI4WDTUlycYTvbAGyM1ueYAezXKuW45qf_dhFXcKilDOYvV2YgcwGFWzJ5HJ914LN8VWGiK3Gv43XYYTJZQaKKSenpkeux0lLFD5yV8PoAXPpKFuol6X6nPqy6Pft02Q9ODks4xNUjFPfSEj8ltBLKmI-9jp67I00xorA_E-jK0cyAxfvYwfbDlfrM3xOwAwiV3awmr0H35Tnlt0vRU4pzq8-kE8QZL3NE4tuDiG6z_cCQMEygz_k8F2CtH25NvR9iFrowZGglbpH8C9MO7uQ1hqz3F0DOBAUi8nBZ0uJLFVNPLNo4hQGUggHSEX8F7czQmCk5YLV7EjX7-7KFZ4zIuRioWkmrbk-7Lc5IXAEAQbmbuQKrmF1CJBw&cid=CAASEuRowSLuBKxTbVvakrBuJnmlpw&rfl=1%2Chttps%253A%252F%252Fzvonil.octo.net%252F%240

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7f35afe8bb3d577bca1af747b0347f2b9c4e37b1396dcd7bcb6ec20c145d0b78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30627
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1DDC 42 B
63 B 44ms
43ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Avt55rPsKamqsrLuBuVaPxatWZHFpyfgsvgI7d4cxaFBJUKp-cdRm9CXNk96NQtGOWMgidZuty0MF0JujJe_fiPRlC90sU9S6e8qLSSp294ULHDeM

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/ Frame 1DDC 2 KB
1 KB 42ms
15ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/window_focus_fy2019.js

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a00a06d39ece4f2816e75b2e577c3b05a51ba196e19bd103d1124567f0c54f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 17
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1210
x-xss-protection: 0
server: cafe
etag: 9753579932288205849
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 18:56:17 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1DDC 120 KB
37 KB 73ms
46ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e78bac7c2d4ad157ca2d43d12d1cdc08ab7943d3535287108ed9e6b8ff9da523

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37632
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641385868096614"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 10 Jan 2022 18:56:34 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/ Frame 1DDC 15 KB
6 KB 34ms
7ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e979dfe4d55dc019e062fbce71ec0821c8abeabd94f7490deedf56ee2712d2ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:51:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 330
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6485
x-xss-protection: 0
server: cafe
etag: 13366392639478751132
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 18:51:04 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 0A09 624 B
297 B 20ms
19ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARjovNe9ATAB&v=APEucNVRmLSlxyq1WrBRkQJWAFH41NCTeiYhjg9ZYuwfnlN2PD4Eh4ZGdZTGbYgZJZhaM6cw72izCeDcMRV3HS6t2uReAi3G6jpa-C4T8XyFPs5RAVuToIGazFL2qOJO-M2yOFgeZNgQei42v-a2m0TrZeVfcoV9rHU2SZ63GbPqLaDm8p4yjf8

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 10 Jan 2022 18:56:34 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame C231 75 KB
31 KB 55ms
55ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BF3NmH1Lu7drwGyMrH0CDWYiP9oO0zzPT2iYCcKFPHtY5c0u5yVvtUYaXljniZXBUEtjgKuxZoMlxXiRUebA1YL-3lfN1qzPgSfSAJ-IW8m57fYzc8A7dbQIlpYoSb-I0ol40JeVXN2se3DwKjhVqdexR_5A&dbm_d=AKAmf-CqQdHn7D-83MIZXuFarPKXoa0oHRtITomYD21ZTKqohRWoHAV9tw6HhTpCMRlf_PlWlWR8hnkCPoiAN6hiFt8EoA9bRQp4BmUUdNUSGBgvcK5VvI-ZO0dJK9KCdSWsBSJr0NWLLdYN47jFl1PjcRg3SN1Divy4Trf0yLa_xexDPDyBXNzHIs15HjKpHGUCP_zZ_o30QvPB7Wcera82Nehai2O0Y29bAFwGbWYz3ZXInSsPa9__xRZYbq_VOPs7slv6Wtb6vhBP_I6WQzj0dsszct838mi-BdDWW67QUIkW7ZzzB-uMWBUNJZpEtCCZ4Km2rc-ut4BDCQTZPPAEHPxehVoOpGTDy9mSZIFu3CnOudtBWCFlsxfRltvmPFZdZkbzkbJBNr1ngqJ5vEmujClDcStIAxdWrfH8pkf6aI8ZuL3yM2RQkIibvlN-1crx-BHqJcVyOy3qdWCChnvlKXS_y6MsKY7uVc074njGGzRYPDhidA5eM4hZeYs3AhPh4hZDdcYJ3ucz_FrQfbYNn8Y-qPuV-YjhRksxYmWzuodNQtElcLQe-gOggnW9v-mU3MVaZ52XaUDw2CSg_z4MhdRobXE17m4I4Mf0tQlyANaiKBd47S9oBbJHt8mQt4cAzzLyiw7QSpsKDqny9MdPMgbo9g3_SVB6y4ROZE6xxjRm8LkbplpOOfrco0reH6wmfv96aGIu_tLhCWUcYRo3L59JhFZ03NUgUuAb6dw1xhOEEfWduq376J7mQZbe7M-l_lDslMUXDycwaXU1eLzmJ0tWPi7pCJj1A_T8J7mea-MmFhGQoFMmEc7A_3ioOkTSJltBsukqnPL67_k1SfRyj8rJHjR5h_gunW4DcMd9ffZwSPLUAS7SrCibRsWSGgFCBbTsTlcPFFX44MmlbSPPcXGFN7b50RdihMkaEjNpy8UzbR8gxYMN9NHmS7uzN5gZmiP2PU93I1AmUyY64WcAKdWxmncDjUvQZl4RLjfodVK4PcIx1Q5VHyqt2k2M3EptYj_xGKh-a4-SjzhL9D5OqHf9BVbd4gHOfj0XhD3TaC6KLf4Cll1vbsdV5Z3lDpaDyuKdSFeA4FYOk4eRBo8MT34CiRt_Dr1uoB7cW4rXgScrnRRRw7MXIRodCj8N2dLsQrnrN-J0EskRjRxlnFeyXkcqAfmNt5D8bkxfi8f4LjfPD-HngYQWrdqiQSdO0BgSCa7bxkWiPcTKL4qJ8h1F12sRg8rRmIZInLpWnwtIv-xphpWV0af3Lb71oU_Hatbts0rbSoZRVkldX_nRDI209AxtbNBzAH6hFWZDysI-PQM50PSK560SUmY8cdkyPP556cwPVTmSpDV7HIngPZBonzO0zfDJ3ZXHSBxAp3kb9uwcYvQug88VQYD2EUOA46PalPuwWkmyMC5tMGm-KUJbt30eoviVWf7vCL0QcBLKq0eVhkTM1YO7H6U140V_GBsD_iPK5wHs5Vqbhli7J4GrwKe6c43whOCZV3epIwqLdOTDI0CgtpO9mJZL0aqntPTWt5pnMi2mxBUjip-wu9Xnv8kcoS3XaI-FECF8NdwjDECpTFhONwX3uGuvTiErsOxR-3bzgn1dyhG8ImiVbEtnQj5J26pXPB2ZgGLl6u3U33Oco8W3RVHLjBUnJyQJBWjjqXkBTqyaFgXQSVX6tV1P7IwmDW--XRrQQ6xS2JtnlkhNCh1Q39356eAKATWz3PgVwvDNq2zmpLTlhRdzUvHFm-0shjxgFx-JsfSXdo-K2lNGWgJdwlmcqsOlNC9lFNuonARwD5bpZ3OUYsb87hc6aYsmZpgc4Hf1wt7gYXaGbV9AkQIBTRiDFGnbotaLSGljdHGrIXmt22UemkO3KrHoEjgdiOHSr80PMtYkq2WJguxZg9cx9gB647MYZyzYqPmAJuNSzsGeQmU6ESUD6-5GJL1OjzTNUgRg0G1OG756lGPmU0PJJWqqiWb9QbEdPsnQ9o5AV2a2gIgF7OpQ9GtaRhlDmGPEqXtC1C755oTw21yPlLzg7OvRdonbLnU_TM9ErViLLZ4-GZF_SpME04BSxYDKD9-TbF4EwpVuNTTfuT6xCuV_j-KyLJFdILaW2WHfu0KlaiYwEhTJlexhrqdgf9IV8DB00xQrRu-sH2dAYOFpaSE6Sz_Ow24iQo7PI7VDOORgr-zNHG3EAfF3_1RbPmPA8D1io8plZAdNIa8LQ5geFT5GY2NctCZJpecjpW8MZoxPR3ANcIqqC10BBerJ3Er8svrONRHtiIJOlaC5GGFelaZM1_Mgm_Fy9xCmTKZJRzpRP9PvfrLdO8-J_R_VR8WHH5te9kVhXt6JQLMkdYRjzHPLa_8pIyZ6FN48V1VUDrgQhvNoXQNvLLBq8ECa-SVBSk7Xj8xwkUtAoZS4Dy3cbZOYdKVAWyRT_O6DUcWKbcRzDMrxb1F2_4LFwRIUs54ufehR2xcmQxWATxbEtNP8r1ZK9-oR4m2kAOGILwyaV_5WdPbWcXRk6i2HiclMx3HWdQl8-9cNs_BX3UMAvAztpjvGtxgJ2MKhK8Y8VYpGmLznHzK-vmUnkZru8iqL-VH2jahoi8kL-SeQmQkB_NI0CCBd6nCBZ_rtU_GyeGVBB7jT45NpchP0ctmreD9Fm1RefH_qwZuQU7H1yDJ-czvPwZz9f140f9X6Ik2nXXi4g8-wKzuhZYSlWe5D243LKmjNImLk7by_XVJIYbbsv_U2CT2l80RzIoL_GrIom79tlw5oNxbbPXIFi9h-PXwyQGbtU7XV9dXhEwJ7HKqBNOuZo2boZB1oRPnzwHskdlJp_2ZuZybvVQ569MAFHU--RQQHmsTM5QEflYiZboI_SICyS7OX5D8MgMVmHgoPYG-dAKuxGKhVSm3_uto2mlokH9GAr2BWFnLwX7hFGflC_2K6bC0tWDVhsmqzlWlNLl0WO0J-ibr_eUkhfJO6BT-db9UcLxJvJVMElGuME2ljoFRr_4i6zOIv1jqlxIM04ZTCrlyMhxPA&cid=CAASEuRooDZeo9_gGmVdzSSugU4DsA&rfl=1%2Chttps%253A%252F%252Fzvonil.octo.net%252F%240

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4faaadc71b1ad53c4d795c598a521c2e866bbefc1bd8a09f3b40dac2e0084596

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31225
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame C231 42 B
63 B 42ms
41ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CL-IFE6VWLaM1koz7OSFEqL3Rbvi4eo7K9WCOo0S8CKM3ci3hdwKlpCJ1vMVHUlng81FQZ41kkUos30LvoryHQTvGY2_sY81ltJfy3o2i6FU4SXsw

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/ Frame C231 2 KB
1 KB 40ms
15ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/window_focus_fy2019.js

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a00a06d39ece4f2816e75b2e577c3b05a51ba196e19bd103d1124567f0c54f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 17
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1210
x-xss-protection: 0
server: cafe
etag: 9753579932288205849
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 18:56:17 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C231 120 KB
37 KB 75ms
50ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e78bac7c2d4ad157ca2d43d12d1cdc08ab7943d3535287108ed9e6b8ff9da523

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37632
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641385868096614"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 10 Jan 2022 18:56:34 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/ Frame C231 15 KB
6 KB 33ms
8ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e979dfe4d55dc019e062fbce71ec0821c8abeabd94f7490deedf56ee2712d2ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:51:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 330
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6485
x-xss-protection: 0
server: cafe
etag: 13366392639478751132
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 18:51:04 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 4DBB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6ISyzyCSfMd4qN9v58A78&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6ISyzyCSfMd4qN9v58A78&google_cver=1&C=1

43 B
1014 B

61ms
61ms

Image
image/gif

104.102.29.65
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6ISyzyCSfMd4qN9v58A78&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQlL6EARi8q9a9ATAB&v=APEucNVBbJ7gjJtMXtcuZQ1x2kaYrJcRJwW8_b3kZqaWAaJUfFcaDoB8U9bszkjknELV-FxgJvCTFST4vhgTgd4zIBhdC7k4qvItMGmr08FHJhhpY0gwhE3wxBtCf60e0oNkt-gAZpN4oJ_CIcC3FggDIQXtozG8x1_CwcY6GO9Dc6WWrGbC4f8
Protocol: HTTP/1.1
Server: 104.102.29.65 Milan, Italy, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a104-102-29-65.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 18:56:34 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 10 Jan 2022 18:56:34 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 18:56:34 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6ISyzyCSfMd4qN9v58A78&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Mon, 10 Jan 2022 18:56:34 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 4DBB
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YdyBYt.dtTEda2bYup8x2AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6ISyzyCSfMd4qN9v58A78&google_cver=1&google_hm=2

43 B
894 B

39ms
39ms

Image
image/gif

104.102.29.65
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6ISyzyCSfMd4qN9v58A78&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQlL6EARi8q9a9ATAB&v=APEucNVBbJ7gjJtMXtcuZQ1x2kaYrJcRJwW8_b3kZqaWAaJUfFcaDoB8U9bszkjknELV-FxgJvCTFST4vhgTgd4zIBhdC7k4qvItMGmr08FHJhhpY0gwhE3wxBtCf60e0oNkt-gAZpN4oJ_CIcC3FggDIQXtozG8x1_CwcY6GO9Dc6WWrGbC4f8
Protocol: HTTP/1.1
Server: 104.102.29.65 Milan, Italy, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a104-102-29-65.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 18:56:34 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 10 Jan 2022 18:56:34 GMT

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6ISyzyCSfMd4qN9v58A78&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 4DBB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEMtoKLdYGD51tM8hIQRnBA8&google_cver=1

43 B
1002 B

60ms
48ms

Image
image/gif

37.252.173.38
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEMtoKLdYGD51tM8hIQRnBA8&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQlL6EARi8q9a9ATAB&v=APEucNVBbJ7gjJtMXtcuZQ1x2kaYrJcRJwW8_b3kZqaWAaJUfFcaDoB8U9bszkjknELV-FxgJvCTFST4vhgTgd4zIBhdC7k4qvItMGmr08FHJhhpY0gwhE3wxBtCf60e0oNkt-gAZpN4oJ_CIcC3FggDIQXtozG8x1_CwcY6GO9Dc6WWrGbC4f8

Protocol

HTTP/1.1

Server

37.252.173.38 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 18:56:34 GMT
X-Proxy-Origin: 193.27.14.43; 193.27.14.43; 537.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 482985fc-e4d0-4a8d-b056-89e80eea1d30
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEMtoKLdYGD51tM8hIQRnBA8&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4DBB
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=OTA0MDg1MTQ0MTQ1ODM0NDM0MA%3D%3D

170 B
188 B

64ms
49ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=OTA0MDg1MTQ0MTQ1ODM0NDM0MA%3D%3D

Requested by

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

537.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 18:56:34 GMT
X-Proxy-Origin: 193.27.14.43; 193.27.14.43; 537.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 4baca9bf-0c91-4ca1-b17a-c0ff6507fc07
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=OTA0MDg1MTQ0MTQ1ODM0NDM0MA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame D28D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6ISyzyCSfMd4qN9v58A78&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6ISyzyCSfMd4qN9v58A78&google_cver=1&C=1

43 B
1014 B

62ms
62ms

Image
image/gif

104.102.29.65
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6ISyzyCSfMd4qN9v58A78&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJHlswIQ8KXioQIY7OOSmgEwAQ&v=APEucNX46gaTmB1N_j5V8obb1pkT0GToIEmKbg4weKxtB5MhCKswdE7gQA63BuSbLVvlSetXfHPWXXtLYmw3SePIWthl1SwmxdhEH-UFQdWSal76w9RX7PeujW8XNxIX9jU_Drs6aZFkZssXQcsKtfaPwQKMgWujeRhFCEff-OMgF6_Gz2K0GuU
Protocol: HTTP/1.1
Server: 104.102.29.65 Milan, Italy, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a104-102-29-65.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 18:56:34 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 10 Jan 2022 18:56:34 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 18:56:34 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6ISyzyCSfMd4qN9v58A78&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Mon, 10 Jan 2022 18:56:34 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame D28D
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YdyBYt.dtTEda2bYup8x2AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6ISyzyCSfMd4qN9v58A78&google_cver=1&google_hm=2

43 B
894 B

40ms
39ms

Image
image/gif

104.102.29.65
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6ISyzyCSfMd4qN9v58A78&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJHlswIQ8KXioQIY7OOSmgEwAQ&v=APEucNX46gaTmB1N_j5V8obb1pkT0GToIEmKbg4weKxtB5MhCKswdE7gQA63BuSbLVvlSetXfHPWXXtLYmw3SePIWthl1SwmxdhEH-UFQdWSal76w9RX7PeujW8XNxIX9jU_Drs6aZFkZssXQcsKtfaPwQKMgWujeRhFCEff-OMgF6_Gz2K0GuU
Protocol: HTTP/1.1
Server: 104.102.29.65 Milan, Italy, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a104-102-29-65.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 18:56:34 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 10 Jan 2022 18:56:34 GMT

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6ISyzyCSfMd4qN9v58A78&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame D28D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEMtoKLdYGD51tM8hIQRnBA8&google_cver=1

43 B
1002 B

13ms
13ms

Image
image/gif

37.252.173.38
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEMtoKLdYGD51tM8hIQRnBA8&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJHlswIQ8KXioQIY7OOSmgEwAQ&v=APEucNX46gaTmB1N_j5V8obb1pkT0GToIEmKbg4weKxtB5MhCKswdE7gQA63BuSbLVvlSetXfHPWXXtLYmw3SePIWthl1SwmxdhEH-UFQdWSal76w9RX7PeujW8XNxIX9jU_Drs6aZFkZssXQcsKtfaPwQKMgWujeRhFCEff-OMgF6_Gz2K0GuU

Protocol

HTTP/1.1

Server

37.252.173.38 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 18:56:34 GMT
X-Proxy-Origin: 193.27.14.43; 193.27.14.43; 537.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 2bb97aa6-649b-47c6-953e-ed78d7bbad02
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEMtoKLdYGD51tM8hIQRnBA8&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D28D
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=OTA0MDg1MTQ0MTQ1ODM0NDM0MA%3D%3D

170 B
188 B

58ms
52ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=OTA0MDg1MTQ0MTQ1ODM0NDM0MA%3D%3D

Requested by

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

537.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 18:56:34 GMT
X-Proxy-Origin: 193.27.14.43; 193.27.14.43; 537.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 32ee5caf-52ee-4920-be23-b99ebb1857db
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=OTA0MDg1MTQ0MTQ1ODM0NDM0MA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 0A09
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6ISyzyCSfMd4qN9v58A78&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6ISyzyCSfMd4qN9v58A78&google_cver=1&C=1

43 B
1014 B

63ms
63ms

Image
image/gif

104.102.29.65
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6ISyzyCSfMd4qN9v58A78&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARjovNe9ATAB&v=APEucNVRmLSlxyq1WrBRkQJWAFH41NCTeiYhjg9ZYuwfnlN2PD4Eh4ZGdZTGbYgZJZhaM6cw72izCeDcMRV3HS6t2uReAi3G6jpa-C4T8XyFPs5RAVuToIGazFL2qOJO-M2yOFgeZNgQei42v-a2m0TrZeVfcoV9rHU2SZ63GbPqLaDm8p4yjf8
Protocol: HTTP/1.1
Server: 104.102.29.65 Milan, Italy, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a104-102-29-65.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 18:56:34 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 10 Jan 2022 18:56:34 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 18:56:34 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6ISyzyCSfMd4qN9v58A78&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Mon, 10 Jan 2022 18:56:34 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 0A09
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YdyBYt.dtTEda2bYup8x2AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6ISyzyCSfMd4qN9v58A78&google_cver=1&google_hm=2

43 B
894 B

39ms
39ms

Image
image/gif

104.102.29.65
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6ISyzyCSfMd4qN9v58A78&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARjovNe9ATAB&v=APEucNVRmLSlxyq1WrBRkQJWAFH41NCTeiYhjg9ZYuwfnlN2PD4Eh4ZGdZTGbYgZJZhaM6cw72izCeDcMRV3HS6t2uReAi3G6jpa-C4T8XyFPs5RAVuToIGazFL2qOJO-M2yOFgeZNgQei42v-a2m0TrZeVfcoV9rHU2SZ63GbPqLaDm8p4yjf8
Protocol: HTTP/1.1
Server: 104.102.29.65 Milan, Italy, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a104-102-29-65.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 18:56:34 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 10 Jan 2022 18:56:34 GMT

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6ISyzyCSfMd4qN9v58A78&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 0A09
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEMtoKLdYGD51tM8hIQRnBA8&google_cver=1

43 B
1002 B

12ms
12ms

Image
image/gif

37.252.173.38
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEMtoKLdYGD51tM8hIQRnBA8&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARjovNe9ATAB&v=APEucNVRmLSlxyq1WrBRkQJWAFH41NCTeiYhjg9ZYuwfnlN2PD4Eh4ZGdZTGbYgZJZhaM6cw72izCeDcMRV3HS6t2uReAi3G6jpa-C4T8XyFPs5RAVuToIGazFL2qOJO-M2yOFgeZNgQei42v-a2m0TrZeVfcoV9rHU2SZ63GbPqLaDm8p4yjf8

Protocol

HTTP/1.1

Server

37.252.173.38 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 18:56:34 GMT
X-Proxy-Origin: 193.27.14.43; 193.27.14.43; 537.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 8eba1c15-7d48-4b08-ae54-52cdd31ed375
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEMtoKLdYGD51tM8hIQRnBA8&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0A09
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=OTA0MDg1MTQ0MTQ1ODM0NDM0MA%3D%3D

170 B
188 B

50ms
49ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=OTA0MDg1MTQ0MTQ1ODM0NDM0MA%3D%3D

Requested by

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 18:56:34 GMT
X-Proxy-Origin: 193.27.14.43; 193.27.14.43; 537.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 0adc37ed-64b1-4a48-accb-3449f83aaf21
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=OTA0MDg1MTQ0MTQ1ODM0NDM0MA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 1DDC 106 KB
38 KB 42ms
7ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
Origin: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 09 Jan 2022 20:53:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 79404
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 10 Jan 2022 20:53:10 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220106/r20110914/elements/html/ Frame 1DDC 8 KB
3 KB 11ms
7ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220106/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AGvMLPo6tPnpXkEU0Q1GyVs6FsF6BjZj10OubSfWev8XWY3xH1_Xy2I1I2Sl4qaoKymJWgUZ_VS5TJ5tNi0Q7HkKxZequHDBlNd9P3z_Rsm-iEu3C3FAyr20GRPRGTnvjpxBfz-4X5XwMXirYDrEgUq2CluA&dbm_d=AKAmf-BVv9lkZMAssZOKDIZhZ-uQgA4H1VmlKXXU4ztnZQaBS9LAAsKVQZr4fSFiMcj3XEtENrf7TVmEcji0lPMhHMQrIZg8bVpXHIYzj3KYz5g6EdLXZwRtlIKeaqeGjm4qw4da_KPLfkKqUvGrpZAwyOm83RMunCOI8Q91Y8m4LdbMe-kDijH-0hv-irhHLwakk9-udNowlCFK8D9UsUMYbfZXnW4snNl9fjUxZc-CqrHqyj6qjkslE4ooobYMaiL_fvxuG9WTY2-CcgstLBqNz-SohU7Jl2uD27JM7qMQsnunfiETa-m2S8iOWEm_qZXyEdyYZixosbFkNDU6vOVQLCYzkgDYkLsu9DdjNBkxBUy708CYTVxsIPo53b-OpcaUCQE5cmCuEaAl5rKuNt3Dx0S4mPbQ4pKvOJRclarGefwFxmhdC8R1kq5K1gaOcsPMxQjPPDCGfOTvN6KRuLsVacl3OETp0kfknzohMgkF7KXexU9fTm-zroZUUpTnnZjTXwxgFPxK3kNvBk8-3EGH9Y7iM3r3MQaIVG7p1T3a2lsckE45yBM8MiefT0e-5V3vlXYef6-KIRtuV_yRfeGYUeQ_5gzX2c7sEU_Ei0UkiDjNRx8RBbznxEdVr3bJcWcQfKRPG9r5f8BU8dQLBv8-4FNMpjgKogGyQ0a5OzIJqWw5Mdi-yYSfQVDkK5Qd98B4f1AbEb551HHT4UCAaqHQlDoe5kerqqopglRztK5PsEwVr9BaKScesBZihBlkISQZyFtg61f7Af0M3zD2lhrVHoxhgYhmClT1Fw8_xYaXUuFRWFG5Q-c4P6DGoHw4VOkC7BVzkeFKfWb0yYmq9S-ZdQFEB06ugRZ9bxd3-g6vV06nE7luzr7Z3M2gO3wAoSEmshbN2Smd_iTCVDBLC-E-LoFzatKe9s_E3LKBJytLr0F4-qkxOzIfStkc8kNOWdCoJBTOrjNaBsLlNy7MIzPVLq1N8p-wVGZzG9K24DZQtSNd3psHNSP-Gvvi1ht-FecDDBo1d1a_bgwkYVMzpYuCnz9TunI6j2z2WbeMjLBvEBkT26xlaDdQ2JnTX4jf5MNixY0jgcOX6fo60TcfT_GjbxsfkKo7oW7nduFVg7sIgIfWZGciw370bJw8L08M7Rp_KQ8spG9yrA5Vu-gJFUny9IIw7pz1-sYhpNeyPAo5W39KI7HSxdg6d20G0z-rIeVvBr0b7Ts-Uv9ntkcjga17gs59gzGUqvoJ0AN1XFr9fwNjPvzBbDHBLLvx0G7BKfXZ2iaQFmN7DAqH9pUe3vmVgaVZ2JkXYZL437-Ep_rhRnYNORSBWjQgvy-_3YvwVd96-YAQhOxkPyjcUPXphaIdfIQ8q23R6DgjenmqaMz_mHqqWNaKR3jscOkOmfOjWirEnsnZc2l07kslZv926vMV67k1JwMsWr-pZoOAvF4uVT-2_EX4zfpNrGN_Jbt7W_Ka2lD8-gM17w7spSnK1b7tF-W1HXkCBaTnncN2DpZarJxgrmlxNkCZgNw7bB-WrDGvfCmW8a6z7PC8BPhm4deIhuZD7az7IgRA00Nv7qG2x4BCr3UhIe4XCnXOe9RWsQacVF2KM_zT6KrySLh-lQIHmT2DG3bo0ZLREnTCqWeR7K51YQ6B1bPR9Cqotj7LfsRN2Td7IBIT-d_RIfjG86y1QSSh9-unl4Oj9BHOEzzjUGzKdWOdSgDzwyOuLkrKFLHVJfNK46hZi78T4j2USZzw_rJmUYg3Ugd2L-YxffjaQ9JryHrQzCEdp5qky7f8vT8jhbEVZeSYvqRaUCh1Mx5bmlG9kiRJYBGxO9T0Cm3g4i-suhywu0BE3JLVKbWMwNcE9NVUcQUWvGWfYPQ3sVTOchSy80uLRKUsd-i-7txk-vXYcZPkQlSAiVJWzmSWaIJaw1IZkY4T8St6GozvLBgLifFkxLe7AdpP9UyRTnqn0suALsE0M3uFwPZfDeEP6_SwikwNmkPf1li7K84B3kFLoxXh4dOiC7uzOE67aCSfRzNCof8oMK8dmvK9MyqljDxuJNLdpfVPLCz0ELTf1DgQsWvfCnadQ09h5VZYDvRXDz5Zgv20C69H3ObRfAxBwS2oPwFLa3AvDQ0AVp1FoQ1juxP7whBcB7D3EhMIEMu473sLZ470mIV5O3NAOZxL73omz-6FkNJXiTAsmxfnUtsXMIS0S6s_3QAizol0Sk38ywMCaiLeCLSZK6arOQT33NXu8n4L_ewebq4p2ZWy4QbK9XkP74pAdQpniLtXmG5eDC8X5GkjL0CXndJzoPl4dkgonCTGRCLFRoxWTjJVEDhGvd8201AL1UH6FViV1uD0-WcVXIhfU3fIv0eYMua-tTARrCHKZaLER5sVQPjuCNkvQOtrOBVynUUqhRYDuRKFp_BK67JyZOZqGtgAbf5_JTmPDKAx8NiDojRejpwhABSVt_KdZQg2PKznd4V1wcZ1OQF6K8MvOldPKy8R0L1pI8JwMB9KCRrus4kaaAZn1GulhLH9Z8ilALa9QRcziGNhYhbOHayVfQ-tP_Gy1Mf2PSFflAl8RsVFOGe2ScWrAysucrIHTkspAwdxLsTdLr_eihCP9RYKhJWOwtNPH0t6gkgetRTR0yPWxAN0cj0d-UoN5H5aVnlQCbpr9M6t6dfGgYXDQhYOQcO3v4LKhIdWdcTCx7atY1Un9TeUts18GyQYnNJekwYMETaEDZqlOo28PBTUPOG_rVf2_X9Smo_4_U6o4dX9gC7vgHyvbimQ5P6zgxRBz_0Wt0YlKYcXCFVnk7yI1UK64PXQfF24aJXGVIe0k7Pbn2ct9oq2HOi4rQ1mVTgqjFJEVFVRsno_4lI4WDTUlycYTvbAGyM1ueYAezXKuW45qf_dhFXcKilDOYvV2YgcwGFWzJ5HJ914LN8VWGiK3Gv43XYYTJZQaKKSenpkeux0lLFD5yV8PoAXPpKFuol6X6nPqy6Pft02Q9ODks4xNUjFPfSEj8ltBLKmI-9jp67I00xorA_E-jK0cyAxfvYwfbDlfrM3xOwAwiV3awmr0H35Tnlt0vRU4pzq8-kE8QZL3NE4tuDiG6z_cCQMEygz_k8F2CtH25NvR9iFrowZGglbpH8C9MO7uQ1hqz3F0DOBAUi8nBZ0uJLFVNPLNo4hQGUggHSEX8F7czQmCk5YLV7EjX7-7KFZ4zIuRioWkmrbk-7Lc5IXAEAQbmbuQKrmF1CJBw&cid=CAASEuRowSLuBKxTbVvakrBuJnmlpw&rfl=1%2Chttps%253A%252F%252Fzvonil.octo.net%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 18:56:30 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220106/r20110914/ Frame 1DDC 24 KB
9 KB 10ms
7ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220106/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b7c55617f84818daf4c70cc10ada26ddd5b582b1d1c2c2829b3220487a6db477

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:55:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 37
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9544
x-xss-protection: 0
server: cafe
etag: 6261108306223674270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 18:55:57 GMT

GET
H2 200 html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame C231 169 KB
59 KB 39ms
16ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
Origin: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:05:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3053
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60173
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 11 Jan 2022 18:05:41 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220106/r20110914/elements/html/ Frame C231 8 KB
3 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220106/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BF3NmH1Lu7drwGyMrH0CDWYiP9oO0zzPT2iYCcKFPHtY5c0u5yVvtUYaXljniZXBUEtjgKuxZoMlxXiRUebA1YL-3lfN1qzPgSfSAJ-IW8m57fYzc8A7dbQIlpYoSb-I0ol40JeVXN2se3DwKjhVqdexR_5A&dbm_d=AKAmf-CqQdHn7D-83MIZXuFarPKXoa0oHRtITomYD21ZTKqohRWoHAV9tw6HhTpCMRlf_PlWlWR8hnkCPoiAN6hiFt8EoA9bRQp4BmUUdNUSGBgvcK5VvI-ZO0dJK9KCdSWsBSJr0NWLLdYN47jFl1PjcRg3SN1Divy4Trf0yLa_xexDPDyBXNzHIs15HjKpHGUCP_zZ_o30QvPB7Wcera82Nehai2O0Y29bAFwGbWYz3ZXInSsPa9__xRZYbq_VOPs7slv6Wtb6vhBP_I6WQzj0dsszct838mi-BdDWW67QUIkW7ZzzB-uMWBUNJZpEtCCZ4Km2rc-ut4BDCQTZPPAEHPxehVoOpGTDy9mSZIFu3CnOudtBWCFlsxfRltvmPFZdZkbzkbJBNr1ngqJ5vEmujClDcStIAxdWrfH8pkf6aI8ZuL3yM2RQkIibvlN-1crx-BHqJcVyOy3qdWCChnvlKXS_y6MsKY7uVc074njGGzRYPDhidA5eM4hZeYs3AhPh4hZDdcYJ3ucz_FrQfbYNn8Y-qPuV-YjhRksxYmWzuodNQtElcLQe-gOggnW9v-mU3MVaZ52XaUDw2CSg_z4MhdRobXE17m4I4Mf0tQlyANaiKBd47S9oBbJHt8mQt4cAzzLyiw7QSpsKDqny9MdPMgbo9g3_SVB6y4ROZE6xxjRm8LkbplpOOfrco0reH6wmfv96aGIu_tLhCWUcYRo3L59JhFZ03NUgUuAb6dw1xhOEEfWduq376J7mQZbe7M-l_lDslMUXDycwaXU1eLzmJ0tWPi7pCJj1A_T8J7mea-MmFhGQoFMmEc7A_3ioOkTSJltBsukqnPL67_k1SfRyj8rJHjR5h_gunW4DcMd9ffZwSPLUAS7SrCibRsWSGgFCBbTsTlcPFFX44MmlbSPPcXGFN7b50RdihMkaEjNpy8UzbR8gxYMN9NHmS7uzN5gZmiP2PU93I1AmUyY64WcAKdWxmncDjUvQZl4RLjfodVK4PcIx1Q5VHyqt2k2M3EptYj_xGKh-a4-SjzhL9D5OqHf9BVbd4gHOfj0XhD3TaC6KLf4Cll1vbsdV5Z3lDpaDyuKdSFeA4FYOk4eRBo8MT34CiRt_Dr1uoB7cW4rXgScrnRRRw7MXIRodCj8N2dLsQrnrN-J0EskRjRxlnFeyXkcqAfmNt5D8bkxfi8f4LjfPD-HngYQWrdqiQSdO0BgSCa7bxkWiPcTKL4qJ8h1F12sRg8rRmIZInLpWnwtIv-xphpWV0af3Lb71oU_Hatbts0rbSoZRVkldX_nRDI209AxtbNBzAH6hFWZDysI-PQM50PSK560SUmY8cdkyPP556cwPVTmSpDV7HIngPZBonzO0zfDJ3ZXHSBxAp3kb9uwcYvQug88VQYD2EUOA46PalPuwWkmyMC5tMGm-KUJbt30eoviVWf7vCL0QcBLKq0eVhkTM1YO7H6U140V_GBsD_iPK5wHs5Vqbhli7J4GrwKe6c43whOCZV3epIwqLdOTDI0CgtpO9mJZL0aqntPTWt5pnMi2mxBUjip-wu9Xnv8kcoS3XaI-FECF8NdwjDECpTFhONwX3uGuvTiErsOxR-3bzgn1dyhG8ImiVbEtnQj5J26pXPB2ZgGLl6u3U33Oco8W3RVHLjBUnJyQJBWjjqXkBTqyaFgXQSVX6tV1P7IwmDW--XRrQQ6xS2JtnlkhNCh1Q39356eAKATWz3PgVwvDNq2zmpLTlhRdzUvHFm-0shjxgFx-JsfSXdo-K2lNGWgJdwlmcqsOlNC9lFNuonARwD5bpZ3OUYsb87hc6aYsmZpgc4Hf1wt7gYXaGbV9AkQIBTRiDFGnbotaLSGljdHGrIXmt22UemkO3KrHoEjgdiOHSr80PMtYkq2WJguxZg9cx9gB647MYZyzYqPmAJuNSzsGeQmU6ESUD6-5GJL1OjzTNUgRg0G1OG756lGPmU0PJJWqqiWb9QbEdPsnQ9o5AV2a2gIgF7OpQ9GtaRhlDmGPEqXtC1C755oTw21yPlLzg7OvRdonbLnU_TM9ErViLLZ4-GZF_SpME04BSxYDKD9-TbF4EwpVuNTTfuT6xCuV_j-KyLJFdILaW2WHfu0KlaiYwEhTJlexhrqdgf9IV8DB00xQrRu-sH2dAYOFpaSE6Sz_Ow24iQo7PI7VDOORgr-zNHG3EAfF3_1RbPmPA8D1io8plZAdNIa8LQ5geFT5GY2NctCZJpecjpW8MZoxPR3ANcIqqC10BBerJ3Er8svrONRHtiIJOlaC5GGFelaZM1_Mgm_Fy9xCmTKZJRzpRP9PvfrLdO8-J_R_VR8WHH5te9kVhXt6JQLMkdYRjzHPLa_8pIyZ6FN48V1VUDrgQhvNoXQNvLLBq8ECa-SVBSk7Xj8xwkUtAoZS4Dy3cbZOYdKVAWyRT_O6DUcWKbcRzDMrxb1F2_4LFwRIUs54ufehR2xcmQxWATxbEtNP8r1ZK9-oR4m2kAOGILwyaV_5WdPbWcXRk6i2HiclMx3HWdQl8-9cNs_BX3UMAvAztpjvGtxgJ2MKhK8Y8VYpGmLznHzK-vmUnkZru8iqL-VH2jahoi8kL-SeQmQkB_NI0CCBd6nCBZ_rtU_GyeGVBB7jT45NpchP0ctmreD9Fm1RefH_qwZuQU7H1yDJ-czvPwZz9f140f9X6Ik2nXXi4g8-wKzuhZYSlWe5D243LKmjNImLk7by_XVJIYbbsv_U2CT2l80RzIoL_GrIom79tlw5oNxbbPXIFi9h-PXwyQGbtU7XV9dXhEwJ7HKqBNOuZo2boZB1oRPnzwHskdlJp_2ZuZybvVQ569MAFHU--RQQHmsTM5QEflYiZboI_SICyS7OX5D8MgMVmHgoPYG-dAKuxGKhVSm3_uto2mlokH9GAr2BWFnLwX7hFGflC_2K6bC0tWDVhsmqzlWlNLl0WO0J-ibr_eUkhfJO6BT-db9UcLxJvJVMElGuME2ljoFRr_4i6zOIv1jqlxIM04ZTCrlyMhxPA&cid=CAASEuRooDZeo9_gGmVdzSSugU4DsA&rfl=1%2Chttps%253A%252F%252Fzvonil.octo.net%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 18:56:30 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220106/r20110914/ Frame C231 24 KB
9 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220106/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b7c55617f84818daf4c70cc10ada26ddd5b582b1d1c2c2829b3220487a6db477

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:55:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 37
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9544
x-xss-protection: 0
server: cafe
etag: 6261108306223674270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 18:55:57 GMT

GET
H2 200 html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 44FB 169 KB
59 KB 34ms
21ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
Origin: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:05:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3053
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60173
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 11 Jan 2022 18:05:41 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220106/r20110914/elements/html/ Frame 44FB 8 KB
3 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220106/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D_vt2dqOvoN6lrq_I-phRRiq5zMyXikhCjkCrxJDKliRiWZo4CgErvbk4Y9pXJyt7bLCFLaqIXKN-XHQIvhZsFLLr57XPtiK8DJScRkjX_ARscECyPrybfIqzLsqmZo83-i-c6e6fSeCkteT7hzD9SGFd6Dw&dbm_d=AKAmf-AAaNvnYxH_u8XldKdaMteafbx3chJn2zaYsk_mZTgnnfYAmzeQX_FOxAbJioqfXWB1NzODVStCxxEUd3ie9zIOoM1_SoFC5xKhlH2gFj8NwkKiG2MXxH3f7c4so3qtnwxCrB1kd4IE-BN9Ei-nvqdfomgUmoelcgRdxNZRmOMldI5HyaA3aBzZSbeJ7i8P-9Z6EElFM5WtIaY_QH_SAkK8Xqk0UjJNziDzZTWelVtsJ5tGluyb50PBWF3Yk-v1TO_q9Jlp9fpT98njl0iGHwoX3MKi8G_y8xun6oi1xa1wm0hTQ_qKS0vmI38diiWFqtxjT2Tg8cy2ErgRPoo1XPsp6E3RQdd3_wg8qGHHYsbjq1xSLBrgmGiV6uO-hAimLgfm0WbZ_YJztDoizKwrTzFNlaKdIysuaxUJOIBPJofME46N-Yg0wLk29QHlLNYWtubCoHeWRl42TLVegRlRcYYW1DQF1iwu6d138bAoB1eqo1QY7Q3c2JUcO0UDTOQdL517qhB4Hgl626OBjw2xFP_UhTy0R7zpUuygOstH-8bWmi_zxCoamliLCWplkr2eBdMYlfde2yfja_E6qb8tiVdabfE4aHjUa-BCu6dMdmI0dd2pEw_2wzGrw9Uxp9FkQ1WTVnS_xcD6g5SA6rIrF4WeQ0CxrY8KxzDRpcJI0CbFaf9IZb6pdKqvW0Px-UgF1H5zZd6BhXz8lJTFsMqWpb1Odnf6U93HQHpMx0zyU5uQTBchrCTIsn5Iov_kyt5Hn__C9jdYTgoHTVjWOWm1zOOdz4UsmgiCkyHIn6-gApm3FZ9HDVBbtlY4YsGg9pjKoRCNbr7jLQmlryl8pbnqRWRXYePwgj0fHSes5Rtz3wCCxX_s8C3BknTOcgSV2ExSWZhjoMj4g3ZtRjE4U4AGyHFDldXOmvO7S8hQLQDKcDay-lOkK3fb6ks5-omsRIY6deL3T88rKlhRyMRgoFdQAzvGWlWsxk3pMObQd4PoCNTlJf4ai-rrrnvWkxQoAIWoUgdc2pAuPZGfx_5_MR8Dvkgg_Zs5QBXCaKsjON0xXvT4vMNbPP-5duNDydR-Dul_PswqGEFum_B52yJ0doHG5XhRS5Nf4iKs9QiWpzcslxHVfXoOb9OKN0N2JVJMrIeQ90tfu8btZwWDpd3ZuWdHj1dpPgUPn4F_ExqJUAIY6k5zQQQMRvW-U1vUXNATUZa3PLoww_cuybgFJjPVhkEDYGM9vmefrM8b2rt6EsswjdBIiCm3iW0k6EzzsVz0YfbIs6YApt281nLmHMq_X5Xvy2poVt3HmbySpOzTiBUNhm-cmaORE5NJQhq24UU8b9N9zGsAh6ae93Uaq4tIp6HGwuIm9BdFj-jkZ4KszJxxEwxTF4fRbqBQE3MuBW7qmZa5xiG2Zv_BzqhrfCduZPNfMVXo6W31I2D0hEAQ7D3Rd0CvVSUhbD6WNeSWPsL8-_OJNLVflC7RSTS72tw9JNNRHIzgCtvmhTWs3GFt0_1p5uU4uAQg0jHIkaVWRQQo2MBvSW9HbE_597dkDH6UEr13sAXVKr68Zkc9AP1jvVsZ5KSRveN8aZcm1DX3EZkApEfCPJqFAzIZPyK7hPrEYYcE3hr4RMsJzy5io774oQuw6smrJ0Cdki--01lS-7BKMLWi5PY1lSp3EDNBVE0XARooIoa5s0jcNIN42uiT64lgk5t13D62LVD4NoP5HhuK2LdymmlmTppdUX-L66o6B7u0Znp6OHbQv9XOlz21RI0qg0IxIk-pUl3wefB7QDlw7KgMWRgH0hp-qr4Ssp4uqqkOqzYxcqOZ0_6F4WHBhbInwfUBFQ8DyYR54llUPKbV_LOfQqBqARbCYBHhVmDgfpNEFOMEoHRY_u9q3gbKUMcEOKOjSlwOGZTjrNhZiiZ56bpmpMy4BIkx5gFj_R2jfBdG96deIwrAOyLNeg_eMiT7Aiz1tCDA8CWyclXcw6PjAY9cjzvdIER7UgNvBkZeoEtwT3Jh2Gf8mvj6nj8ms_iGMi7dDj64vBVlTlh_Ih4PT3U_ph3P37hJ4UhfCOoEBG65-K6f2iWcMmgw48NYZg0Aq8ysadw5OkZV4jwVv77La5XD7V_MJzZY-1P7l5HKuDBQRLm84O1o41RnQHHoS3CUv7dzsZbHBwx-Goz4Hl2aF_wULksnyULfN9lx6agsdJbDCH1naH2QkTAgRQS3y4jzDzLYh9gltP8ro9VyIAGgLQvR8MtWiU7Ixk-t2ji8Vof6MCzUh399WRBQPC5u5fGJbcc0t_1q5asS1I4qU3WJWobdeldfo1_ckEO0uu-FDafQwmKXtm8zyVsZ3hEqgMaOEMzDqfrpM9nh47Ouf-NP-XVoGFis1Ie2ZEjNyiDSYbNBZ9KK-Tlb-SUlNKXELM76_wBceBQ4wzg2MaTnkXDvfyBVzRCqg7jjsPeFEaADuMLhnPYk2ucqjfnE-AjwWl2u22A5LaA-FIOVNGNk4RxPRjsAVm_Pz5DXWyV5yWcQZYokz4IQSpuSWL6aLKfL05N9nQEeWx2BW5I_62KHl1EvSCOwbGP5I3jaDdQsufWP9HzCmfmCbz1iilsJEi-U9_snaqZH1MZRbjZcib7s87PVxSK_FfpfWopGrZ7r_ETt1c9kI_o7xTaiPIiEA_yajkVOO7JjD7Hx0QfMDwuWLxO363gADxWCR92VbgbF1GtAl25Sl8G7ZhinpVa9_bGoc28083_56DRmpWWvHauXxy3im5CggEVEXzoT71Pt1QvTHyeIaK6kjPAgFy1x45I2ZlMkvctQvAemCN8FWnE0CEpOqFrUm_rS6C5n8UjYnkrFB7U6FXnIb9fj0L04_F69JtDzUOKjJpCtoSmSOeQblT1gllFhrtxAHeoIND6Xcb-ZMxEwLlR1_cfgJj4topfo0YldpnowVz5DL3uzN9uzcjhj5F8ZJpZZ4cJbStTiIAqMfeEsTrh8eJiD5mP0ZHtLh0yBhDLVnxH30GWiSUpIRltxhUefzD5n4kHObQoOqvpVTajbuGDCkit8uXAgU9RYua8p91NWSAcBdioQXRv1l1V9lbxojGt9KxQs9mws8SED7UrcaXkTdZLCpsIc4VPElxHus6C6tF8qDCsGSf50i-B_TozJ3FFRUcPAI2scH2YwjZvrSl7URqo05I--_1vwWlQLjEPHsL6mCRiFXOMX6Amo2sCcX78lHcnroQwQ8AiLxOL9RygHtMNU1dUu3BBWLQ2Zvc95wGtGuCawllAc_FQMR3dSuvIeG8E1tSXI3d2VYfCGusf7TE5SeQ&cid=CAASFeRoLPVrTp_I1jzFzLu0g3RpbP6New&rfl=1%2Chttps%253A%252F%252Fzvonil.octo.net%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 18:56:30 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220106/r20110914/ Frame 44FB 24 KB
9 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220106/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b7c55617f84818daf4c70cc10ada26ddd5b582b1d1c2c2829b3220487a6db477

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:55:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 37
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9544
x-xss-protection: 0
server: cafe
etag: 6261108306223674270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 18:55:57 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 1DDC 41 KB
15 KB 27ms
8ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 08 Jan 2022 18:05:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 175851
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 08 Jan 2023 18:05:43 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 2166 1 KB
749 B 7ms
7ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 10 Jan 2022 13:26:12 GMT
expires: Tue, 11 Jan 2022 13:26:12 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 19822
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 1DDC 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cc992175655dcbf47d8c1338af0f1136d9db50a192b4dc3a3647311200daf0ff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/ Frame 495C 11 KB
4 KB 24ms
9ms Document
text/html 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

58a4f64c59bc68563aff3456ec97240e724e5692fa8850885ec147290b0b05de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 3881
date: Tue, 04 Jan 2022 11:17:59 GMT
expires: Wed, 04 Jan 2023 11:17:59 GMT
last-modified: Tue, 09 Feb 2021 19:34:09 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
age: 545915
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 1DDC 0
571 B 72ms
48ms Ping
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssKx3nVLNQ27hfx4ZeG2IzZEXzrQLPT6ZQHAcXFMVBnNwN95CVrsMKGp2pPv2InTp8fyRt4bXx9cXTtYLXjvQ4ZdptJf-A3KIA3grAJgl_DYYRFBzULmqTk8k9o4OWJ7vILhomDlXWeHlwSxMJjvQYtZo-XBuqXxulniqOwKpiPs2YAW1EGoRw1EqJHztPN-6kz83GUP1DKjZi0V-nIY22hTdj7lZ16kbe2Dnt_xvRUoDBTQE3zpH4tpqUjYLpTiU4B5AneVTvti_w3MV1f1JCTDHtqJsOFv4_W7LkXahYFjVjBcl8WpmFqLe-AIQr704GL-zSSqJc5_Ccybv_9KtpgmC-PSlb66MdkBXFBMu6lSvtvB6-VnDskkxdB-6bTgYDFys_y5oQoCEofCBwwzKNTOER3Kni3EiBmKNgLPix6aYvO6jg6eUkG-ydb-vgk9L_3cLnL7rn2vyRknTjAUDFpGGSwhtuRhG8wxfNWEnoyTtceqr080mR4OCvYpRDaqBa6QWc5hmRL6rszPG1rNdkk9fAh7Wh7cr6YZKbfhDiTBsFHF-RClCsjcNMDWEXf_eQpf8lLrqq1RnYws_gGitFdf2YERgdWFDiPGVKS_lFhapgwgzwJ5OnE-O7Tt7629dokB4ThKs1Mw5piQvsv-QNHt13J1IpBZNE_r40SjYrCCj5yVP3cUSrKavDYe0qGOScUTQNhL79RHgioPgtgvk0P1s3r5aLi9xqKQ6nqyLD4HfmTGNizVDCplp7JCRZAEjpICgIcQX07_b5x25Ly0TakkA_Xl5O9IeJTWtclt9oa8EmhbcAl_hHGbFZ7QW48O8bEDAHE63ovNbKT4wJavHVlAQ5CiBtpd4wWQEV2K8_1DDS6WdMV7-l9IJlf_DzesFvIMiLg12OlVTvH3Ks7goP0cD0yFX8tC4IWQFgYbnecEzocaCNUBpwjJhTLQMfqaeIFJLIdrMkZ2XuvTYK6-taMxiiTrKvKMl3rQ7uWWFeJjXiwyTeX0ADdvBCz-XYsvRX0Eh38Tju7QoPlPqEn3XlNc9MfZoFH4fxlue4dXS4DGhxr-TVRj4huoWQCMbYSKsLrqGY_GTXqoMQ5v4vz1Evnv5JTIqcjoZQ7-dQQcE_FW6IFy_mVOzxT_SC6s2l6V8UqTDQZVTlJ9pxHdft6NKcIi07-aoLF-Jccb4ZGEF5zdDIjWwjInNF1XA&sai=AMfl-YQGJ1sunVRSsAoeZXa2lqdmlS0FQtOIZa3KIa4njacX5TeLUkrjbxGI7VhKYSJlBlvvHkWidYWY63QZvoK9szTnoOtZoKuGdEcoIv3PlBAHD3XHehAtHQST8eaYfc6rniOPuo1DUM9w8488OLu3UQqHY9bupQ&sig=Cg0ArKJSzG27EtRpOZb_EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=91&cbvp=1&cstd=89&cisv=r20220106.86142&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 10 Jan 2022 18:56:34 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 32A1 22 KB
8 KB 7ms
7ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/

Response headers

cross-origin-resource-policy: cross-origin
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Sat, 08 Jan 2022 18:05:45 GMT
expires: Sun, 08 Jan 2023 18:05:45 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 175849
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame C231 41 KB
15 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 08 Jan 2022 18:05:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 175851
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 08 Jan 2023 18:05:43 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 4E81 1 KB
749 B 8ms
8ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 10 Jan 2022 13:26:12 GMT
expires: Tue, 11 Jan 2022 13:26:12 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 19822
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame C231 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fea611435593980439ac2417db3ebf503b45852fa1a804bf220c28e3388660b8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 44FB 41 KB
15 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 08 Jan 2022 18:05:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 175851
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 08 Jan 2023 18:05:43 GMT

GET
DATA 200
OK truncated
/ Frame 44FB 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4faf56c7c721d47b49df08f6e6177a2b12ae4333c6f46bcfdc9d4c23d493c617

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 300x600.html Show response
s0.2mdn.net/sadbundle/16062795329522630656/ Frame 612B 42 KB
10 KB 15ms
15ms Document
text/html 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/16062795329522630656/300x600.html?e=69&leftOffset=0&topOffset=0&c=sSN0U8XuLz&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b35ea6f9f792b54bd99cd4b915d9c6410f9a92e2e65f22d6e9163e877c2b24f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/

Response headers

cross-origin-resource-policy: cross-origin
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
date: Mon, 10 Jan 2022 18:56:34 GMT
expires: Tue, 10 Jan 2023 18:56:34 GMT
cache-control: public, max-age=31536000
last-modified: Fri, 11 Jun 2021 18:32:48 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame C231 0
24 B 65ms
49ms Ping
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstfpw3h-XqQGPqhogvP8CpUVNIladR_lJIyKHPy-eIoG2HC_jelvYabb8ihsN2Mrf5QVu80wlFsWzDy63dTNdC5IWuSmbP6FXhAapaAjEb-xsRkDGDk31UQMPPIFGykc3vqzQtPuj_X-KBDrQYbwz6szIheN9YQ4mm3DosaKX1DebNLTR-4YUNBZLY72exFCRqzVgB6q4VIYbhy1woUQPIJsaJG_stQCZLD2FViN1YxUo1uyqNwjir2SMrptTbaIPNXxUqD5Yk0VWAEPWA4j3HR2F0chAsCGCWKAMimvvsTXzO2tpeIPPQIXtVcmhy2m_gx8GnwhWlA_k1VPfThB54l-MjemOHtZAz8LG2YWEED4_qwZIVqIGXMBxzi3m-vKi6-MfNUn_MXWB0u8UFsyIDUIzRpQQ5uiXFtOYTw2QECR7TdIzQlNYJO0QrQh_E1o9O_6aFRw2kLMMyUEGzXww2RKkZGd79j9oKOwOsiX4au_Z7CYRZy-2iXT9NH5WjsGzoJOpMDWIS1MAMSGQYM6arHnh80BfLD3lyaYN8XEvv6dJHzU0dVQK8UQIOF274Qn9jcMg9W2PqnQi6TKZ7qAaWc0p2SrHhY_CYV9hvJuKEuTXMfLCe10jupbnkDRK_Cy8iJxHsG2lpI8_kG-tZQLL-Z8-njwyx06Qf0QwOmap_0ynleuAoyTbdKbFDrywzp13J_4UO5Cs9uNyB1DTOpi1oMGUo0eArjMG5nQXGzOSoPwncghGnSvnproXvXnM9GgQMJplERXTvC64Hmz3iOOngn0zUFhBvZOVlZwQzXx1An0pH_g96j6CrQvsCICwYkISrugIeg9eLWR9IVA5vqt7UMH46gjnASzbsNtzBSBvdhyW_lTMvWorkqsQcci8taTQ3fNKvSf7HmdYvJzhOTQV_7VI-HvaSdw3ZdOMiXtUEvQUBQLjMtOW4IB-tKBWVpfueVVz0oQRGcTty5qLTgg45X71I-5pnYZ1E1FPNCrK2WYnhrprYkn0YcDL4UQUsd3yPnW0PfvFgANequXzXbyECTuaKvV4wg9IjEyrD6sMdbWzBvE4x4Q2yv5UcrnkBxlc6IgUxoLiiAyKm3CEcrwfQPAWmcxoXC6FblT702s5tZnHnj41orlt039gwvV2awJfuDcd9TNFuaZhnTqR91ad2wblijk05fF8N8NbV_TQ&sai=AMfl-YSpCzeHTzMuMqs0ptsNMMUiihE8fyeOLZ8zM9Ay-Mn4FtiTvp5YYva4F2HnmpZQFQs7-yILFeuHN_58gfEg7SZRMbE0ijd8ZfRVtMAiGc8uHIJ5odpwiwtjrhiy4ZmQIxTl6Td8d14mf_ptgQxLY4ahvuzNmA&sig=Cg0ArKJSzNAWHfO7O8S8EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=162&cbvp=1&cstd=157&cisv=r20220106.71303&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 10 Jan 2022 18:56:34 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 728x090.html Show response
s0.2mdn.net/sadbundle/9747004193402519552/ Frame A39C 44 KB
10 KB 15ms
15ms Document
text/html 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9747004193402519552/728x090.html?e=69&leftOffset=0&topOffset=0&c=fDhiPuxYL2&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4017f4a22f8fd8c745b332e8bda4f05e249fe853ecf5a1a56662f5cd1eff7988

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/

Response headers

cross-origin-resource-policy: cross-origin
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
date: Mon, 10 Jan 2022 18:56:34 GMT
expires: Tue, 10 Jan 2023 18:56:34 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 10 Jan 2022 08:57:36 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 44FB 0
24 B 64ms
54ms Ping
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsu1ucA7HUWMV8Kq0bxZC3FClVbAvL4u_RVj2w7tPsyRw2TZ8ucMt21Nmk6aGxBRabDjfZ1lAC6ijwmmqxAZFkOMxqT81us5EWvbOeRCsMewAH_inFHnccsIqTb5omycjsbCLpN3kTllXy3LD0l9CA41Yx8BSvhhqbSTZnUruZi_-rx5dDb0KMDL-X3BNMDf0IZkpQWO0xGlrSulXjEbQJKRHtOwP36-E-Pnvair4zNb5BxAheWYQul26TOjLADhYp28_t3Ev2LEJ32fKjIn_MLPkbCtfvktJ2u_12B3nnQiW2nuruDZf9zZhsnL5CxWtGJjrt9jVlPua6at6JUFxpGU-GP5srG9PnFbB5JOfc2OwAUz6KskHX3HGsxeudywqEXtkc1V1UGZrjb18Gx501aEngLc8RcZXA57veemLA1BDuU5HUOq4HdSEs8zf7e9U_ypTSA5B2Ty6HbZKqmDWz2U4l315DAn8ST1f3_W-wr18887sKsJbzsp8h9M1bc2YkXHnMeU2xRO6nB6Ik_oqdS0MfwrgksZMsUwYts2N4dQU4uS3RqFTbf0UAXDPVvtMiBAusMV0XIGCHycW-VfxKWY-dvF2VN_HnR8X50_JXWb2RLoHX0dN3OLbBF1LSHxPfgK0I4e7cgIm6j4k7nPHHIQix5DQZ05uin4uLT-UIRm4Xnsh1oICbN_wdNBtGkWgXkK7zfECZ3io-Wzm2W1uCKvfWAARKyDd9SZOurRdVFfu1hZONF1ZEVCJVhdmNQLM2FNcku5VGIusyIfqfiuA0b7Bna1KLbafro_fmWRwKK6Ti-Vr7kxuszXBHiyRB3P1kRIc7klnefXy2JA3ik16c33hkQYloQRLU0HciEABmpJAHZOxR8snBheqiqTdMBDq_mu4iaJwhuiTWWzSNfDcJdjyEBiK3FzLD98-V-dYGJKV0kui7NvHN_U38Bok2ss6xLgoDhot1FwOUMMHrWXjuCnKiJLNy_A-o0juIdlOZHN3bpDJB3yDnAG604laQZaxkVJv3qsBZmYyOCniPJHQtvSauAiEw1oElj2BJTqFbTYS8RqnDKoR8kKHkdtcaZhSyszhewlj5J1vNVNHB2BdcZ3tfBYbROD1a2xQeI-iNKzC_4SjGxU-Nn4I9O3AXmI_IltSPgPHM81Gqbw&sai=AMfl-YTpdvUM4BC7OKvuoqpZ5hDtQgGlmaquuOiO6ADvUP_AfeB2mngrD-KW18oThwAU8_TTr0pcY5Y0b562URjPhpwQYlheUMdcRshGQUgc4ixZGJJRYrS3uK4MN27ZkQgQuoI_FT7RC48lWCo-l2IDMMFsFh-vK84mn37S8xY&sig=Cg0ArKJSzOLqqzF5dSweEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=159&cbvp=1&cstd=155&cisv=r20220106.26113&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 10 Jan 2022 18:56:34 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 dpixel
cms.quantserve.com/ Frame 2166 35 B
464 B 108ms
9ms Image
image/gif 2620:116:800d:21:ee05:6a01:4b41:8c89
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEAR5tGULyVCZXB4H1VM2spo&google_cver=1&google_push=AYg5qPK8UfhzYZrBPNTklds__-n9SE4c00INnF7Voc43I-u-D_cvkz32ouFtKg57YrwPZ-IHOTyb76OG4D8vP_UQTgb6GCJtrM8

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:ee05:6a01:4b41:8c89 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2166
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPJOoDKTZ3Tdy2US0yAJx-MfSrw5MSKb8UYZ85i...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWR5QllnQUFBZk1IbVdkRA&google_push=AYg5qPJOoDKTZ3Tdy2US0yAJx-MfSrw5MSKb8UYZ85iYXMZQHAekk7AQgt4yhr72NwCJ0DRwaOAgFoI_XTMfVYUTC2Snw5K_Beg

170 B
188 B

61ms
52ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWR5QllnQUFBZk1IbVdkRA&google_push=AYg5qPJOoDKTZ3Tdy2US0yAJx-MfSrw5MSKb8UYZ85iYXMZQHAekk7AQgt4yhr72NwCJ0DRwaOAgFoI_XTMfVYUTC2Snw5K_Beg

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWR5QllnQUFBZk1IbVdkRA&google_push=AYg5qPJOoDKTZ3Tdy2US0yAJx-MfSrw5MSKb8UYZ85iYXMZQHAekk7AQgt4yhr72NwCJ0DRwaOAgFoI_XTMfVYUTC2Snw5K_Beg
Date: Mon, 10 Jan 2022 18:56:34 GMT
Server: Apache
Connection: keep-alive
Content-Length: 390
Content-Type: text/html; charset=iso-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2166
Redirect Chain

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPK4zEOhmIKh1CkEcB_PChrwZUhv1nSDhw0iS5DPHWavJ-7MXpjvX0xuax13YCn2VKxJIhoVTeKVFY2r05KOaDd4bNFvDcww&google_gid=CAESEIN8_rGYzOlnFAMATa5h6OM&goo...
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCOKC8o4GEgUI6AcQAEIASnBnb29nbGVfcHVzaD1BWWc1cVBLNHpFT2htSUtoMUNrRWNCX1BDaHJ3WlVodjFuU0RodzBpUzVEUEhXYXZKLTdNWHBqdlgweHVheDEzWUNuMlZLeEpJaG9WVGVLVkZZMnIwNU...
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwWWI0YWpLQldSVWJjSEF2YUtxem03Q19DdVprWHFYV0Y0Tm1jQnJxcmVDQQ==&google_push

170 B
188 B

53ms
50ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwWWI0YWpLQldSVWJjSEF2YUtxem03Q19DdVprWHFYV0Y0Tm1jQnJxcmVDQQ==&google_push

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 10 Jan 2022 18:56:34 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwWWI0YWpLQldSVWJjSEF2YUtxem03Q19DdVprWHFYV0Y0Tm1jQnJxcmVDQQ==&google_push
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H2 200 dds
rtb.openx.net/sync/ Frame 2166 43 B
351 B 110ms
14ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEJWp5VnHw7CtfdmliMc-FU8&google_cver=1&google_push=AYg5qPLaXfXpyNV_l4NJ0dNl8YkMbKjgu0fVhp9OmWVMRxnYdiqup7-KrBf5O6vs8Y367I7GAqX02n324jQWggRrVk_qCJJDOji7
Requested by: Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: 3btquo1rkujgcun7pnk7i819lhrkl4h6

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2166
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=fpu8pJ29Tle9jvpOJP8pTw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

52ms
50ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=fpu8pJ29Tle9jvpOJP8pTw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKYY45ogwj9gtPFweEOEVOeCvU4qdO8EePDH7suqTiTxIS5WVYQKzoD1lTz2BkHymG-fxv4coWGoFrrP6Ywe-5Fd-9E3Nbz

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=fpu8pJ29Tle9jvpOJP8pTw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKYY45ogwj9gtPFweEOEVOeCvU4qdO8EePDH7suqTiTxIS5WVYQKzoD1lTz2BkHymG-fxv4coWGoFrrP6Ywe-5Fd-9E3Nbz
date: Mon, 10 Jan 2022 18:56:34 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2166
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEBU-nVPLJkGxLRzfXP6MB8g&google_cver=1&google_push=AYg5qPJ5QVLeAp6XCQdkwF8iZt3YQilqKIOKbcWGs_7IDgAYO5KwPOsLGd-DMXGbQLq91NrequD...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k5MVFKQlQtMjEtNEE1NA==&google_push=AYg5qPJ5QVLeAp6XCQdkwF8iZt3YQilqKIOKbcWGs_7IDgAYO5KwPOsLGd-DMXGbQLq91NrequDgmkJc0frVG5PFMLt_qjzFvfyQ

170 B
188 B

50ms
50ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k5MVFKQlQtMjEtNEE1NA==&google_push=AYg5qPJ5QVLeAp6XCQdkwF8iZt3YQilqKIOKbcWGs_7IDgAYO5KwPOsLGd-DMXGbQLq91NrequDgmkJc0frVG5PFMLt_qjzFvfyQ

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k5MVFKQlQtMjEtNEE1NA==&google_push=AYg5qPJ5QVLeAp6XCQdkwF8iZt3YQilqKIOKbcWGs_7IDgAYO5KwPOsLGd-DMXGbQLq91NrequDgmkJc0frVG5PFMLt_qjzFvfyQ
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 2166
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPJZvuziLrOfblnNTtbMrRiN2Hj_fpMfhWwFylCyTD5ZSZ1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPJZvuziLrOfblnNTtbMrRiN2Hj_fpMfhWwFylCyTD5ZSZ1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPJZvuziLrOfblnNTtbMrRiN2Hj_fpMfhWwFylCyTD5ZSZ1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPJZvuziLrOfblnNTtbMrRiN2Hj_fpMfhWwFylCyTD5ZSZ1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPJZvuziLrOfblnNTtbMrRiN2Hj_fpMfhWwFylCyTD5ZSZ1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPJZvuziLrOfblnNTtbMrRiN2Hj_fpMfhWwFylCyTD5ZSZ1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPJZvuziLrOfblnNTtbMrRiN2Hj_fpMfhWwFylCyTD5ZSZ1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPJZvuziLrOfblnNTtbMrRiN2Hj_fpMfhWwFylCyTD5ZSZ1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPJZvuziLrOfblnNTtbMrRiN2Hj_fpMfhWwFylCyTD5ZSZ1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPJZvuziLrOfblnNTtbMrRiN2Hj_fpMfhWwFylCyTD5ZSZ1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPJZvuziLrOfblnNTtbMrRiN2Hj_fpMfhWwFylCyTD5ZSZ1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPJZvuziLrOfblnNTtbMrRiN2Hj_fpMfhWwFylCyTD5ZSZ1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPJZvuziLrOfblnNTtbMrRiN2Hj_fpMfhWwFylCyTD5ZSZ1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPJZvuziLrOfblnNTtbMrRiN2Hj_fpMfhWwFylCyTD5ZSZ1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPJZvuziLrOfblnNTtbMrRiN2Hj_fpMfhWwFylCyTD5ZSZ1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPJZvuziLrOfblnNTtbMrRiN2Hj_fpMfhWwFylCyTD5ZSZ1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPJZvuziLrOfblnNTtbMrRiN2Hj_fpMfhWwFylCyTD5ZSZ1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPJZvuziLrOfblnNTtbMrRiN2Hj_fpMfhWwFylCyTD5ZSZ1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPJZvuziLrOfblnNTtbMrRiN2Hj_fpMfhWwFylCyTD5ZSZ1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPJZvuziLrOfblnNTtbMrRiN2Hj_fpMfhWwFylCyTD5ZSZ1...

0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 2166 0
12 B 24ms
23ms Image
text/html 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Lfz1UPSAUKuDWi4piY7qMFA-s70qSjzMQCJVP73dNaLcmZPMZqbEqQB4VuNDPVK7qLtFQS

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:34 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame FC4D 22 KB
8 KB 7ms
7ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/

Response headers

cross-origin-resource-policy: cross-origin
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Sat, 08 Jan 2022 18:05:45 GMT
expires: Sun, 08 Jan 2023 18:05:45 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 175849
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame EAC4 22 KB
8 KB 8ms
8ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/

Response headers

cross-origin-resource-policy: cross-origin
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Sat, 08 Jan 2022 18:05:45 GMT
expires: Sun, 08 Jan 2023 18:05:45 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 175849
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 dpixel
cms.quantserve.com/ Frame 4E81 35 B
463 B 96ms
10ms Image
image/gif 2620:116:800d:21:ee05:6a01:4b41:8c89
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEAR5tGULyVCZXB4H1VM2spo&google_cver=1&google_push=AYg5qPKT8H-yCQ9bMHAPiiQEmBV6fd9GkDj2QUXeXea8fMqm_xusZayG_KG-Of0G8EU9GRfZajUlAN5uWM0dFS5raR4BeSh2GLwq

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:ee05:6a01:4b41:8c89 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 466606.gif
id.rlcdn.com/ Frame 4E81 42 B
189 B 103ms
17ms Image
image/gif 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPJPJbdP0RzvtBam8BNS7u-uXXSYYA1ANfooT3PDAT3hMDPkilWwsMg8R7kXA_MhhifQmp9xme6-qRvbJzPFL_TFYADn0PEG&google_gid=CAESEIN8_rGYzOlnFAMATa5h6OM&google_cver=1
Requested by: Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 10 Jan 2022 18:56:34 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

GET
H2 200 dds
rtb.openx.net/sync/ Frame 4E81 43 B
135 B 99ms
14ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEJWp5VnHw7CtfdmliMc-FU8&google_cver=1&google_push=AYg5qPJqmntoQLFvVLXr-CjF1j48J7AxlLLZsJR6HIbFUSglIG2faQJLRMpYHD52fI8IyMGrChOBAl8vTWr3o35gpR15zJOmxaagrg
Requested by: Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: 5vsnkphlb5tbajhsj5ng002kbf08ltoh

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4E81
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=saYQRH9qTWyx8lQFjGb9Ag%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

57ms
55ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=saYQRH9qTWyx8lQFjGb9Ag%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPK2BTUS-s_C3YuK_A3jNBbhqR0TpowxnFMLHj0Fimwqw6Z8vw4KMfqK2dQNZeLuAcOC4QGOHPt4kORJfWD8Y2uS-1p9lSR50Q

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=saYQRH9qTWyx8lQFjGb9Ag%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPK2BTUS-s_C3YuK_A3jNBbhqR0TpowxnFMLHj0Fimwqw6Z8vw4KMfqK2dQNZeLuAcOC4QGOHPt4kORJfWD8Y2uS-1p9lSR50Q
date: Mon, 10 Jan 2022 18:56:32 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4E81
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEBU-nVPLJkGxLRzfXP6MB8g&google_cver=1&google_push=AYg5qPJDwcDRmVmsdEk2jgqWW7mG-N_If4Lng2XAkcaAF9J1SOuko7Y_ZaYlk3zkYUWrmphc3gv...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k5MVFKQlUtWi1MTlo3&google_push=AYg5qPJDwcDRmVmsdEk2jgqWW7mG-N_If4Lng2XAkcaAF9J1SOuko7Y_ZaYlk3zkYUWrmphc3gv1uNKrVOnyk2rrMm8dU8rShCmp

170 B
188 B

50ms
50ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k5MVFKQlUtWi1MTlo3&google_push=AYg5qPJDwcDRmVmsdEk2jgqWW7mG-N_If4Lng2XAkcaAF9J1SOuko7Y_ZaYlk3zkYUWrmphc3gv1uNKrVOnyk2rrMm8dU8rShCmp

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k5MVFKQlUtWi1MTlo3&google_push=AYg5qPJDwcDRmVmsdEk2jgqWW7mG-N_If4Lng2XAkcaAF9J1SOuko7Y_ZaYlk3zkYUWrmphc3gv1uNKrVOnyk2rrMm8dU8rShCmp
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 4E81
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_push=AYg5qPLK01MfH63W4clcXC-aka0zQShgerojCE5OdNo2TJhfKI2iyvhx5tdzjfiaGRlfRLkaHQdx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_push=AYg5qPLK01MfH63W4clcXC-aka0zQShgerojCE5OdNo2TJhfKI2iyvhx5tdzjfiaGRlfRLkaHQdx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_push=AYg5qPLK01MfH63W4clcXC-aka0zQShgerojCE5OdNo2TJhfKI2iyvhx5tdzjfiaGRlfRLkaHQdx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_push=AYg5qPLK01MfH63W4clcXC-aka0zQShgerojCE5OdNo2TJhfKI2iyvhx5tdzjfiaGRlfRLkaHQdx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_push=AYg5qPLK01MfH63W4clcXC-aka0zQShgerojCE5OdNo2TJhfKI2iyvhx5tdzjfiaGRlfRLkaHQdx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_push=AYg5qPLK01MfH63W4clcXC-aka0zQShgerojCE5OdNo2TJhfKI2iyvhx5tdzjfiaGRlfRLkaHQdx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_push=AYg5qPLK01MfH63W4clcXC-aka0zQShgerojCE5OdNo2TJhfKI2iyvhx5tdzjfiaGRlfRLkaHQdx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_push=AYg5qPLK01MfH63W4clcXC-aka0zQShgerojCE5OdNo2TJhfKI2iyvhx5tdzjfiaGRlfRLkaHQdx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_push=AYg5qPLK01MfH63W4clcXC-aka0zQShgerojCE5OdNo2TJhfKI2iyvhx5tdzjfiaGRlfRLkaHQdx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_push=AYg5qPLK01MfH63W4clcXC-aka0zQShgerojCE5OdNo2TJhfKI2iyvhx5tdzjfiaGRlfRLkaHQdx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_push=AYg5qPLK01MfH63W4clcXC-aka0zQShgerojCE5OdNo2TJhfKI2iyvhx5tdzjfiaGRlfRLkaHQdx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_push=AYg5qPLK01MfH63W4clcXC-aka0zQShgerojCE5OdNo2TJhfKI2iyvhx5tdzjfiaGRlfRLkaHQdx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_push=AYg5qPLK01MfH63W4clcXC-aka0zQShgerojCE5OdNo2TJhfKI2iyvhx5tdzjfiaGRlfRLkaHQdx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_push=AYg5qPLK01MfH63W4clcXC-aka0zQShgerojCE5OdNo2TJhfKI2iyvhx5tdzjfiaGRlfRLkaHQdx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_push=AYg5qPLK01MfH63W4clcXC-aka0zQShgerojCE5OdNo2TJhfKI2iyvhx5tdzjfiaGRlfRLkaHQdx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_push=AYg5qPLK01MfH63W4clcXC-aka0zQShgerojCE5OdNo2TJhfKI2iyvhx5tdzjfiaGRlfRLkaHQdx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_push=AYg5qPLK01MfH63W4clcXC-aka0zQShgerojCE5OdNo2TJhfKI2iyvhx5tdzjfiaGRlfRLkaHQdx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_push=AYg5qPLK01MfH63W4clcXC-aka0zQShgerojCE5OdNo2TJhfKI2iyvhx5tdzjfiaGRlfRLkaHQdx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_push=AYg5qPLK01MfH63W4clcXC-aka0zQShgerojCE5OdNo2TJhfKI2iyvhx5tdzjfiaGRlfRLkaHQdx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_push=AYg5qPLK01MfH63W4clcXC-aka0zQShgerojCE5OdNo2TJhfKI2iyvhx5tdzjfiaGRlfRLkaHQdx...

0
0

GET
H2 200 trk
ag.innovid.com/ Frame 4E81 43 B
297 B 167ms
16ms Image
image/gif 2a05:d01c:1d8:8102:fac4:e2cc:bf1c:7892
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEDciebEyV9vmNzwyeHFtIx4&google_cver=1&google_push=AYg5qPKHX72luhqZoH-sN9PcRfZkFESz_vou2LUwFtQdm3SShSFQXZVzmIq-Pj5gFviVbUxgX7-Tu7G0lx_9jf0wjW5OlBH0JiHhTg
Requested by: Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8102:fac4:e2cc:bf1c:7892 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 4E81 0
12 B 15ms
15ms Image
text/html 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13L7oiyPOFmhOVkMVWFPeT3TWHRhEg1GhiHA2bbXrm33OY1hukqpeMP_ggrwGcElYIxwEZmt

Requested by

Host: 02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com
URL: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:34 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 r8nbwAJIoZCxWYvDNzL2FR480laaoV7LX6_itKNPK9o.js Show response
pagead2.googlesyndication.com/bg/ Frame 32A1 35 KB
13 KB 12ms
12ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/r8nbwAJIoZCxWYvDNzL2FR480laaoV7LX6_itKNPK9o.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

afc9dbc00248a190b1598bc33732f6151e3cd2569aa15ecb5fafe2b4a34f2bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 09 Jan 2022 12:26:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 109804
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13292
x-xss-protection: 0
last-modified: Tue, 21 Dec 2021 11:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 09 Jan 2023 12:26:30 GMT

GET
H3 200 keyvisual-x2.jpg
s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/images/ Frame 495C 21 KB
21 KB 10ms
10ms Image
image/jpeg 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/images/keyvisual-x2.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce754304e29c744f66b54300fd66da6c1c79841974b41cd5ccf01631f3cc65a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 11:10:45 GMT
x-content-type-options: nosniff
age: 459949
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21665
x-xss-protection: 0
last-modified: Tue, 09 Feb 2021 19:34:09 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 05 Jan 2023 11:10:45 GMT

GET
H3 200 attribute-1-x2.png
s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/images/ Frame 495C 1 KB
1 KB 26ms
26ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/images/attribute-1-x2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

86e18c250dd6b69d1e8ba42e2ce6e1db1542a70ca98b531afc70fb19733d1bad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 04:06:31 GMT
x-content-type-options: nosniff
age: 485403
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1476
x-xss-protection: 0
last-modified: Tue, 09 Feb 2021 19:34:09 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 05 Jan 2023 04:06:31 GMT

GET
H3 200 attribute-2-x2.png
s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/images/ Frame 495C 3 KB
3 KB 20ms
13ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/images/attribute-2-x2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

daa8ffef02f9990498a0a1dedbdb1b0b2b338ac754046a0b7a255b97e90bbd7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 05:37:37 GMT
x-content-type-options: nosniff
age: 479937
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3329
x-xss-protection: 0
last-modified: Tue, 09 Feb 2021 19:34:09 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 05 Jan 2023 05:37:37 GMT

GET
H3 200 push-3-x2.png
s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/images/ Frame 495C 15 KB
15 KB 21ms
13ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/images/push-3-x2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4be97a7c5deb5e3dd4ff55eba955b8e5cb799c9d45f821fa55177cb35359d83

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 20:09:05 GMT
x-content-type-options: nosniff
age: 427649
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15337
x-xss-protection: 0
last-modified: Tue, 09 Feb 2021 19:34:09 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 05 Jan 2023 20:09:05 GMT

GET
H3 200 push-1-x2.png
s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/images/ Frame 495C 8 KB
8 KB 22ms
14ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/images/push-1-x2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b90fee301d049aa7a8bdb23cfcf2a56bb29fe2b5dec604b5611f8d47655c59f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 04:06:31 GMT
x-content-type-options: nosniff
age: 485403
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8380
x-xss-protection: 0
last-modified: Tue, 09 Feb 2021 19:34:09 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 05 Jan 2023 04:06:31 GMT

GET
H3 200 push-2-x2.png
s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/images/ Frame 495C 2 KB
2 KB 22ms
15ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/images/push-2-x2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7ce0adf90ec0c63c7743daef9d63bdf7373b73b7ed1eeb144c336423b76ae83d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 04:06:31 GMT
x-content-type-options: nosniff
age: 485403
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1604
x-xss-protection: 0
last-modified: Tue, 09 Feb 2021 19:34:09 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 05 Jan 2023 04:06:31 GMT

GET
H3 200 box-push-x2.png
s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/images/ Frame 495C 2 KB
2 KB 22ms
15ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/images/box-push-x2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c5509ce61f9d4fab661a2f28bbbbacc081be16402404174d1906182b046c5a6f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 06:14:51 GMT
x-content-type-options: nosniff
age: 45703
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2445
x-xss-protection: 0
last-modified: Tue, 09 Feb 2021 19:34:09 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 10 Jan 2023 06:14:51 GMT

GET
H3 200 box-cta-x2.png
s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/images/ Frame 495C 1 KB
1 KB 22ms
14ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/images/box-cta-x2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

457e2dc6e429c26383b704db37b21f42509c31b5f810000aec26fffa7b23a0d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 04:06:31 GMT
x-content-type-options: nosniff
age: 485403
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1120
x-xss-protection: 0
last-modified: Tue, 09 Feb 2021 19:34:09 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 05 Jan 2023 04:06:31 GMT

GET
H3 200 partner.svg
s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/images/ Frame 495C 351 B
298 B 24ms
15ms Image
image/svg+xml 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/images/partner.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

72fd1fa5c56689ff1fc4d3d60c6065f7f99fe6953a3c54ed3ad0c82aa9a34fa2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 20:16:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 427233
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 264
x-xss-protection: 0
last-modified: Tue, 09 Feb 2021 19:34:09 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 05 Jan 2023 20:16:01 GMT

GET
H3 200 logo.svg
s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/images/ Frame 495C 3 KB
1 KB 22ms
14ms Image
image/svg+xml 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/images/logo.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

23f66936773cf6edddcdc7b474a536146779ca32fca06d731861ff069544b93e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 05:49:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 479216
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1369
x-xss-protection: 0
last-modified: Tue, 09 Feb 2021 19:34:09 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 05 Jan 2023 05:49:38 GMT

GET
H3 200 overlay-push-x2.png
s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/images/ Frame 495C 2 KB
2 KB 23ms
14ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/images/overlay-push-x2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77e2ceb91181d1679c4d7b50e913fb50ab4928fb314302edb1c95df8cc476232

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 05:37:37 GMT
x-content-type-options: nosniff
age: 479937
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1967
x-xss-protection: 0
last-modified: Tue, 09 Feb 2021 19:34:09 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 05 Jan 2023 05:37:37 GMT

GET
H3 200 overlay-cta-hover-x2.png
s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/images/ Frame 495C 1 KB
1 KB 24ms
14ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/images/overlay-cta-hover-x2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50fb16435af36aa4edcc1d264dfe43fc04a317d6ad74b6287efd52bdcd093a18

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 20:17:29 GMT
x-content-type-options: nosniff
age: 427145
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1427
x-xss-protection: 0
last-modified: Tue, 09 Feb 2021 19:34:09 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 05 Jan 2023 20:17:29 GMT

GET
H3 200 overlay-cta-x2.png
s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/images/ Frame 495C 1 KB
1 KB 23ms
14ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/images/overlay-cta-x2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

73463af12c8189114e0b385c59546438db8da5bea66eee76f75fc2ce52054b93

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 20:25:59 GMT
x-content-type-options: nosniff
age: 426635
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1426
x-xss-protection: 0
last-modified: Tue, 09 Feb 2021 19:34:09 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 05 Jan 2023 20:25:59 GMT

GET
H3 200 tweenmax_2.0.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 495C 113 KB
38 KB 26ms
23ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/tweenmax_2.0.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62afec092c21b138eeb1fc55859f60c19dd12ca3c02bdfeb336a820b016a547b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38915
x-xss-protection: 0
last-modified: Tue, 19 Jun 2018 18:02:41 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 10 Jan 2022 18:56:34 GMT

GET
H3 200 creative-1.0.6.min.js Show response
s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/scripts/ Frame 495C 2 KB
884 B 20ms
13ms Script
application/x-javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/scripts/creative-1.0.6.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a44400fb88aaf018fb0e9aff450c4b708da545d38ab0317d6bc599f093e20030

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6371185760924672210/TB_MR_HTM_CategoryUmzug-UMZUG-THINK_300x250_rta-V01/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 11:03:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 546804
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 855
x-xss-protection: 0
last-modified: Tue, 09 Feb 2021 19:34:09 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 04 Jan 2023 11:03:10 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220106/r20110914/client/ Frame 7891 2 KB
1 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220106/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=250&slotname=0787847652&adk=665242438&adf=3866777003&pi=t.ma~as.0787847652&w=300&lmt=1641840994&psa=0&format=300x250&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641840991081&bpp=1&bdt=145&idt=3113&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dce6fdd0735d9541c%3AT%3D1641840993%3AS%3DALNI_MapIh1wIk4CQkuJU4LU2MggxokXJQ&prev_fmts=728x90%2C728x90&correlator=1873363329958&frm=20&pv=1&ga_vid=1762928891.1641840991&ga_sid=1641840991&ga_hid=1646229672&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1039&ady=1319&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063858&oid=2&pvsid=4150545889650970&pem=438&tmod=427&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeopEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=tyYckT3vCd&p=https%3A//zvonil.octo.net&dtd=3117

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:39:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8242
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 16:39:12 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7891 120 KB
37 KB 60ms
40ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e78bac7c2d4ad157ca2d43d12d1cdc08ab7943d3535287108ed9e6b8ff9da523

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37632
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641385868096614"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 10 Jan 2022 18:56:34 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220106/r20110914/client/ Frame 7891 15 KB
6 KB 11ms
11ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220106/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d847a2b472bb4f98a901aecde2461eba0d47978d1ee4c0e386e3ee299e8ed96b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:39:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8242
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 10427043382315408254
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 16:39:12 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 7891 0
0 53ms
15ms Image
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ1hwKBqWAY0husuu6VuMj-EpV9Yzt8KfO9JNuRGz3t6JPp5K3wEP3qNuGNRorfVlvmYjCol9DEHwbRUFXwi1hMl8mJEg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=250&slotname=0787847652&adk=665242438&adf=3866777003&pi=t.ma~as.0787847652&w=300&lmt=1641840994&psa=0&format=300x250&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641840991081&bpp=1&bdt=145&idt=3113&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dce6fdd0735d9541c%3AT%3D1641840993%3AS%3DALNI_MapIh1wIk4CQkuJU4LU2MggxokXJQ&prev_fmts=728x90%2C728x90&correlator=1873363329958&frm=20&pv=1&ga_vid=1762928891.1641840991&ga_sid=1641840991&ga_hid=1646229672&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1039&ady=1319&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063858&oid=2&pvsid=4150545889650970&pem=438&tmod=427&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeopEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=tyYckT3vCd&p=https%3A//zvonil.octo.net&dtd=3117
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H3 200 Enabler_01_245.js Show response
s0.2mdn.net/879366/ Frame 612B 110 KB
38 KB 12ms
12ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_245.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16062795329522630656/300x600.html?e=69&leftOffset=0&topOffset=0&c=sSN0U8XuLz&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4642568b405b3750fb18df621889e27def95e8162c1cdd256a21b319c9a4e24b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16062795329522630656/300x600.html?e=69&leftOffset=0&topOffset=0&c=sSN0U8XuLz&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:05:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3049
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38568
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 19:32:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 11 Jan 2022 18:05:45 GMT

GET
H3 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 612B 60 KB
24 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16062795329522630656/300x600.html?e=69&leftOffset=0&topOffset=0&c=sSN0U8XuLz&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16062795329522630656/300x600.html?e=69&leftOffset=0&topOffset=0&c=sSN0U8XuLz&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 10 Jan 2022 18:56:34 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame A39C 118 KB
40 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9747004193402519552/728x090.html?e=69&leftOffset=0&topOffset=0&c=fDhiPuxYL2&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9747004193402519552/728x090.html?e=69&leftOffset=0&topOffset=0&c=fDhiPuxYL2&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 09 Jan 2022 20:53:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 79394
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 10 Jan 2022 20:53:20 GMT

GET
H3 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame A39C 60 KB
24 KB 33ms
33ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9747004193402519552/728x090.html?e=69&leftOffset=0&topOffset=0&c=fDhiPuxYL2&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9747004193402519552/728x090.html?e=69&leftOffset=0&topOffset=0&c=fDhiPuxYL2&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 10 Jan 2022 18:56:34 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220106/r20110914/client/ Frame 37E1 2 KB
1 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220106/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=7096521402&adk=2342716466&adf=3252783458&pi=t.ma~as.7096521402&w=728&lmt=1641840994&psa=0&format=728x90&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641840991080&bpp=1&bdt=145&idt=3108&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dce6fdd0735d9541c%3AT%3D1641840993%3AS%3DALNI_MapIh1wIk4CQkuJU4LU2MggxokXJQ&prev_fmts=728x90&correlator=1873363329958&frm=20&pv=1&ga_vid=1762928891.1641840991&ga_sid=1641840991&ga_hid=1646229672&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=1133&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063858&oid=2&pvsid=4150545889650970&pem=438&tmod=427&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=cZVS1rX0el&p=https%3A//zvonil.octo.net&dtd=3112

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:39:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8242
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 16:39:12 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 37E1 120 KB
37 KB 44ms
29ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e78bac7c2d4ad157ca2d43d12d1cdc08ab7943d3535287108ed9e6b8ff9da523

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37632
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641385868096614"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 10 Jan 2022 18:56:34 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220106/r20110914/client/ Frame 37E1 15 KB
6 KB 13ms
12ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220106/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d847a2b472bb4f98a901aecde2461eba0d47978d1ee4c0e386e3ee299e8ed96b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:39:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8242
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 10427043382315408254
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 16:39:12 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 37E1 0
0 44ms
16ms Image
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSf4m__wgZdZZlJ86Hghu1nRo_DaYcXd9bD3zHepj4DN9me4iU3qD_gVd3f9WFivDxzKARb3jsg3bdH_LNT22VpcmgpWg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=7096521402&adk=2342716466&adf=3252783458&pi=t.ma~as.7096521402&w=728&lmt=1641840994&psa=0&format=728x90&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641840991080&bpp=1&bdt=145&idt=3108&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dce6fdd0735d9541c%3AT%3D1641840993%3AS%3DALNI_MapIh1wIk4CQkuJU4LU2MggxokXJQ&prev_fmts=728x90&correlator=1873363329958&frm=20&pv=1&ga_vid=1762928891.1641840991&ga_sid=1641840991&ga_hid=1646229672&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=1133&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063858&oid=2&pvsid=4150545889650970&pem=438&tmod=427&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=cZVS1rX0el&p=https%3A//zvonil.octo.net&dtd=3112
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 7891 0
0 55ms
46ms Fetch
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CElZrYoHcYeHzDs-JiQbS4q6ICZDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQJeJQrmqPuyPqgDAaoExgFP0NxSdZeeTExkgWPitZqixMwE86hW8nIaVVf-Wp7a1uZXqw3noJ66w82HtQrBmB5WwEwz09if_TcbGKEyXgMPhv7l1Cmqo9ra3nxDh6rz9Rz9vbU_lVp89sQFeWc4RECSRGnECDC1SpgsB_6lQEvZIY0KmMCulVNlWu0Auersl7IB9imDrg6i3PiM6y97a4PRJ-SNrp3Oes0fjy0ESqvjwjKmQev645oA69iAhtW90oiDSosb66gxPPOAKl--kF5Me0KWXJmABry2mfOd_o_LMaAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBABgAoB-gsCCAGADAHQFQGAFwGyFxoKGBIUcHViLTI5Nzk1MzM5MDkzOTI1ODgYAA&sigh=tEcwNBj6X-A&uach_m=[UACH]&cid=CAQSPACNIrLMo2oKoVdURUbpMctbm9UIWOfbeK_tG-JbeK5iOLMQSJH0TqDwct-LKePoLR1WxWV-fszywSuaERgB

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=250&slotname=0787847652&adk=665242438&adf=3866777003&pi=t.ma~as.0787847652&w=300&lmt=1641840994&psa=0&format=300x250&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641840991081&bpp=1&bdt=145&idt=3113&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dce6fdd0735d9541c%3AT%3D1641840993%3AS%3DALNI_MapIh1wIk4CQkuJU4LU2MggxokXJQ&prev_fmts=728x90%2C728x90&correlator=1873363329958&frm=20&pv=1&ga_vid=1762928891.1641840991&ga_sid=1641840991&ga_hid=1646229672&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1039&ady=1319&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063858&oid=2&pvsid=4150545889650970&pem=438&tmod=427&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeopEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=tyYckT3vCd&p=https%3A//zvonil.octo.net&dtd=3117
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 10 Jan 2022 18:56:34 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 204 winResponse
prod-rtb.ad4mat.net/ Frame 7891 0
0 49ms
17ms Fetch
image/gif 2600:1901:0:76b9::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://prod-rtb.ad4mat.net/winResponse?a=1jck9rzw7t8dennwh7cvdtzvgyk3f0s26487w75b17xfwkw4z3mffbet496k4n287aeane40ga1g88mvg2yyetw0wnqg6gx744yp5738j2k53hegpsepschfczfpmbb0t2a34vw75jfjxzyczp47xrt75280wwj9xcy4dp2a50e00rsr652h3w25yr9mg561dvzv8bhxtjjdm77qtd7e87gwjgcs8fe40mk7fknqywqwb96facm4yk2mgrej5vgpn03m4r8pbspcq71mddgtzpzt5t3g1dg6yc3wgy104rj85jz904e4ds2aw31j6ebqwcywv6zhmmr5e500nggfn2b9t0a585e17xszrpj7my93k0pn0j2mp6p9d3cxez1jtckzrssfejdgpdbbbh2rq012219ay&b=YdyBYgADueEKwkTPAAuxUlzHRQLKy9B75GeNmw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=250&slotname=0787847652&adk=665242438&adf=3866777003&pi=t.ma~as.0787847652&w=300&lmt=1641840994&psa=0&format=300x250&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641840991081&bpp=1&bdt=145&idt=3113&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dce6fdd0735d9541c%3AT%3D1641840993%3AS%3DALNI_MapIh1wIk4CQkuJU4LU2MggxokXJQ&prev_fmts=728x90%2C728x90&correlator=1873363329958&frm=20&pv=1&ga_vid=1762928891.1641840991&ga_sid=1641840991&ga_hid=1646229672&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1039&ady=1319&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063858&oid=2&pvsid=4150545889650970&pem=438&tmod=427&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeopEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=tyYckT3vCd&p=https%3A//zvonil.octo.net&dtd=3117
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:76b9:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 10 Jan 2022 18:56:34 GMT
via: 1.1 google
alt-svc: clear
content-type: image/gif

GET
H2 200 dr Show response
as.ad4m.at/ad/ Frame ECC5 2 KB
3 KB 128ms
81ms Document
text/html 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://as.ad4m.at/ad/dr?ed=1jd43kbsaygz9zdcf69j8gfac3kjt91j8s606ea0keww1f73xa2je76kbnagjey7qt1vtk2kp8t86a5kf0dw1fvxxh3t1vkwv54q347cmqnng4f22sxjbjeyntqt1dn69c8mca10jgway49zt648e65x1qgrg8zgprxyeqfshg1k7qnmxyb1yvjzm3qmqz7y9q3vyh5cd1mv45d9r9va0qy8e10psv8a14w2h0hwz85c426ts75852n47f5q8xwn6tf8xt0cm46tjsbwee3g3xvvq1wdk2vyd8971c9mpkjf1qcbgw2q0mehkyaw2h34d5c2gg1zfcpcv30z9jtsarkp3b6kxhmkmgnz7e01qqn09k6maqrfcgaxn58ecwqzv9fv4f5xvsrkexebawq9yxqqm7nf7egw5ryc1sa84s64ja6dz1tmg&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCmheAYoHcYeHzDs-JiQbS4q6ICZDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQJeJQrmqPuyPqgDAaoEyQFP0NxSdZeeTExkgWPitZqixMwE86hW8nIaVVf-Wp7a1uZXqw3noJ66w82HtQrBmB5WwEwz09if_TcbGKEyXgMPhv7l1Cmqo9ra3nxDh6rz9Rz9vbU_lVp89sQFeWc4RECSRGnECDC1SpgsB_6lQEvZIY0KmMCulVNlWu0Auersl7IB9imDrg6i3PiM6y97a4PRJ-SNrp3Oes0fjy0ESqvjgDCH0zwDZNrIbJAWXJwvILGXQCYRxbDsvDHJuKcqjnJUrp4JHFFz-_KABry2mfOd_o_LMaAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_3zykky8NkaC4naf844LOUCHczl4g%26client%3Dca-pub-2979533909392588%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

75507f23d6b44ab5e47229dcb3f06f498167359a0bdf8a98dbadfa1cdeb0b47a

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri ;child-src ;connect-src ;default-src 'self';font-src ;form-action 'none';frame-ancestors * data:;frame-src ;img-src data:;manifest-src 'none';media-src 'none';navigate-to ;object-src 'none';prefetch-src 'none';script-src 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
Strict-Transport-Security	max-age=86400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

date: Mon, 10 Jan 2022 18:56:34 GMT
content-type: text/html; charset=utf-8
strict-transport-security: max-age=86400; includeSubDomains; preload
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
x-download-options: noopen
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
x-xss-protection: 1; mode=block
cross-origin-embedder-policy: unsafe-none
content-security-policy: block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-ancestors * data:;frame-src *;img-src * data:;manifest-src 'none';media-src 'none';navigate-to *;object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
referrer-policy: same-origin
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
expires: 0
surrogate-control: no-store
pragma: no-cache
cross-origin-opener-policy: unsafe-none
via: 1.1 google
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6cb820492c8f59a1-MXP
content-encoding: br

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame F0F9 1 KB
749 B 20ms
7ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 10 Jan 2022 13:26:12 GMT
expires: Tue, 11 Jan 2022 13:26:12 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 19822
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 37E1 0
0 57ms
48ms Fetch
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CWzu7YoHcYfayDvK7iQaU-biQDsme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItMjk3OTUzMzkwOTM5MjU4OKAB1bbS6gPIAQmpAhLw3Kgi_rI-qAMBqgTFAU_QSkqKV1ZnozVIWLpQzxRwIE695kN6gQ5bJd9IaIsR3_dDbRBOkQUxqcz3pxdwGMltkQehX7K5caEJcjx5oiHtifLxXIucyNlwgtALYDuwRddwYeLr9JtoVlync1fNJvQXw4cBU-TJypw9zE2WQ-E6J_DeichMFGp6keJwkM_0P6chIGp0BTKoA7cr9UTcWp-4WsjeUeoF_N0S2yNX4hYV4HFg5dZMcWKkwdgVxDcrIkLDY9JzukhnVD8lHBQ0FykMQDHYgAbUoIrLpJuoo2ygBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAYAKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi0yOTc5NTMzOTA5MzkyNTg4GAA&sigh=ovuuZGf4ZhM&uach_m=[UACH]&cid=CAQSPACNIrLM5zYfBgmpZxGdxr1ZztleKP-SMMcl1Hh_BVtTCE-SwqlCme9n2k5Eh5COu9ytkLpQ5U4aUH1RxxgB

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=7096521402&adk=2342716466&adf=3252783458&pi=t.ma~as.7096521402&w=728&lmt=1641840994&psa=0&format=728x90&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641840991080&bpp=1&bdt=145&idt=3108&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dce6fdd0735d9541c%3AT%3D1641840993%3AS%3DALNI_MapIh1wIk4CQkuJU4LU2MggxokXJQ&prev_fmts=728x90&correlator=1873363329958&frm=20&pv=1&ga_vid=1762928891.1641840991&ga_sid=1641840991&ga_hid=1646229672&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=1133&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063858&oid=2&pvsid=4150545889650970&pem=438&tmod=427&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=cZVS1rX0el&p=https%3A//zvonil.octo.net&dtd=3112
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 10 Jan 2022 18:56:34 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 204 notify
rtb.fr.eu.criteo.com/google/auction/ Frame 37E1 0
0 72ms
15ms Fetch 2a02:2638::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.fr.eu.criteo.com/google/auction/notify?profile=14&payload=UOb8EN6BMNgFWp2DYgICAAAASV-pTuvRD9cQYYHcYQab3EwdCe-lQvy3ABI&wp=YdyBYgADmXYKwl3yAA48lEUjP_lf0BXErg2sKg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload;

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 9C60 196 KB
57 KB 517ms
157ms Document
text/html 2a02:2638::18
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=YdyBYgADmXYKwl3yAA48lEUjP_lf0BXErg2sKg&u=%7CdUT6sJtqYKlw4c2f7NGJ8Iz6QLICfb4oMQrHcOTW3%2FE%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_AM8iEE4GHx4XAZ8-c9e5LlJfMjehYPJbM0j2hknANCpNfsuV4bKOZdERZwsUOl74YTlNh2oC0QHYQDlh-AmHzDLT_jyvxHH1uXmzrgtMLAx0kJ8SP4M0e2vlZ0n6rkHF8We3a9_XpnqbAtrzhSswhjOJ_pF0993_-c5aljubi_rZhATUWM9dYfdkiI9YXk7scR5eOjgpL4WTfozA_o-DiZndZwMmf6dVdAsEp1SQOC4M7zRNSeGQYmSIBph0PDWobJJQaH37qvBdmJ6Pwj059yua1OE1UwcZD5CVedt2tUoqdclmXhKofKcByycKe58QqCBLZl66CrZpNwSAxAcAGZ3pXk3QcLB6jKLAexKu_cGmK0yU6YpR7RyRyGKFRbkXUdkOtKw8VjmtoeWQesyDvntnwkReSOOXBV7pHuu6RqPsppyiL8SZJ2Zzl2P_KzB4O&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCHr5SYoHcYfayDvK7iQaU-biQDsme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItMjk3OTUzMzkwOTM5MjU4OKAB1bbS6gPIAQmpAhLw3Kgi_rI-qAMBqgTIAU_QSkqKV1ZnozVIWLpQzxRwIE695kN6gQ5bJd9IaIsR3_dDbRBOkQUxqcz3pxdwGMltkQehX7K5caEJcjx5oiHtifLxXIucyNlwgtALYDuwRddwYeLr9JtoVlync1fNJvQXw4cBU-TJypw9zE2WQ-E6J_DeichMFGp6keJwkM_0P6chIGp0BTKoA7cr9UTcWp-4WsjeUeoF_N0S2yNX4lQXwePnakpfzv6wYggoYs8iNkh1afxrOPyvaZnXowoYD6ymxCJnphxxgAbUoIrLpJuoo2ygBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0gMpYXphgXviFACc2PsyvsKiEVCA%26client%3Dca-pub-2979533909392588%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::18 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

2ab19ae426cbcae5ba22e7ab59fe77b3fb6c79148122c61202cf61f23f61ad88

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

date: Mon, 10 Jan 2022 18:56:34 GMT
content-type: text/html
server: Kestrel
cache-control: private, max-age=0, no-cache
pragma: no-cache
expires: Mon, 26 Jul 1997 05:00:00 GMT
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cross-origin-resource-policy: cross-origin
p3p: CP='CUR ADM OUR NOR STA NID'
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=z8s8INiuH0A_m3V4IM0eyYkbMkSXn241_FRC3BMtTsxuwCZhzwMHdRrkzwBmpPAtzkZHArlykZpd5VzA77Ow4ddmDKmGEbYtX_-9XSOhnkSamzBonKRqfXRfp3qSlGKnuSHQOhG_C2IeadSM7M-v4QWvJ9qy4Q0kEEJgc5YJpeomQ3LPJh-6_voF_VYaVCLHxeD6XWyfYeOP-m8HCWPefQtVOA61FnUJwx1zP4hJPxc_RsC7TuqPLUrtNghxWw7O9Z4tAQ"}], "max_age": 86400}
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
server-processing-duration-in-ticks: 139231318
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 120F 1 KB
749 B 19ms
7ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 10 Jan 2022 13:26:12 GMT
expires: Tue, 11 Jan 2022 13:26:12 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 19822
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 r8nbwAJIoZCxWYvDNzL2FR480laaoV7LX6_itKNPK9o.js Show response
pagead2.googlesyndication.com/bg/ Frame FC4D 35 KB
13 KB 11ms
8ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/r8nbwAJIoZCxWYvDNzL2FR480laaoV7LX6_itKNPK9o.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

afc9dbc00248a190b1598bc33732f6151e3cd2569aa15ecb5fafe2b4a34f2bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 09 Jan 2022 12:26:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 109804
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13292
x-xss-protection: 0
last-modified: Tue, 21 Dec 2021 11:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 09 Jan 2023 12:26:30 GMT

GET
H3 200 r8nbwAJIoZCxWYvDNzL2FR480laaoV7LX6_itKNPK9o.js Show response
pagead2.googlesyndication.com/bg/ Frame EAC4 35 KB
13 KB 12ms
9ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/r8nbwAJIoZCxWYvDNzL2FR480laaoV7LX6_itKNPK9o.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

afc9dbc00248a190b1598bc33732f6151e3cd2569aa15ecb5fafe2b4a34f2bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 09 Jan 2022 12:26:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 109804
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13292
x-xss-protection: 0
last-modified: Tue, 21 Dec 2021 11:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 09 Jan 2023 12:26:30 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame C231 0
23 B 45ms
45ms Ping
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstfpw3h-XqQGPqhogvP8CpUVNIladR_lJIyKHPy-eIoG2HC_jelvYabb8ihsN2Mrf5QVu80wlFsWzDy63dTNdC5IWuSmbP6FXhAapaAjEb-xsRkDGDk31UQMPPIFGykc3vqzQtPuj_X-KBDrQYbwz6szIheN9YQ4mm3DosaKX1DebNLTR-4YUNBZLY72exFCRqzVgB6q4VIYbhy1woUQPIJsaJG_stQCZLD2FViN1YxUo1uyqNwjir2SMrptTbaIPNXxUqD5Yk0VWAEPWA4j3HR2F0chAsCGCWKAMimvvsTXzO2tpeIPPQIXtVcmhy2m_gx8GnwhWlA_k1VPfThB54l-MjemOHtZAz8LG2YWEED4_qwZIVqIGXMBxzi3m-vKi6-MfNUn_MXWB0u8UFsyIDUIzRpQQ5uiXFtOYTw2QECR7TdIzQlNYJO0QrQh_E1o9O_6aFRw2kLMMyUEGzXww2RKkZGd79j9oKOwOsiX4au_Z7CYRZy-2iXT9NH5WjsGzoJOpMDWIS1MAMSGQYM6arHnh80BfLD3lyaYN8XEvv6dJHzU0dVQK8UQIOF274Qn9jcMg9W2PqnQi6TKZ7qAaWc0p2SrHhY_CYV9hvJuKEuTXMfLCe10jupbnkDRK_Cy8iJxHsG2lpI8_kG-tZQLL-Z8-njwyx06Qf0QwOmap_0ynleuAoyTbdKbFDrywzp13J_4UO5Cs9uNyB1DTOpi1oMGUo0eArjMG5nQXGzOSoPwncghGnSvnproXvXnM9GgQMJplERXTvC64Hmz3iOOngn0zUFhBvZOVlZwQzXx1An0pH_g96j6CrQvsCICwYkISrugIeg9eLWR9IVA5vqt7UMH46gjnASzbsNtzBSBvdhyW_lTMvWorkqsQcci8taTQ3fNKvSf7HmdYvJzhOTQV_7VI-HvaSdw3ZdOMiXtUEvQUBQLjMtOW4IB-tKBWVpfueVVz0oQRGcTty5qLTgg45X71I-5pnYZ1E1FPNCrK2WYnhrprYkn0YcDL4UQUsd3yPnW0PfvFgANequXzXbyECTuaKvV4wg9IjEyrD6sMdbWzBvE4x4Q2yv5UcrnkBxlc6IgUxoLiiAyKm3CEcrwfQPAWmcxoXC6FblT702s5tZnHnj41orlt039gwvV2awJfuDcd9TNFuaZhnTqR91ad2wblijk05fF8N8NbV_TQ&sai=AMfl-YSpCzeHTzMuMqs0ptsNMMUiihE8fyeOLZ8zM9Ay-Mn4FtiTvp5YYva4F2HnmpZQFQs7-yILFeuHN_58gfEg7SZRMbE0ijd8ZfRVtMAiGc8uHIJ5odpwiwtjrhiy4ZmQIxTl6Td8d14mf_ptgQxLY4ahvuzNmA&sig=Cg0ArKJSzNAWHfO7O8S8EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=413&vt=11&dtpt=251&dett=3&cstd=157&cisv=r20220106.71303&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 10 Jan 2022 18:56:34 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 44FB 0
23 B 43ms
43ms Ping
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsu1ucA7HUWMV8Kq0bxZC3FClVbAvL4u_RVj2w7tPsyRw2TZ8ucMt21Nmk6aGxBRabDjfZ1lAC6ijwmmqxAZFkOMxqT81us5EWvbOeRCsMewAH_inFHnccsIqTb5omycjsbCLpN3kTllXy3LD0l9CA41Yx8BSvhhqbSTZnUruZi_-rx5dDb0KMDL-X3BNMDf0IZkpQWO0xGlrSulXjEbQJKRHtOwP36-E-Pnvair4zNb5BxAheWYQul26TOjLADhYp28_t3Ev2LEJ32fKjIn_MLPkbCtfvktJ2u_12B3nnQiW2nuruDZf9zZhsnL5CxWtGJjrt9jVlPua6at6JUFxpGU-GP5srG9PnFbB5JOfc2OwAUz6KskHX3HGsxeudywqEXtkc1V1UGZrjb18Gx501aEngLc8RcZXA57veemLA1BDuU5HUOq4HdSEs8zf7e9U_ypTSA5B2Ty6HbZKqmDWz2U4l315DAn8ST1f3_W-wr18887sKsJbzsp8h9M1bc2YkXHnMeU2xRO6nB6Ik_oqdS0MfwrgksZMsUwYts2N4dQU4uS3RqFTbf0UAXDPVvtMiBAusMV0XIGCHycW-VfxKWY-dvF2VN_HnR8X50_JXWb2RLoHX0dN3OLbBF1LSHxPfgK0I4e7cgIm6j4k7nPHHIQix5DQZ05uin4uLT-UIRm4Xnsh1oICbN_wdNBtGkWgXkK7zfECZ3io-Wzm2W1uCKvfWAARKyDd9SZOurRdVFfu1hZONF1ZEVCJVhdmNQLM2FNcku5VGIusyIfqfiuA0b7Bna1KLbafro_fmWRwKK6Ti-Vr7kxuszXBHiyRB3P1kRIc7klnefXy2JA3ik16c33hkQYloQRLU0HciEABmpJAHZOxR8snBheqiqTdMBDq_mu4iaJwhuiTWWzSNfDcJdjyEBiK3FzLD98-V-dYGJKV0kui7NvHN_U38Bok2ss6xLgoDhot1FwOUMMHrWXjuCnKiJLNy_A-o0juIdlOZHN3bpDJB3yDnAG604laQZaxkVJv3qsBZmYyOCniPJHQtvSauAiEw1oElj2BJTqFbTYS8RqnDKoR8kKHkdtcaZhSyszhewlj5J1vNVNHB2BdcZ3tfBYbROD1a2xQeI-iNKzC_4SjGxU-Nn4I9O3AXmI_IltSPgPHM81Gqbw&sai=AMfl-YTpdvUM4BC7OKvuoqpZ5hDtQgGlmaquuOiO6ADvUP_AfeB2mngrD-KW18oThwAU8_TTr0pcY5Y0b562URjPhpwQYlheUMdcRshGQUgc4ixZGJJRYrS3uK4MN27ZkQgQuoI_FT7RC48lWCo-l2IDMMFsFh-vK84mn37S8xY&sig=Cg0ArKJSzOLqqzF5dSweEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=424&vt=11&dtpt=265&dett=3&cstd=155&cisv=r20220106.26113&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 10 Jan 2022 18:56:34 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 1DDC 0
23 B 43ms
43ms Ping
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssKx3nVLNQ27hfx4ZeG2IzZEXzrQLPT6ZQHAcXFMVBnNwN95CVrsMKGp2pPv2InTp8fyRt4bXx9cXTtYLXjvQ4ZdptJf-A3KIA3grAJgl_DYYRFBzULmqTk8k9o4OWJ7vILhomDlXWeHlwSxMJjvQYtZo-XBuqXxulniqOwKpiPs2YAW1EGoRw1EqJHztPN-6kz83GUP1DKjZi0V-nIY22hTdj7lZ16kbe2Dnt_xvRUoDBTQE3zpH4tpqUjYLpTiU4B5AneVTvti_w3MV1f1JCTDHtqJsOFv4_W7LkXahYFjVjBcl8WpmFqLe-AIQr704GL-zSSqJc5_Ccybv_9KtpgmC-PSlb66MdkBXFBMu6lSvtvB6-VnDskkxdB-6bTgYDFys_y5oQoCEofCBwwzKNTOER3Kni3EiBmKNgLPix6aYvO6jg6eUkG-ydb-vgk9L_3cLnL7rn2vyRknTjAUDFpGGSwhtuRhG8wxfNWEnoyTtceqr080mR4OCvYpRDaqBa6QWc5hmRL6rszPG1rNdkk9fAh7Wh7cr6YZKbfhDiTBsFHF-RClCsjcNMDWEXf_eQpf8lLrqq1RnYws_gGitFdf2YERgdWFDiPGVKS_lFhapgwgzwJ5OnE-O7Tt7629dokB4ThKs1Mw5piQvsv-QNHt13J1IpBZNE_r40SjYrCCj5yVP3cUSrKavDYe0qGOScUTQNhL79RHgioPgtgvk0P1s3r5aLi9xqKQ6nqyLD4HfmTGNizVDCplp7JCRZAEjpICgIcQX07_b5x25Ly0TakkA_Xl5O9IeJTWtclt9oa8EmhbcAl_hHGbFZ7QW48O8bEDAHE63ovNbKT4wJavHVlAQ5CiBtpd4wWQEV2K8_1DDS6WdMV7-l9IJlf_DzesFvIMiLg12OlVTvH3Ks7goP0cD0yFX8tC4IWQFgYbnecEzocaCNUBpwjJhTLQMfqaeIFJLIdrMkZ2XuvTYK6-taMxiiTrKvKMl3rQ7uWWFeJjXiwyTeX0ADdvBCz-XYsvRX0Eh38Tju7QoPlPqEn3XlNc9MfZoFH4fxlue4dXS4DGhxr-TVRj4huoWQCMbYSKsLrqGY_GTXqoMQ5v4vz1Evnv5JTIqcjoZQ7-dQQcE_FW6IFy_mVOzxT_SC6s2l6V8UqTDQZVTlJ9pxHdft6NKcIi07-aoLF-Jccb4ZGEF5zdDIjWwjInNF1XA&sai=AMfl-YQGJ1sunVRSsAoeZXa2lqdmlS0FQtOIZa3KIa4njacX5TeLUkrjbxGI7VhKYSJlBlvvHkWidYWY63QZvoK9szTnoOtZoKuGdEcoIv3PlBAHD3XHehAtHQST8eaYfc6rniOPuo1DUM9w8488OLu3UQqHY9bupQ&sig=Cg0ArKJSzG27EtRpOZb_EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=467&vt=11&dtpt=376&dett=3&cstd=89&cisv=r20220106.86142&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 10 Jan 2022 18:56:34 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
DATA 200
OK truncated
/ Frame 37E1 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d456a4df06ffd4b7b0f176462d2d7df0b56d1297d8087415de0bd958b76b469c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 7891 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5feab046d6bdb6c7a0903328bc9fb2db2e4115f63aef76686208739217299443

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F0F9
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEAR5tGULyVCZXB4H1VM2spo&google_cver=1&google_push=AYg5qPLdWgQAxPNAJW8k91pVPG895KlP7nU4gMLjxh8FO9x1XAuVqlX9ks...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPLdWgQAxPNAJW8k91pVPG895KlP7nU4gMLjxh8FO9x1XAuVqlX9ksRLXyemZhhzvRVi2aRNk0KG-mNvXdpI-gQJoWMkYg0T&google_hm=956KXp...

170 B
188 B

50ms
49ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPLdWgQAxPNAJW8k91pVPG895KlP7nU4gMLjxh8FO9x1XAuVqlX9ksRLXyemZhhzvRVi2aRNk0KG-mNvXdpI-gQJoWMkYg0T&google_hm=956KXphtQvfT1mHDjsqW7Q

Requested by

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPLdWgQAxPNAJW8k91pVPG895KlP7nU4gMLjxh8FO9x1XAuVqlX9ksRLXyemZhhzvRVi2aRNk0KG-mNvXdpI-gQJoWMkYg0T&google_hm=956KXphtQvfT1mHDjsqW7Q
pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F0F9
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPJYANAm...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPJYANAm...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAxMTAxODU2MzUwMDAxMDI5MzA2NDEzMA%3D%3D&google_push=AYg5qPJYANAmJIdCf5nD7GgkmpKwJhiAa93HqXm75Ql4qCf5xSEa1IY8HCqUdrvwTY4QNT...

170 B
188 B

51ms
51ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAxMTAxODU2MzUwMDAxMDI5MzA2NDEzMA%3D%3D&google_push=AYg5qPJYANAmJIdCf5nD7GgkmpKwJhiAa93HqXm75Ql4qCf5xSEa1IY8HCqUdrvwTY4QNTUIyjKstygO1D9yGVYe_FjtBnb_ZXO0

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAxMTAxODU2MzUwMDAxMDI5MzA2NDEzMA%3D%3D&google_push=AYg5qPJYANAmJIdCf5nD7GgkmpKwJhiAa93HqXm75Ql4qCf5xSEa1IY8HCqUdrvwTY4QNTUIyjKstygO1D9yGVYe_FjtBnb_ZXO0
pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Mon, 10 Jan 2022 18:56:35 GMT

GET
H3 200 dds
rtb.openx.net/sync/ Frame F0F9 43 B
64 B 31ms
22ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEJWp5VnHw7CtfdmliMc-FU8&google_cver=1&google_push=AYg5qPJ02yb2MTVeqvxclgqgeD9_rrRAkeg4-vb_e1IWKN02QCThPROnMdrUihXeKEq3y0fL0xHVqr0nXPP7OKi8DgEjiXt0JGiE
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=250&slotname=0787847652&adk=665242438&adf=3866777003&pi=t.ma~as.0787847652&w=300&lmt=1641840994&psa=0&format=300x250&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641840991081&bpp=1&bdt=145&idt=3113&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dce6fdd0735d9541c%3AT%3D1641840993%3AS%3DALNI_MapIh1wIk4CQkuJU4LU2MggxokXJQ&prev_fmts=728x90%2C728x90&correlator=1873363329958&frm=20&pv=1&ga_vid=1762928891.1641840991&ga_sid=1641840991&ga_hid=1646229672&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1039&ady=1319&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063858&oid=2&pvsid=4150545889650970&pem=438&tmod=427&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeopEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=tyYckT3vCd&p=https%3A//zvonil.octo.net&dtd=3117
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: lo090o6t78dfbtm0gl4pnn8pca0mtsga

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F0F9
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=saYQRH9qTWyx8lQFjGb9Ag%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

51ms
50ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=saYQRH9qTWyx8lQFjGb9Ag%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIsqMBsjh2KShlAfwX0aPBKyo-Q95K-wnaqAFMlfOhpM1pukj42H_fQoLbpijeYgNbaum5HI4m5CQdHeozdfXH9DzbB_NxH

Requested by

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=saYQRH9qTWyx8lQFjGb9Ag%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIsqMBsjh2KShlAfwX0aPBKyo-Q95K-wnaqAFMlfOhpM1pukj42H_fQoLbpijeYgNbaum5HI4m5CQdHeozdfXH9DzbB_NxH
date: Mon, 10 Jan 2022 18:56:33 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F0F9
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEBU-nVPLJkGxLRzfXP6MB8g&google_cver=1&google_push=AYg5qPI87jCnW2sgr-SWQbRwNzCu1hmlIfL7EfXoxjPwci1QJks0Bq-P05VCFYjneU8MQjSDebu...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k5MVFKSzAtMUstSFRNMw==&google_push=AYg5qPI87jCnW2sgr-SWQbRwNzCu1hmlIfL7EfXoxjPwci1QJks0Bq-P05VCFYjneU8MQjSDebueRsFLuwiX7nUIIsZLDnCINHrT

170 B
188 B

49ms
49ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k5MVFKSzAtMUstSFRNMw==&google_push=AYg5qPI87jCnW2sgr-SWQbRwNzCu1hmlIfL7EfXoxjPwci1QJks0Bq-P05VCFYjneU8MQjSDebueRsFLuwiX7nUIIsZLDnCINHrT

Requested by

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k5MVFKSzAtMUstSFRNMw==&google_push=AYg5qPI87jCnW2sgr-SWQbRwNzCu1hmlIfL7EfXoxjPwci1QJks0Bq-P05VCFYjneU8MQjSDebueRsFLuwiX7nUIIsZLDnCINHrT
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame F0F9
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLV4ojadGJFY36AF-tXA-TOmpWgEu2R6WWgDSrjX7FUQRzHuLMWjxEqrlo4dQjOckfyDDw2FZioMW3_JoIds_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLV4ojadGJFY36AF-tXA-TOmpWgEu2R6WWgDSrjX7FUQRzHuLMWjxEqrlo4dQjOckfyDDw2FZioMW3_JoIds_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLV4ojadGJFY36AF-tXA-TOmpWgEu2R6WWgDSrjX7FUQRzHuLMWjxEqrlo4dQjOckfyDDw2FZioMW3_JoIds_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLV4ojadGJFY36AF-tXA-TOmpWgEu2R6WWgDSrjX7FUQRzHuLMWjxEqrlo4dQjOckfyDDw2FZioMW3_JoIds_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLV4ojadGJFY36AF-tXA-TOmpWgEu2R6WWgDSrjX7FUQRzHuLMWjxEqrlo4dQjOckfyDDw2FZioMW3_JoIds_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLV4ojadGJFY36AF-tXA-TOmpWgEu2R6WWgDSrjX7FUQRzHuLMWjxEqrlo4dQjOckfyDDw2FZioMW3_JoIds_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLV4ojadGJFY36AF-tXA-TOmpWgEu2R6WWgDSrjX7FUQRzHuLMWjxEqrlo4dQjOckfyDDw2FZioMW3_JoIds_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLV4ojadGJFY36AF-tXA-TOmpWgEu2R6WWgDSrjX7FUQRzHuLMWjxEqrlo4dQjOckfyDDw2FZioMW3_JoIds_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLV4ojadGJFY36AF-tXA-TOmpWgEu2R6WWgDSrjX7FUQRzHuLMWjxEqrlo4dQjOckfyDDw2FZioMW3_JoIds_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLV4ojadGJFY36AF-tXA-TOmpWgEu2R6WWgDSrjX7FUQRzHuLMWjxEqrlo4dQjOckfyDDw2FZioMW3_JoIds_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLV4ojadGJFY36AF-tXA-TOmpWgEu2R6WWgDSrjX7FUQRzHuLMWjxEqrlo4dQjOckfyDDw2FZioMW3_JoIds_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLV4ojadGJFY36AF-tXA-TOmpWgEu2R6WWgDSrjX7FUQRzHuLMWjxEqrlo4dQjOckfyDDw2FZioMW3_JoIds_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLV4ojadGJFY36AF-tXA-TOmpWgEu2R6WWgDSrjX7FUQRzHuLMWjxEqrlo4dQjOckfyDDw2FZioMW3_JoIds_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLV4ojadGJFY36AF-tXA-TOmpWgEu2R6WWgDSrjX7FUQRzHuLMWjxEqrlo4dQjOckfyDDw2FZioMW3_JoIds_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLV4ojadGJFY36AF-tXA-TOmpWgEu2R6WWgDSrjX7FUQRzHuLMWjxEqrlo4dQjOckfyDDw2FZioMW3_JoIds_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLV4ojadGJFY36AF-tXA-TOmpWgEu2R6WWgDSrjX7FUQRzHuLMWjxEqrlo4dQjOckfyDDw2FZioMW3_JoIds_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLV4ojadGJFY36AF-tXA-TOmpWgEu2R6WWgDSrjX7FUQRzHuLMWjxEqrlo4dQjOckfyDDw2FZioMW3_JoIds_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLV4ojadGJFY36AF-tXA-TOmpWgEu2R6WWgDSrjX7FUQRzHuLMWjxEqrlo4dQjOckfyDDw2FZioMW3_JoIds_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLV4ojadGJFY36AF-tXA-TOmpWgEu2R6WWgDSrjX7FUQRzHuLMWjxEqrlo4dQjOckfyDDw2FZioMW3_JoIds_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLV4ojadGJFY36AF-tXA-TOmpWgEu2R6WWgDSrjX7FUQRzHuLMWjxEqrlo4dQjOckfyDDw2FZioMW3_JoIds_...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F0F9
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEBFS3YX3Mab_b2tBIKARtbY&google_cver=1&google_push=AYg5qPK8L7fiOlq8msXBgiPd...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPK8L7fiOlq8msXBgiPdZZW6iE52dGKA_vtnsOzFE1z4LWXIRvXQupu7pb_uaXDKgAeJML7fFbVCUqAXqeQsbdoB_CrFy-xF7g&google_hm=

170 B
188 B

49ms
48ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPK8L7fiOlq8msXBgiPdZZW6iE52dGKA_vtnsOzFE1z4LWXIRvXQupu7pb_uaXDKgAeJML7fFbVCUqAXqeQsbdoB_CrFy-xF7g&google_hm=

Requested by

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPK8L7fiOlq8msXBgiPdZZW6iE52dGKA_vtnsOzFE1z4LWXIRvXQupu7pb_uaXDKgAeJML7fFbVCUqAXqeQsbdoB_CrFy-xF7g&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Sun, 09 Jan 2022 18:56:35 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame F0F9 0
12 B 15ms
14ms Image
text/html 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K8pogscNMLXgNQ1jiu-X4WRiV1AAwLotGEuy_s5x9OY__559xnKJtx2Lx4rvJRgD1kctHCRA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:34 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 120F
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEAR5tGULyVCZXB4H1VM2spo&google_cver=1&google_push=AYg5qPI78HoFKmPxuRBmtKwIMjYb_ONkmLoLGjz64kYQoEzuWeVEFehdx8...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPI78HoFKmPxuRBmtKwIMjYb_ONkmLoLGjz64kYQoEzuWeVEFehdx8M7WJlXsyfAdE1aM0xuTLoRqWU0d_ZyWr2QVr0F3oo&google_hm=956KXph...

170 B
188 B

53ms
52ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPI78HoFKmPxuRBmtKwIMjYb_ONkmLoLGjz64kYQoEzuWeVEFehdx8M7WJlXsyfAdE1aM0xuTLoRqWU0d_ZyWr2QVr0F3oo&google_hm=956KXphtQvfT1mHDjsqW7Q

Requested by

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPI78HoFKmPxuRBmtKwIMjYb_ONkmLoLGjz64kYQoEzuWeVEFehdx8M7WJlXsyfAdE1aM0xuTLoRqWU0d_ZyWr2QVr0F3oo&google_hm=956KXphtQvfT1mHDjsqW7Q
pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 120F
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPIlo17vy4s-1eXZGMUTUSfdR8ESU1NgtFK27k8...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWR5QllnQUFCS2N2RlV1TQ&google_push=AYg5qPIlo17vy4s-1eXZGMUTUSfdR8ESU1NgtFK27k8Feno5a7YEF4046gRNxkXWYIbNbdTn_V62aJAxXvMljamoEghKX8K5D-Q

170 B
188 B

49ms
48ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWR5QllnQUFCS2N2RlV1TQ&google_push=AYg5qPIlo17vy4s-1eXZGMUTUSfdR8ESU1NgtFK27k8Feno5a7YEF4046gRNxkXWYIbNbdTn_V62aJAxXvMljamoEghKX8K5D-Q

Requested by

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWR5QllnQUFCS2N2RlV1TQ&google_push=AYg5qPIlo17vy4s-1eXZGMUTUSfdR8ESU1NgtFK27k8Feno5a7YEF4046gRNxkXWYIbNbdTn_V62aJAxXvMljamoEghKX8K5D-Q
Date: Mon, 10 Jan 2022 18:56:34 GMT
Server: Apache
Connection: keep-alive
Content-Length: 390
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame 120F 43 B
324 B 34ms
16ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEMOehyQPgRy3wKhLV40GkFE&google_push=AYg5qPJ4jmvAD5RMUgZIic_r8CfXzTul7Yd-UMrQS-cuuqyhcDUuYHiUXl_Q5JeitaTdp0E_T3Iz1DScED1nGLcOO4u_4LtyW-M&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=7096521402&adk=2342716466&adf=3252783458&pi=t.ma~as.7096521402&w=728&lmt=1641840994&psa=0&format=728x90&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641840991080&bpp=1&bdt=145&idt=3108&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dce6fdd0735d9541c%3AT%3D1641840993%3AS%3DALNI_MapIh1wIk4CQkuJU4LU2MggxokXJQ&prev_fmts=728x90&correlator=1873363329958&frm=20&pv=1&ga_vid=1762928891.1641840991&ga_sid=1641840991&ga_hid=1646229672&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=1133&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063858&oid=2&pvsid=4150545889650970&pem=438&tmod=427&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=cZVS1rX0el&p=https%3A//zvonil.octo.net&dtd=3112
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 dds
rtb.openx.net/sync/ Frame 120F 43 B
64 B 25ms
18ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEJWp5VnHw7CtfdmliMc-FU8&google_cver=1&google_push=AYg5qPKTAoXfvjSK6EMMyPOtF_C9a7enf8clU7d-17gnLZDXX_zCcbbsYJ40ofmDpqKBK2C_fALZPk9o0ipTOE3F6BgXcUvZQLo
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=7096521402&adk=2342716466&adf=3252783458&pi=t.ma~as.7096521402&w=728&lmt=1641840994&psa=0&format=728x90&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641840991080&bpp=1&bdt=145&idt=3108&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dce6fdd0735d9541c%3AT%3D1641840993%3AS%3DALNI_MapIh1wIk4CQkuJU4LU2MggxokXJQ&prev_fmts=728x90&correlator=1873363329958&frm=20&pv=1&ga_vid=1762928891.1641840991&ga_sid=1641840991&ga_hid=1646229672&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=1133&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063858&oid=2&pvsid=4150545889650970&pem=438&tmod=427&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=cZVS1rX0el&p=https%3A//zvonil.octo.net&dtd=3112
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: huq5i1t93viimisups4dq2iflsi28qo7

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 120F
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=saYQRH9qTWyx8lQFjGb9Ag%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

49ms
49ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=saYQRH9qTWyx8lQFjGb9Ag%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJN0Ncym5RSqzkri8CvdM_B3e6Wf9h_TEpb-SBw6UB1nfy9FWHCccbw_1c0wtNsAJchDzk0PWklCrQTuK5ptkfA_zol3hY

Requested by

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=saYQRH9qTWyx8lQFjGb9Ag%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJN0Ncym5RSqzkri8CvdM_B3e6Wf9h_TEpb-SBw6UB1nfy9FWHCccbw_1c0wtNsAJchDzk0PWklCrQTuK5ptkfA_zol3hY
date: Mon, 10 Jan 2022 18:56:33 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 120F
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEBU-nVPLJkGxLRzfXP6MB8g&google_cver=1&google_push=AYg5qPKBgaDHdVc2hovpZ8-QMwz6qbgIZV2Lazqf8Dsi6wzhK1bzLaVE59s9R8WrF3Se5g_bhG5...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k5MVFKSzItRi1BUUFH&google_push=AYg5qPKBgaDHdVc2hovpZ8-QMwz6qbgIZV2Lazqf8Dsi6wzhK1bzLaVE59s9R8WrF3Se5g_bhG5TKKeLDFYVbxykmYGkMrUGzMM

170 B
188 B

50ms
49ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k5MVFKSzItRi1BUUFH&google_push=AYg5qPKBgaDHdVc2hovpZ8-QMwz6qbgIZV2Lazqf8Dsi6wzhK1bzLaVE59s9R8WrF3Se5g_bhG5TKKeLDFYVbxykmYGkMrUGzMM

Requested by

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k5MVFKSzItRi1BUUFH&google_push=AYg5qPKBgaDHdVc2hovpZ8-QMwz6qbgIZV2Lazqf8Dsi6wzhK1bzLaVE59s9R8WrF3Se5g_bhG5TKKeLDFYVbxykmYGkMrUGzMM
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 120F
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLMshohvZzt9SlrbNj8Ec_qwYeWzp0UIoBULeUxnNGBfqQMkKVbYNXuzE0fJsp0TENZejmYLbTzz87jgJ59yp...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLMshohvZzt9SlrbNj8Ec_qwYeWzp0UIoBULeUxnNGBfqQMkKVbYNXuzE0fJsp0TENZejmYLbTzz87jgJ59yp...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLMshohvZzt9SlrbNj8Ec_qwYeWzp0UIoBULeUxnNGBfqQMkKVbYNXuzE0fJsp0TENZejmYLbTzz87jgJ59yp...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLMshohvZzt9SlrbNj8Ec_qwYeWzp0UIoBULeUxnNGBfqQMkKVbYNXuzE0fJsp0TENZejmYLbTzz87jgJ59yp...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLMshohvZzt9SlrbNj8Ec_qwYeWzp0UIoBULeUxnNGBfqQMkKVbYNXuzE0fJsp0TENZejmYLbTzz87jgJ59yp...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLMshohvZzt9SlrbNj8Ec_qwYeWzp0UIoBULeUxnNGBfqQMkKVbYNXuzE0fJsp0TENZejmYLbTzz87jgJ59yp...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLMshohvZzt9SlrbNj8Ec_qwYeWzp0UIoBULeUxnNGBfqQMkKVbYNXuzE0fJsp0TENZejmYLbTzz87jgJ59yp...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLMshohvZzt9SlrbNj8Ec_qwYeWzp0UIoBULeUxnNGBfqQMkKVbYNXuzE0fJsp0TENZejmYLbTzz87jgJ59yp...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLMshohvZzt9SlrbNj8Ec_qwYeWzp0UIoBULeUxnNGBfqQMkKVbYNXuzE0fJsp0TENZejmYLbTzz87jgJ59yp...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLMshohvZzt9SlrbNj8Ec_qwYeWzp0UIoBULeUxnNGBfqQMkKVbYNXuzE0fJsp0TENZejmYLbTzz87jgJ59yp...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLMshohvZzt9SlrbNj8Ec_qwYeWzp0UIoBULeUxnNGBfqQMkKVbYNXuzE0fJsp0TENZejmYLbTzz87jgJ59yp...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLMshohvZzt9SlrbNj8Ec_qwYeWzp0UIoBULeUxnNGBfqQMkKVbYNXuzE0fJsp0TENZejmYLbTzz87jgJ59yp...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLMshohvZzt9SlrbNj8Ec_qwYeWzp0UIoBULeUxnNGBfqQMkKVbYNXuzE0fJsp0TENZejmYLbTzz87jgJ59yp...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLMshohvZzt9SlrbNj8Ec_qwYeWzp0UIoBULeUxnNGBfqQMkKVbYNXuzE0fJsp0TENZejmYLbTzz87jgJ59yp...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLMshohvZzt9SlrbNj8Ec_qwYeWzp0UIoBULeUxnNGBfqQMkKVbYNXuzE0fJsp0TENZejmYLbTzz87jgJ59yp...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLMshohvZzt9SlrbNj8Ec_qwYeWzp0UIoBULeUxnNGBfqQMkKVbYNXuzE0fJsp0TENZejmYLbTzz87jgJ59yp...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLMshohvZzt9SlrbNj8Ec_qwYeWzp0UIoBULeUxnNGBfqQMkKVbYNXuzE0fJsp0TENZejmYLbTzz87jgJ59yp...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLMshohvZzt9SlrbNj8Ec_qwYeWzp0UIoBULeUxnNGBfqQMkKVbYNXuzE0fJsp0TENZejmYLbTzz87jgJ59yp...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLMshohvZzt9SlrbNj8Ec_qwYeWzp0UIoBULeUxnNGBfqQMkKVbYNXuzE0fJsp0TENZejmYLbTzz87jgJ59yp...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_push=AYg5qPLMshohvZzt9SlrbNj8Ec_qwYeWzp0UIoBULeUxnNGBfqQMkKVbYNXuzE0fJsp0TENZejmYLbTzz87jgJ59yp...

0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 120F 0
12 B 20ms
19ms Image
text/html 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LikLapstn-rRq7T-pnTxCqR3dSRP47Egin4_HfWMkqrC6MFXCjD7lmV9KWr9QxQRIjI33f

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:34 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 OnAir-Bold.woff2
s0.2mdn.net/creatives/assets/4140742/ Frame 612B 47 KB
47 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4140742/OnAir-Bold.woff2

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c284299aeec8595fd3a10dcd2c27022edfda37c815571843a90c45cad18ace95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/16062795329522630656/300x600.html?e=69&leftOffset=0&topOffset=0&c=sSN0U8XuLz&t=1&renderingType=2
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:44:53 GMT
x-content-type-options: nosniff
age: 701
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47676
x-xss-protection: 0
last-modified: Thu, 06 May 2021 11:38:39 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 10 Jan 2022 18:59:53 GMT

GET
H3 200 OnAir-Regular.woff2
s0.2mdn.net/creatives/assets/4140742/ Frame 612B 47 KB
47 KB 11ms
11ms Font
font/woff2 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4140742/OnAir-Regular.woff2

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c110419995948214e5b16d9d0df8f7d91536cc42783edd90c7fc1810308309ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/16062795329522630656/300x600.html?e=69&leftOffset=0&topOffset=0&c=sSN0U8XuLz&t=1&renderingType=2
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:48:56 GMT
x-content-type-options: nosniff
age: 458
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47848
x-xss-protection: 0
last-modified: Thu, 06 May 2021 11:38:29 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 10 Jan 2022 19:03:56 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 612B 6 KB
4 KB 44ms
22ms XHR
application/json 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_245&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2b715976f1660e84fdb158ce024b6c200e52f0945e5c93acee0fcfb8eb99cefd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 10 Jan 2022 18:56:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4551
x-xss-protection: 0

GET
H3 200 60005582_20210602065029322_300x600_LOOK-01.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 612B 9 KB
10 KB 8ms
8ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20210602065029322_300x600_LOOK-01.png

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0c38ae3f32ceb41b6e8a0538a5183ccf8a3af48b59a16e7cbf378c72ffae0c90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16062795329522630656/300x600.html?e=69&leftOffset=0&topOffset=0&c=sSN0U8XuLz&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 09 Jan 2022 23:00:43 GMT
x-content-type-options: nosniff
age: 71751
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9714
x-xss-protection: 0
last-modified: Wed, 02 Jun 2021 13:50:29 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 10 Jan 2022 23:00:43 GMT

GET
H3 200 60005582_20210602065032561_300x600_LOOK-02.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 612B 10 KB
10 KB 9ms
8ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20210602065032561_300x600_LOOK-02.png

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2bf0b868b823fbe18aa7789527690ba3de4dd4a5f7ae02c754efd4735108091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16062795329522630656/300x600.html?e=69&leftOffset=0&topOffset=0&c=sSN0U8XuLz&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 02:32:09 GMT
x-content-type-options: nosniff
age: 59065
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9732
x-xss-protection: 0
last-modified: Wed, 02 Jun 2021 13:50:32 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 11 Jan 2022 02:32:09 GMT

GET
H3 200 60005582_20210507060843268_Asset_Transparent.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 612B 2 KB
2 KB 10ms
9ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20210507060843268_Asset_Transparent.png

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f741883eafc84067b80014e53fbfab2505aca4f7cf767b17404a291fffb79d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16062795329522630656/300x600.html?e=69&leftOffset=0&topOffset=0&c=sSN0U8XuLz&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 09 Jan 2022 19:54:54 GMT
x-content-type-options: nosniff
age: 82900
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2040
x-xss-protection: 0
last-modified: Fri, 07 May 2021 13:08:43 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 10 Jan 2022 19:54:54 GMT

GET
H/1.1 200
OK postview.gif
portal.o2online.de/nws/img/ Frame 612B 43 B
609 B 35ms
11ms Image
image/gif 82.113.101.132
TDDE-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://portal.o2online.de/nws/img/postview.gif?partnerId=O2_DSP_TRA_HAV_14114_PV&mediacode=26952494_4307561_323354094_100516637_-0&ref=26952494_4307561_323354094_100516637_-0
Requested by: Host: zvonil.octo.net
URL: https://zvonil.octo.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 82.113.101.132 Obertshausen, Germany, ASN6805 (TDDE-ASN1, DE),
Reverse DNS: portal.o2online.de
Software: Apache /
Resource Hash: e46eb58f99814c32c849b97a268129ddb14ca88e9070964ee75a2cd987c66839

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 10 Jan 2022 18:56:34 GMT
Last-Modified: Wed, 26 Aug 2020 10:11:24 GMT
Server: Apache
ETag: "2b-5adc50abeeb00"
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Connection: close
Accept-Ranges: bytes
Content-Type: image/gif
Content-Length: 43

GET
H3 200 CodeProLCW05-Regular.woff
s0.2mdn.net/creatives/assets/2560291/ Frame A39C 52 KB
52 KB 13ms
12ms Font
font/woff 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/2560291/CodeProLCW05-Regular.woff

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65ec5e0481c4ceacde8c5e8fab9d5305fc68496b8c75d7d58fb0e91feaf7f598

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/9747004193402519552/728x090.html?e=69&leftOffset=0&topOffset=0&c=fDhiPuxYL2&t=1&renderingType=2
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:52:15 GMT
x-content-type-options: nosniff
age: 259
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52901
x-xss-protection: 0
last-modified: Thu, 10 Sep 2020 12:12:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 10 Jan 2022 19:07:15 GMT

GET
H3 200 CodeProBoldLCW05-Regular.woff
s0.2mdn.net/creatives/assets/2560291/ Frame A39C 48 KB
48 KB 8ms
7ms Font
font/woff 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/2560291/CodeProBoldLCW05-Regular.woff

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92426eb5437b357b9046670556ba89baa8384edcc8734f56b813745bdb9e1cc6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/9747004193402519552/728x090.html?e=69&leftOffset=0&topOffset=0&c=fDhiPuxYL2&t=1&renderingType=2
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:52:49 GMT
x-content-type-options: nosniff
age: 225
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49198
x-xss-protection: 0
last-modified: Thu, 10 Sep 2020 12:11:57 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 10 Jan 2022 19:07:49 GMT

GET
H3 200 60005582_20210507060843268_Asset_Transparent.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame A39C 2 KB
2 KB 7ms
6ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20210507060843268_Asset_Transparent.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9747004193402519552/728x090.html?e=69&leftOffset=0&topOffset=0&c=fDhiPuxYL2&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f741883eafc84067b80014e53fbfab2505aca4f7cf767b17404a291fffb79d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9747004193402519552/728x090.html?e=69&leftOffset=0&topOffset=0&c=fDhiPuxYL2&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 09 Jan 2022 19:54:54 GMT
x-content-type-options: nosniff
age: 82900
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2040
x-xss-protection: 0
last-modified: Fri, 07 May 2021 13:08:43 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 10 Jan 2022 19:54:54 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame A39C 6 KB
4 KB 23ms
22ms XHR
application/json 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c51b50cba12252e1ef494c289e94b45093e6303cab1de4b7d40e566d08e70d5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 10 Jan 2022 18:56:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4504
x-xss-protection: 0

GET
H3 200 60005582_20211005060058845_STANDARD_728x090_LOOK-02.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame A39C 4 KB
4 KB 9ms
8ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20211005060058845_STANDARD_728x090_LOOK-02.png

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e74a4648c837c537132e658bcc2a76286d8dbd4c4e3bea40988ad8eef50dabd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9747004193402519552/728x090.html?e=69&leftOffset=0&topOffset=0&c=fDhiPuxYL2&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 06:14:17 GMT
x-content-type-options: nosniff
age: 45737
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4138
x-xss-protection: 0
last-modified: Tue, 05 Oct 2021 13:00:58 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 11 Jan 2022 06:14:17 GMT

GET
H/1.1 200
OK postview.gif
portal.blau.de/nws/img/ Frame A39C 43 B
616 B 40ms
9ms Image
image/gif 82.113.101.236
TDDE-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://portal.blau.de/nws/img/postview.gif?partnerId=BLU_DSP_TRA_HAV_34114_PV&mediacode=26952485_4307561_323347787_154735167_PO1303A&ref=26952485_4307561_323347787_154735167_PO1303A
Requested by: Host: zvonil.octo.net
URL: https://zvonil.octo.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 82.113.101.236 Obertshausen, Germany, ASN6805 (TDDE-ASN1, DE),
Reverse DNS: portal.blau.de
Software: Apache /
Resource Hash: e46eb58f99814c32c849b97a268129ddb14ca88e9070964ee75a2cd987c66839

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 10 Jan 2022 18:56:35 GMT
Last-Modified: Wed, 26 Aug 2020 10:11:24 GMT
Server: Apache
ETag: "2b-5adc50abeeb00"
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Connection: close
Accept-Ranges: bytes
Content-Type: image/gif
Content-Length: 43

GET
H3 200 default.css
as.ad4m.at/ad/style/0.1.18/one-ad/ Frame ECC5 81 KB
11 KB 51ms
33ms Stylesheet
text/css 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://as.ad4m.at/ad/style/0.1.18/one-ad/default.css

Requested by

Host: as.ad4m.at
URL: https://as.ad4m.at/ad/dr?ed=1jd43kbsaygz9zdcf69j8gfac3kjt91j8s606ea0keww1f73xa2je76kbnagjey7qt1vtk2kp8t86a5kf0dw1fvxxh3t1vkwv54q347cmqnng4f22sxjbjeyntqt1dn69c8mca10jgway49zt648e65x1qgrg8zgprxyeqfshg1k7qnmxyb1yvjzm3qmqz7y9q3vyh5cd1mv45d9r9va0qy8e10psv8a14w2h0hwz85c426ts75852n47f5q8xwn6tf8xt0cm46tjsbwee3g3xvvq1wdk2vyd8971c9mpkjf1qcbgw2q0mehkyaw2h34d5c2gg1zfcpcv30z9jtsarkp3b6kxhmkmgnz7e01qqn09k6maqrfcgaxn58ecwqzv9fv4f5xvsrkexebawq9yxqqm7nf7egw5ryc1sa84s64ja6dz1tmg&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCmheAYoHcYeHzDs-JiQbS4q6ICZDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQJeJQrmqPuyPqgDAaoEyQFP0NxSdZeeTExkgWPitZqixMwE86hW8nIaVVf-Wp7a1uZXqw3noJ66w82HtQrBmB5WwEwz09if_TcbGKEyXgMPhv7l1Cmqo9ra3nxDh6rz9Rz9vbU_lVp89sQFeWc4RECSRGnECDC1SpgsB_6lQEvZIY0KmMCulVNlWu0Auersl7IB9imDrg6i3PiM6y97a4PRJ-SNrp3Oes0fjy0ESqvjgDCH0zwDZNrIbJAWXJwvILGXQCYRxbDsvDHJuKcqjnJUrp4JHFFz-_KABry2mfOd_o_LMaAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_3zykky8NkaC4naf844LOUCHczl4g%26client%3Dca-pub-2979533909392588%26adurl%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0442de55e3838ce2b8cfca9a7ad2a6bcecfd94844453c13b38d7a9f1d31944b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://as.ad4m.at/ad/dr?ed=1jd43kbsaygz9zdcf69j8gfac3kjt91j8s606ea0keww1f73xa2je76kbnagjey7qt1vtk2kp8t86a5kf0dw1fvxxh3t1vkwv54q347cmqnng4f22sxjbjeyntqt1dn69c8mca10jgway49zt648e65x1qgrg8zgprxyeqfshg1k7qnmxyb1yvjzm3qmqz7y9q3vyh5cd1mv45d9r9va0qy8e10psv8a14w2h0hwz85c426ts75852n47f5q8xwn6tf8xt0cm46tjsbwee3g3xvvq1wdk2vyd8971c9mpkjf1qcbgw2q0mehkyaw2h34d5c2gg1zfcpcv30z9jtsarkp3b6kxhmkmgnz7e01qqn09k6maqrfcgaxn58ecwqzv9fv4f5xvsrkexebawq9yxqqm7nf7egw5ryc1sa84s64ja6dz1tmg&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCmheAYoHcYeHzDs-JiQbS4q6ICZDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQJeJQrmqPuyPqgDAaoEyQFP0NxSdZeeTExkgWPitZqixMwE86hW8nIaVVf-Wp7a1uZXqw3noJ66w82HtQrBmB5WwEwz09if_TcbGKEyXgMPhv7l1Cmqo9ra3nxDh6rz9Rz9vbU_lVp89sQFeWc4RECSRGnECDC1SpgsB_6lQEvZIY0KmMCulVNlWu0Auersl7IB9imDrg6i3PiM6y97a4PRJ-SNrp3Oes0fjy0ESqvjgDCH0zwDZNrIbJAWXJwvILGXQCYRxbDsvDHJuKcqjnJUrp4JHFFz-_KABry2mfOd_o_LMaAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_3zykky8NkaC4naf844LOUCHczl4g%26client%3Dca-pub-2979533909392588%26adurl%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:35 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
age: 622845
cross-origin-embedder-policy: unsafe-none
cf-polished: origSize=83581
surrogate-control: no-store
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=86400; includeSubDomains; preload
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: same-origin
expires: 0
last-modified: Mon, 03 Jan 2022 13:55:50 GMT
server: cloudflare
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-download-options: noopen
report-to: {"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cache-control: max-age=3600, must-revalidate, proxy-revalidate
cf-ray: 6cb8204adec05bf5-FRA
cf-bgj: minify

GET
H2 200 r62eglto.js Show response
ad4m.at/ Frame ECC5 36 KB
13 KB 49ms
48ms Script
application/javascript 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/r62eglto.js
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/dr?ed=1jd43kbsaygz9zdcf69j8gfac3kjt91j8s606ea0keww1f73xa2je76kbnagjey7qt1vtk2kp8t86a5kf0dw1fvxxh3t1vkwv54q347cmqnng4f22sxjbjeyntqt1dn69c8mca10jgway49zt648e65x1qgrg8zgprxyeqfshg1k7qnmxyb1yvjzm3qmqz7y9q3vyh5cd1mv45d9r9va0qy8e10psv8a14w2h0hwz85c426ts75852n47f5q8xwn6tf8xt0cm46tjsbwee3g3xvvq1wdk2vyd8971c9mpkjf1qcbgw2q0mehkyaw2h34d5c2gg1zfcpcv30z9jtsarkp3b6kxhmkmgnz7e01qqn09k6maqrfcgaxn58ecwqzv9fv4f5xvsrkexebawq9yxqqm7nf7egw5ryc1sa84s64ja6dz1tmg&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCmheAYoHcYeHzDs-JiQbS4q6ICZDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQJeJQrmqPuyPqgDAaoEyQFP0NxSdZeeTExkgWPitZqixMwE86hW8nIaVVf-Wp7a1uZXqw3noJ66w82HtQrBmB5WwEwz09if_TcbGKEyXgMPhv7l1Cmqo9ra3nxDh6rz9Rz9vbU_lVp89sQFeWc4RECSRGnECDC1SpgsB_6lQEvZIY0KmMCulVNlWu0Auersl7IB9imDrg6i3PiM6y97a4PRJ-SNrp3Oes0fjy0ESqvjgDCH0zwDZNrIbJAWXJwvILGXQCYRxbDsvDHJuKcqjnJUrp4JHFFz-_KABry2mfOd_o_LMaAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_3zykky8NkaC4naf844LOUCHczl4g%26client%3Dca-pub-2979533909392588%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b98c8f3aa7cc2835be32fd3a1488ba31a3de35a3fa0dd643a092c2846c613017

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-goog-hash: crc32c=i2G9+Q==, md5=KT4B161Aam0qyQ5N1n+FMQ==
date: Mon, 10 Jan 2022 18:56:35 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 14430
x-guploader-uploadid: ADPycdtXvXkNTikigjdIbYNhxiQLD-4AZAv9bzOL91Gi0Vasqu-NthMEIEUtuuiuVaKDT9UyXdL8EGeHFPeRkpk5qsfqo-CjnA
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
cf-bgj: minify
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Tue, 02 Nov 2021 14:54:41 GMT
server: cloudflare
etag: W/"293e01d7ad406a6d2ac90e4dd67f8531"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QY3aQRSBnFFTBNaI%2BHCKtlZ2Ko6Mw4jnxugWbecGcdfGro3Dn4BKkSEE4eCmaUOYvOyxFceTLA1uy0EKu8AL5nhY%2Beoa5X0i6ApV%2B1NV%2BvVQy2%2BaFPbwFEFDZIO88UyOHN06PmQ%3D"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1635864881199576
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=3600, must-revalidate, stale-while-revalidate=300
x-goog-stored-content-length: 11933
cf-ray: 6cb8204ac9a959a1-MXP
expires: Mon, 10 Jan 2022 14:56:05 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220106/r20110914/client/ Frame 68F2 2 KB
1 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220106/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=4170394609&adk=2715274491&adf=2671285577&pi=t.ma~as.4170394609&w=728&lmt=1641840994&psa=0&format=728x90&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641840991077&bpp=3&bdt=141&idt=3097&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dce6fdd0735d9541c%3AT%3D1641840993%3AS%3DALNI_MapIh1wIk4CQkuJU4LU2MggxokXJQ&correlator=1873363329958&frm=20&pv=2&ga_vid=1762928891.1641840991&ga_sid=1641840991&ga_hid=1646229672&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=477&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063858&oid=2&pvsid=4150545889650970&pem=438&tmod=427&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=FgoanG4k2O&p=https%3A//zvonil.octo.net&dtd=3108

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:39:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8243
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 16:39:12 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 68F2 120 KB
37 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e78bac7c2d4ad157ca2d43d12d1cdc08ab7943d3535287108ed9e6b8ff9da523

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37632
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641385868096614"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 10 Jan 2022 18:56:35 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220106/r20110914/client/ Frame 68F2 15 KB
6 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220106/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d847a2b472bb4f98a901aecde2461eba0d47978d1ee4c0e386e3ee299e8ed96b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:39:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8243
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 10427043382315408254
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 16:39:12 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 68F2 0
0 47ms
46ms Fetch
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=ClX0IYoHcYeXCDaCf7_UPu6-K2ATJntKxXNWdkfdwwI23ARABIABglQKCARdjYS1wdWItMjk3OTUzMzkwOTM5MjU4OKAB1bbS6gPIAQmpAhLw3Kgi_rI-qAMBqgS6AU_QK1vV1XTWVuCtDuzTDA86LBahSVd7BcWP2ILca-P9hfTVslAk_fm8X9vnWZNvCCXmwXtqGm0HXe7Vyohia3sJ_9SAFviLYwiET38MXbcixhNFCPqm7JVn9Itpq3Q4i8R0chCqrP4f0lc6bSDnMwFW2yUVJ_yzHIF9KyzhLDbf1EbUnQOntK81Va4ca1uHhawYvaV13SbFxi1rQtULii1nGlBKTa_X9NrPX9ebR3WQRlcYtmuMTWPIoYAG1KCKy6SbqKNsoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAGACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItMjk3OTUzMzkwOTM5MjU4OBgA&sigh=mTWwaBwKpHY&uach_m=[UACH]&cid=CAQSPACNIrLMwkiRyle7Fw5-3CLztjsLm6EyyopkoBxJ_g5q3oBDdf1v-1Cbh83bzZEmeZr4mlK5p9y-UWyiYhgB

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=4170394609&adk=2715274491&adf=2671285577&pi=t.ma~as.4170394609&w=728&lmt=1641840994&psa=0&format=728x90&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641840991077&bpp=3&bdt=141&idt=3097&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dce6fdd0735d9541c%3AT%3D1641840993%3AS%3DALNI_MapIh1wIk4CQkuJU4LU2MggxokXJQ&correlator=1873363329958&frm=20&pv=2&ga_vid=1762928891.1641840991&ga_sid=1641840991&ga_hid=1646229672&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=477&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063858&oid=2&pvsid=4150545889650970&pem=438&tmod=427&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=FgoanG4k2O&p=https%3A//zvonil.octo.net&dtd=3108
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 10 Jan 2022 18:56:35 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.fr.eu.criteo.com/google/auction/ Frame 68F2 0
0 21ms
20ms Fetch 2a02:2638::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.fr.eu.criteo.com/google/auction/notify?profile=14&payload=UOb8EN6BMNgFWp2DYgICAAAA6tM_jvcn4xUQYYHcYWFIGV7dpmhQC8rJABI&wp=YdyBYgADYWUIu8-gAAKXu5F7sAK-v1V4IBtZpQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:34 GMT
server: Kestrel
server-processing-duration-in-ticks: 196467
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 86AE 165 KB
53 KB 161ms
123ms Document
text/html 2a02:2638::18
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=YdyBYgADYWUIu8-gAAKXu5F7sAK-v1V4IBtZpQ&u=%7CdUT6sJtqYKkO3gEoEWePaw2WbFJkAqOQm0cD%2BMriXs8%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_AM8iEE4GHx4XAZ8-c9e5LlJfMjehYPJbM0j2hknANCpNfsuV4bKOZdERZwsUOl74YTlNh2oC0QHYqH2C3c2Eq_Qgi-OOOvPAkgbbkf2B9x2QcFreXPZ_EJtSgHjheHiHnZdgQ9NCBZ_l2-eKFg2DGu7sD7-ABUMSF5Qm_opuL4mekuZrLdfEXy-EVmaC7tCIQ6nYjv4Wu1DeFN7wEOcwl8ggASSwz7k2suTIJ63u8DBaKg4i7y9ckEiF49TliMNLd1-dGUjLIetXcZbJ99-MavXPt_XUrGnBCSx4b_Rca44YiykLXocTWZh7PgprGr_IUo443YxL3TqEKEBt5VcpetZs_-scwuvDVEL2kwddx4lAtIL5CB4ln1UPlrbHsgUp3en3u0KGHyVDEvbKT7s8dvSGy1JJxVzVKq8vxMCxxYVmo-LYNjbdgwLOpgnOh6TBV&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCwjUoYoHcYeXCDaCf7_UPu6-K2ATJntKxXNWdkfdwwI23ARABIABglQKCARdjYS1wdWItMjk3OTUzMzkwOTM5MjU4OKAB1bbS6gPIAQmpAhLw3Kgi_rI-qAMBqgS9AU_QK1vV1XTWVuCtDuzTDA86LBahSVd7BcWP2ILca-P9hfTVslAk_fm8X9vnWZNvCCXmwXtqGm0HXe7Vyohia3sJ_9SAFviLYwiET38MXbcixhNFCPqm7JVn9Itpq3Q4i8R0chCqrP4f0lc6bSDnMwFW2yUVJ_yzHIF9KyzhLDbf1EbUnQOntK81Va4ca1uHhawYvaU33wdXQaL3UWqXno63J_ayRLvdQtDhR1Uvj0g2tOgGmnMJ5-fbHvl1e4AG1KCKy6SbqKNsoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2DScX8r2jwNQddTrdJP_bDP7vjCg%26client%3Dca-pub-2979533909392588%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::18 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

239773293963c28947ba84ffa0e0df4b2d1b5ebb5820793f3aaab731f04ad66e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

date: Mon, 10 Jan 2022 18:56:34 GMT
content-type: text/html
server: Kestrel
cache-control: private, max-age=0, no-cache
pragma: no-cache
expires: Mon, 26 Jul 1997 05:00:00 GMT
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cross-origin-resource-policy: cross-origin
p3p: CP='CUR ADM OUR NOR STA NID'
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=WGC6o9iuH0A_m3V4KYmxAAG6pdDMLWWYYbrjzog7Xa1q5oa8h20RHR-rrXpObGvaZj8mffhevR3A0J_rwtyI2kCkdVvQqbHVGaL28Tp-qlPhAo0SIy_mEcXqBWg1jkc2ch0MiU88NPgNYErsbHDESzxV-ZfYdcGCi6J1xencG1dDdNkfU3MqXosbTLlRW8shns_vm0UBbyqb4Fp5JpSf2lm5aRZ1g3zDi95Wf4TzGwcdeE0dRWwkOkvmkEU4JDoKcgRlvA"}], "max_age": 86400}
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
server-processing-duration-in-ticks: 92934160
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame E64D 1 KB
749 B 7ms
7ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 10 Jan 2022 13:26:12 GMT
expires: Tue, 11 Jan 2022 13:26:12 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 19823
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 612B 17 KB
6 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 10 Jan 2022 18:56:35 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame A39C 17 KB
6 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 10 Jan 2022 18:56:35 GMT

GET
H2 200 adchoices_default.png
static-de.ad4mat.net/ads/img/ad_markers_folder/ Frame ECC5 3 KB
4 KB 72ms
30ms Image
image/png 2606:4700:20::681a:61b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static-de.ad4mat.net/ads/img/ad_markers_folder/adchoices_default.png
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/style/0.1.18/one-ad/default.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:61b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2eeaed1b310e214596abec926291c1a41c6333ddaeac312886fc0b5930d71f0e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-goog-hash: crc32c=v7nNsg==, md5=eUyE0w4hPsahRNZCFfB1UQ==
date: Mon, 10 Jan 2022 18:56:35 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3343309
x-guploader-uploadid: ADPycds9UegxUXswK4RzZzF6mXDfQy_y0GHXQmo_7EYAAHyEQ16keq-zOTSqb6YP04oikMtdLFTYNybr6iTpruHRyi30S7TEFw
x-goog-storage-class: STANDARD
x-goog-custom-time: 1970-01-01T00:00:00Z
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 3262
x-goog-meta-
last-modified: Wed, 09 Jun 2021 12:35:14 GMT
server: cloudflare
etag: "794c84d30e213ec6a144d64215f07551"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3eRSjcNNJhc%2FdJ0JCH36NtyTXyW4lQEU557uh8S8kTHd2wVmUGgVbgSpAYrp2%2FoI9%2BZehs5%2F2xYDopIm3qWEax6LU0KKcBwns1rTxD40Sh5rnR0Uan%2BFFtX2%2BWEzQtLQuST6qAk8lQlE666xDhG%2FlEDI"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1623242114099744
content-type: image/png
cache-control: public, max-age=31536000, immutable
x-goog-stored-content-length: 3262
accept-ranges: bytes
cf-ray: 6cb8204b9d1a839c-MXP
expires: Sat, 03 Dec 2022 02:14:46 GMT

GET
DATA 200
OK truncated
/ Frame 68F2 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e53577fbfec96abdb0b0152e63be404f6f9f4311d191f94d33cc0475e15a368d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 32A1 0
20 B 43ms
43ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BH_WMYoHcYZLoD9Hm7gO8n6mgDAAAAAA4AeAEAg&bg=!R0SlRADNAAbDtiZlw7Y7ACkAdvg8WnwNcz2a1PBlKcBHww2nnoAfkZzBlDvQLKDQLQUdhphoGInoFQIAAAEtUgAAADxoAQeZAtawsUOos3JFjNb1U4x4f2X7jGuZe6dixwi2osj9VnWTXZ9CCDis2jwiPmGtNUFmzLNaINdqju9J4M3PZ87g1OA2LsOaZVftRbuS81R1eExLmvBxhTvJ3U--FiQ3im4kEYlnaWe41K99Vqmx3SzjFJDus-P_nmiQ_8bH0z1RXthn4fsVZHHPTmkoFxRKizfpHWnXdejpzmsqgVBOGiVs_c47ni_SAooE63UzyZN5_cGa6cigqLuGYBJR5oP341AOjd-_8BE3oFXCR1wCPVGgPCdIXZx7B74L7VQwD1K2xy0mExJFElHXni548Ngm--v6jxOOeaJbY6h1AJksrklpQBnRjBqJpAcrWOKHGkLSdua1jZlca-VzANKWLUoC4iNzbdm_D0sjNfaSStHGWv9-P_cRHcNsNaa3ljhfRmOFXHBdvCpNfYC8Em0YqsCie-Q4n9ZKyvg34zm50bYCmh3PaZHzxetoHBIM3EP4aYjI8IP63zd643Ac3tv5mV18r0JtaxA0AjLh7Umfa7SfP0n8ZGoL7kIu9AgRbWe1lDQ9RSRGgmR0zjk19bC75E626IePbUzi0vAX29gNem86UJBVB0mN-eB9BUV1mRXasE3M92ggjkQr19P8mFsfQznUJATIUU1mMIUKtpmP-_7qmcClodd0DozjMPzwDONEipx-4evnd5UbfwCGxEQQ4o9Xk0mfvpyfX2fJ0jAOKgjs9YYM8A5NIZtLUhASAlpXl6JuQdxOmPT6gnO94OsUv9mXIQp_jCELLwDjCMmRFpa526XFvtBY8EuvpzWh2s_VgnaTc7t4l3TNn6xBZKgkhxCszUMYu23r-HAC7kEo5c_kj94RBZWG3ywdkdcBHPSFpn0lHtPeQsKSvxpcYlIkXebm96R7n3ZzAps4hMfs4CE-vzkTndavtr20wlm8dol-whU_7Wtz-qrW8p1A4frGJ199DWNXLVasNc2fzPk

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 frame.html Show response
ad4m.at/ Frame A385 2 KB
2 KB 22ms
22ms Document
text/html 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/frame.html
Requested by: Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d12a71cd626ac8f0fc91e6f1b98280cfb49fd724f2dcc118d192adff9a0154b4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Mon, 10 Jan 2022 18:56:35 GMT
content-type: text/html; charset=utf-8
x-guploader-uploadid: ADPycdvLTCgoXmADkdcT3I37l30xNlRaSjouX-Sl28_KEixoOwtIhuC7ftK7SkTaZoNIMUlq8FbL1y_z0Bf6GljiyPs
expires: Mon, 10 Jan 2022 19:56:35 GMT
last-modified: Wed, 06 May 2020 15:09:30 GMT
x-goog-generation: 1588777770164783
x-goog-metageneration: 3
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1681
x-goog-meta-
x-goog-custom-time: 1970-01-01T00:00:00Z
content-language: en
x-goog-hash: crc32c=iTDHew== md5=c2ZaqCqAXxKd4MgeeQDU8g==
x-goog-storage-class: MULTI_REGIONAL
age: 526326
cache-control: public, max-age=3600
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cf-cache-status: HIT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KeD1DbP91PFrI2erTFQuuYkl43rDvkfqkdC66YWaOD6hyUOGx8oihuWvE2qOIpxXxqpn3rOF6p9bpHrrtp1ZgSiPTaZ9Q%2BHUoX6ubbwIY%2FlEihGRiCITMgbDCzkf%2BdFoTng8uEs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 6cb8204b886a5bf5-FRA
content-encoding: br

GET
H3 200 r8nbwAJIoZCxWYvDNzL2FR480laaoV7LX6_itKNPK9o.js Show response
pagead2.googlesyndication.com/bg/ Frame 9BAF 35 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/r8nbwAJIoZCxWYvDNzL2FR480laaoV7LX6_itKNPK9o.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

afc9dbc00248a190b1598bc33732f6151e3cd2569aa15ecb5fafe2b4a34f2bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 09 Jan 2022 12:26:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 109805
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13292
x-xss-protection: 0
last-modified: Tue, 21 Dec 2021 11:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 09 Jan 2023 12:26:30 GMT

GET
H3 200 r8nbwAJIoZCxWYvDNzL2FR480laaoV7LX6_itKNPK9o.js Show response
pagead2.googlesyndication.com/bg/ Frame FD9B 35 KB
13 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/r8nbwAJIoZCxWYvDNzL2FR480laaoV7LX6_itKNPK9o.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

afc9dbc00248a190b1598bc33732f6151e3cd2569aa15ecb5fafe2b4a34f2bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 09 Jan 2022 12:26:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 109805
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13292
x-xss-protection: 0
last-modified: Tue, 21 Dec 2021 11:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 09 Jan 2023 12:26:30 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E64D
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEAR5tGULyVCZXB4H1VM2spo&google_cver=1&google_push=AYg5qPKt2LECcB8nTsLdGXcOLbtyY8ZZvxWxekX3RFp3c-HxPkff-F9cX2...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKt2LECcB8nTsLdGXcOLbtyY8ZZvxWxekX3RFp3c-HxPkff-F9cX2UIzkfxRvorJ5IkvWhMXqWi1GAJVxGSGtUJP-3VC25K&google_hm=956KXp...

170 B
188 B

49ms
49ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKt2LECcB8nTsLdGXcOLbtyY8ZZvxWxekX3RFp3c-HxPkff-F9cX2UIzkfxRvorJ5IkvWhMXqWi1GAJVxGSGtUJP-3VC25K&google_hm=956KXphtQvfT1mHDjsqW7Q

Requested by

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKt2LECcB8nTsLdGXcOLbtyY8ZZvxWxekX3RFp3c-HxPkff-F9cX2UIzkfxRvorJ5IkvWhMXqWi1GAJVxGSGtUJP-3VC25K&google_hm=956KXphtQvfT1mHDjsqW7Q
pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame E64D 43 B
106 B 17ms
17ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEMOehyQPgRy3wKhLV40GkFE&google_push=AYg5qPJb2NlxJW86yGI8CL1fBUVOsCBL3jDT_kaElWXpyL9a_PHfK48-YBGkk2SUNng4U4PkIrSY8_ikW0xG2Z8pyRPHXRS17D9L&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=4170394609&adk=2715274491&adf=2671285577&pi=t.ma~as.4170394609&w=728&lmt=1641840994&psa=0&format=728x90&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641840991077&bpp=3&bdt=141&idt=3097&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dce6fdd0735d9541c%3AT%3D1641840993%3AS%3DALNI_MapIh1wIk4CQkuJU4LU2MggxokXJQ&correlator=1873363329958&frm=20&pv=2&ga_vid=1762928891.1641840991&ga_sid=1641840991&ga_hid=1646229672&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=477&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063858&oid=2&pvsid=4150545889650970&pem=438&tmod=427&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=FgoanG4k2O&p=https%3A//zvonil.octo.net&dtd=3108
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 dds
rtb.openx.net/sync/ Frame E64D 43 B
64 B 18ms
18ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEJWp5VnHw7CtfdmliMc-FU8&google_cver=1&google_push=AYg5qPLV8IJfS1ohUA4wpGmjkKkRBLpcuGvnqOOLyYyIe7wk7rO3N_cYGs_L1BaoxP9JahMH8T2eexodxM5wWswiSx56ilIC28M_
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=4170394609&adk=2715274491&adf=2671285577&pi=t.ma~as.4170394609&w=728&lmt=1641840994&psa=0&format=728x90&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641840991077&bpp=3&bdt=141&idt=3097&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dce6fdd0735d9541c%3AT%3D1641840993%3AS%3DALNI_MapIh1wIk4CQkuJU4LU2MggxokXJQ&correlator=1873363329958&frm=20&pv=2&ga_vid=1762928891.1641840991&ga_sid=1641840991&ga_hid=1646229672&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=477&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063858&oid=2&pvsid=4150545889650970&pem=438&tmod=427&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=FgoanG4k2O&p=https%3A//zvonil.octo.net&dtd=3108
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: qafqhlreh461ag25q9nkptg92gai8frf

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E64D
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=saYQRH9qTWyx8lQFjGb9Ag%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

51ms
50ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=saYQRH9qTWyx8lQFjGb9Ag%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIjs1oz8Y7JnFaQkSSflwkEgNG0K9DkKjHLHJZn7icY5F_4DcM6L-bTXv6IRJpLqDJXvMI165EWKXwkYv8kNR_ZYRlXPuuq

Requested by

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=saYQRH9qTWyx8lQFjGb9Ag%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIjs1oz8Y7JnFaQkSSflwkEgNG0K9DkKjHLHJZn7icY5F_4DcM6L-bTXv6IRJpLqDJXvMI165EWKXwkYv8kNR_ZYRlXPuuq
date: Mon, 10 Jan 2022 18:56:34 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E64D
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEBU-nVPLJkGxLRzfXP6MB8g&google_cver=1&google_push=AYg5qPJaref-_V0trgvfSrcCFyduMPm0gSCcpBWk9qGavCc96zIZiUIIW4IIM7SSy4hkq4h2MFv...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k5MVFKUVEtMTctOU84WQ==&google_push=AYg5qPJaref-_V0trgvfSrcCFyduMPm0gSCcpBWk9qGavCc96zIZiUIIW4IIM7SSy4hkq4h2MFv0i4-54-VA-731aRHD_u0AG7bO

170 B
188 B

50ms
50ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k5MVFKUVEtMTctOU84WQ==&google_push=AYg5qPJaref-_V0trgvfSrcCFyduMPm0gSCcpBWk9qGavCc96zIZiUIIW4IIM7SSy4hkq4h2MFv0i4-54-VA-731aRHD_u0AG7bO

Requested by

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k5MVFKUVEtMTctOU84WQ==&google_push=AYg5qPJaref-_V0trgvfSrcCFyduMPm0gSCcpBWk9qGavCc96zIZiUIIW4IIM7SSy4hkq4h2MFv0i4-54-VA-731aRHD_u0AG7bO
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame E64D
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPLgZ2ZH2tWVW_Vi22XlxCxURAmK0d6xo...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPLgZ2ZH2tWVW_Vi22XlxCxURAmK0d6xo...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPLgZ2ZH2tWVW_Vi22XlxCxURAmK0d6xo...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPLgZ2ZH2tWVW_Vi22XlxCxURAmK0d6xo...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPLgZ2ZH2tWVW_Vi22XlxCxURAmK0d6xo...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPLgZ2ZH2tWVW_Vi22XlxCxURAmK0d6xo...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPLgZ2ZH2tWVW_Vi22XlxCxURAmK0d6xo...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPLgZ2ZH2tWVW_Vi22XlxCxURAmK0d6xo...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPLgZ2ZH2tWVW_Vi22XlxCxURAmK0d6xo...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPLgZ2ZH2tWVW_Vi22XlxCxURAmK0d6xo...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPLgZ2ZH2tWVW_Vi22XlxCxURAmK0d6xo...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPLgZ2ZH2tWVW_Vi22XlxCxURAmK0d6xo...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPLgZ2ZH2tWVW_Vi22XlxCxURAmK0d6xo...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPLgZ2ZH2tWVW_Vi22XlxCxURAmK0d6xo...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPLgZ2ZH2tWVW_Vi22XlxCxURAmK0d6xo...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPLgZ2ZH2tWVW_Vi22XlxCxURAmK0d6xo...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPLgZ2ZH2tWVW_Vi22XlxCxURAmK0d6xo...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPLgZ2ZH2tWVW_Vi22XlxCxURAmK0d6xo...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPLgZ2ZH2tWVW_Vi22XlxCxURAmK0d6xo...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdyBYt-dtTEda2bYup8x2AAABHgAAAAB&google_cver=1&google_gid=CAESEAKbJCJZiytWhzKUbYCTz1Q&google_push=AYg5qPLgZ2ZH2tWVW_Vi22XlxCxURAmK0d6xo...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E64D
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEBFS3YX3Mab_b2tBIKARtbY&google_cver=1&google_push=AYg5qPKGKXlP-TiHbtOAfZbv...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPKGKXlP-TiHbtOAfZbvaV8oj9rOi8li_cM8kShQHmYZllOknujsvTLV0udJACDLsHSsoI7Ddbb4gFM16Fp17AslvuEHbhweaw&google_hm=

170 B
188 B

51ms
50ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPKGKXlP-TiHbtOAfZbvaV8oj9rOi8li_cM8kShQHmYZllOknujsvTLV0udJACDLsHSsoI7Ddbb4gFM16Fp17AslvuEHbhweaw&google_hm=

Requested by

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPKGKXlP-TiHbtOAfZbvaV8oj9rOi8li_cM8kShQHmYZllOknujsvTLV0udJACDLsHSsoI7Ddbb4gFM16Fp17AslvuEHbhweaw&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Sun, 09 Jan 2022 18:56:35 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame E64D 0
12 B 15ms
14ms Image
text/html 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13L9ptVoo-RECq_hzlyQca5MIKOfveeLQ4erRKh7__qMbNe0uRUIt5gB53ssDvWzdgRgHPVfLQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:35 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 86AE 2 KB
1 KB 62ms
26ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YdyBYgADYWUIu8-gAAKXu5F7sAK-v1V4IBtZpQ&u=%7CdUT6sJtqYKkO3gEoEWePaw2WbFJkAqOQm0cD%2BMriXs8%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_AM8iEE4GHx4XAZ8-c9e5LlJfMjehYPJbM0j2hknANCpNfsuV4bKOZdERZwsUOl74YTlNh2oC0QHYqH2C3c2Eq_Qgi-OOOvPAkgbbkf2B9x2QcFreXPZ_EJtSgHjheHiHnZdgQ9NCBZ_l2-eKFg2DGu7sD7-ABUMSF5Qm_opuL4mekuZrLdfEXy-EVmaC7tCIQ6nYjv4Wu1DeFN7wEOcwl8ggASSwz7k2suTIJ63u8DBaKg4i7y9ckEiF49TliMNLd1-dGUjLIetXcZbJ99-MavXPt_XUrGnBCSx4b_Rca44YiykLXocTWZh7PgprGr_IUo443YxL3TqEKEBt5VcpetZs_-scwuvDVEL2kwddx4lAtIL5CB4ln1UPlrbHsgUp3en3u0KGHyVDEvbKT7s8dvSGy1JJxVzVKq8vxMCxxYVmo-LYNjbdgwLOpgnOh6TBV&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCwjUoYoHcYeXCDaCf7_UPu6-K2ATJntKxXNWdkfdwwI23ARABIABglQKCARdjYS1wdWItMjk3OTUzMzkwOTM5MjU4OKAB1bbS6gPIAQmpAhLw3Kgi_rI-qAMBqgS9AU_QK1vV1XTWVuCtDuzTDA86LBahSVd7BcWP2ILca-P9hfTVslAk_fm8X9vnWZNvCCXmwXtqGm0HXe7Vyohia3sJ_9SAFviLYwiET38MXbcixhNFCPqm7JVn9Itpq3Q4i8R0chCqrP4f0lc6bSDnMwFW2yUVJ_yzHIF9KyzhLDbf1EbUnQOntK81Va4ca1uHhawYvaU33wdXQaL3UWqXno63J_ayRLvdQtDhR1Uvj0g2tOgGmnMJ5-fbHvl1e4AG1KCKy6SbqKNsoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2DScX8r2jwNQddTrdJP_bDP7vjCg%26client%3Dca-pub-2979533909392588%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:35 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Jan 2023 18:56:35 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 86AE 2 KB
1 KB 52ms
17ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:35 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Jan 2023 18:56:35 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 86AE 308 B
636 B 47ms
18ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:35 GMT
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Thu, 05 Jan 2023 18:56:35 GMT

GET
H2 200 back_button.svg
static.criteo.net/flash/icon/ Frame 86AE 507 B
835 B 53ms
25ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8f9a7962cf58f27b89c0627d094ee1b631ec118675f9eae1dc06031353360422

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:35 GMT
last-modified: Thu, 01 Apr 2021 14:03:13 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "6065d2a1-1fb"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 507
expires: Thu, 05 Jan 2023 18:56:35 GMT

GET
H2 200 m
secure-gl.imrworldwide.com/cgi-bin/ Frame 86AE 0
462 B 192ms
152ms Image
text/plain 2600:9000:223c:6a00:1e:a43d:b640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-gl.imrworldwide.com/cgi-bin/m?ca=nlsn184820&cr=crtve&ce=criteo&pc=criteo_plc0001&ci=nlsnci162&am=3&at=view&rt=banner&st=image&r=1641840994
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YdyBYgADYWUIu8-gAAKXu5F7sAK-v1V4IBtZpQ&u=%7CdUT6sJtqYKkO3gEoEWePaw2WbFJkAqOQm0cD%2BMriXs8%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_AM8iEE4GHx4XAZ8-c9e5LlJfMjehYPJbM0j2hknANCpNfsuV4bKOZdERZwsUOl74YTlNh2oC0QHYqH2C3c2Eq_Qgi-OOOvPAkgbbkf2B9x2QcFreXPZ_EJtSgHjheHiHnZdgQ9NCBZ_l2-eKFg2DGu7sD7-ABUMSF5Qm_opuL4mekuZrLdfEXy-EVmaC7tCIQ6nYjv4Wu1DeFN7wEOcwl8ggASSwz7k2suTIJ63u8DBaKg4i7y9ckEiF49TliMNLd1-dGUjLIetXcZbJ99-MavXPt_XUrGnBCSx4b_Rca44YiykLXocTWZh7PgprGr_IUo443YxL3TqEKEBt5VcpetZs_-scwuvDVEL2kwddx4lAtIL5CB4ln1UPlrbHsgUp3en3u0KGHyVDEvbKT7s8dvSGy1JJxVzVKq8vxMCxxYVmo-LYNjbdgwLOpgnOh6TBV&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCwjUoYoHcYeXCDaCf7_UPu6-K2ATJntKxXNWdkfdwwI23ARABIABglQKCARdjYS1wdWItMjk3OTUzMzkwOTM5MjU4OKAB1bbS6gPIAQmpAhLw3Kgi_rI-qAMBqgS9AU_QK1vV1XTWVuCtDuzTDA86LBahSVd7BcWP2ILca-P9hfTVslAk_fm8X9vnWZNvCCXmwXtqGm0HXe7Vyohia3sJ_9SAFviLYwiET38MXbcixhNFCPqm7JVn9Itpq3Q4i8R0chCqrP4f0lc6bSDnMwFW2yUVJ_yzHIF9KyzhLDbf1EbUnQOntK81Va4ca1uHhawYvaU33wdXQaL3UWqXno63J_ayRLvdQtDhR1Uvj0g2tOgGmnMJ5-fbHvl1e4AG1KCKy6SbqKNsoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2DScX8r2jwNQddTrdJP_bDP7vjCg%26client%3Dca-pub-2979533909392588%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:6a00:1e:a43d:b640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
via: 1.1 83f1b8f73f37458f38e2ee1fc0b9e68c.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA56-P2
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://secure-gl.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin: *
cache-control: no-cache
cross-origin-resource-policy: cross-origin
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: uqt3qZYAO1Li8eQ_skhRIzxh9lBGQkcz3IymZAG77Hz4Bt5WUXHDhg==
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 lg.php
cat.fr.eu.criteo.com/m/delivery/ Frame 86AE 43 B
347 B 195ms
21ms Image
image/gif 178.250.0.160
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.fr.eu.criteo.com/m/delivery/lg.php?cppv=3&cpp=-0nXvPdilEUGzUYjtvasR3GqREcp5lflWtGZwEtQtmRvllgVnXDP8iBQ_Hqo027mqtaKgAOU2cGzWZTF6MIKpEh-CeGSsEA5DYWyE2bKPdlwYAEdfVtyltZ1q70Vfn0McxJEqaBePOkSVhlHcvvA-7ObsS6jXJ4rkI7IJJ-2HBNwwlIF9etBS6-HO2Jwxq4-AnP-GYeRxtf3BUnRnaTBMm2DQYK5qfrgynPF5ggaQPnkDYdcQLQFuzJ5PZ5mJSEWGhC5GO6EwyzkKbUqlOlxQ8B1RPeRiWmMhD5Y4CgLzIq-0EpE0EIfXmPPx_rTxLfhRH6VMJd8OLuvF5jAxK6KeieYQrmxicKRb4qcCuuFXgSFSg8ivrpzmvdQxPb2owTFO23e7P-drgL_8Zw9kQwc5TWCNQqbCq-cUzNJkhujYAQdbIAvxCeoHYS8UgWsO8Pplr6EVQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.160 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 3290276
content-type: image/gif
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 9C60 2 KB
1 KB 112ms
82ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YdyBYgADmXYKwl3yAA48lEUjP_lf0BXErg2sKg&u=%7CdUT6sJtqYKlw4c2f7NGJ8Iz6QLICfb4oMQrHcOTW3%2FE%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_AM8iEE4GHx4XAZ8-c9e5LlJfMjehYPJbM0j2hknANCpNfsuV4bKOZdERZwsUOl74YTlNh2oC0QHYQDlh-AmHzDLT_jyvxHH1uXmzrgtMLAx0kJ8SP4M0e2vlZ0n6rkHF8We3a9_XpnqbAtrzhSswhjOJ_pF0993_-c5aljubi_rZhATUWM9dYfdkiI9YXk7scR5eOjgpL4WTfozA_o-DiZndZwMmf6dVdAsEp1SQOC4M7zRNSeGQYmSIBph0PDWobJJQaH37qvBdmJ6Pwj059yua1OE1UwcZD5CVedt2tUoqdclmXhKofKcByycKe58QqCBLZl66CrZpNwSAxAcAGZ3pXk3QcLB6jKLAexKu_cGmK0yU6YpR7RyRyGKFRbkXUdkOtKw8VjmtoeWQesyDvntnwkReSOOXBV7pHuu6RqPsppyiL8SZJ2Zzl2P_KzB4O&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCHr5SYoHcYfayDvK7iQaU-biQDsme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItMjk3OTUzMzkwOTM5MjU4OKAB1bbS6gPIAQmpAhLw3Kgi_rI-qAMBqgTIAU_QSkqKV1ZnozVIWLpQzxRwIE695kN6gQ5bJd9IaIsR3_dDbRBOkQUxqcz3pxdwGMltkQehX7K5caEJcjx5oiHtifLxXIucyNlwgtALYDuwRddwYeLr9JtoVlync1fNJvQXw4cBU-TJypw9zE2WQ-E6J_DeichMFGp6keJwkM_0P6chIGp0BTKoA7cr9UTcWp-4WsjeUeoF_N0S2yNX4lQXwePnakpfzv6wYggoYs8iNkh1afxrOPyvaZnXowoYD6ymxCJnphxxgAbUoIrLpJuoo2ygBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0gMpYXphgXviFACc2PsyvsKiEVCA%26client%3Dca-pub-2979533909392588%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:35 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Jan 2023 18:56:35 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 9C60 2 KB
1 KB 49ms
19ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:35 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Jan 2023 18:56:35 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 9C60 308 B
636 B 39ms
17ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:35 GMT
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Thu, 05 Jan 2023 18:56:35 GMT

GET
H2 200 back_button.svg
static.criteo.net/flash/icon/ Frame 9C60 507 B
835 B 40ms
18ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8f9a7962cf58f27b89c0627d094ee1b631ec118675f9eae1dc06031353360422

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:35 GMT
last-modified: Thu, 01 Apr 2021 14:03:13 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "6065d2a1-1fb"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 507
expires: Thu, 05 Jan 2023 18:56:35 GMT

GET
H2 200 m
secure-gl.imrworldwide.com/cgi-bin/ Frame 9C60 0
460 B 188ms
154ms Image
text/plain 2600:9000:223c:6a00:1e:a43d:b640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-gl.imrworldwide.com/cgi-bin/m?ca=nlsn184820&cr=crtve&ce=criteo&pc=criteo_plc0001&ci=nlsnci162&am=3&at=view&rt=banner&st=image&r=1641840994
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YdyBYgADmXYKwl3yAA48lEUjP_lf0BXErg2sKg&u=%7CdUT6sJtqYKlw4c2f7NGJ8Iz6QLICfb4oMQrHcOTW3%2FE%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_AM8iEE4GHx4XAZ8-c9e5LlJfMjehYPJbM0j2hknANCpNfsuV4bKOZdERZwsUOl74YTlNh2oC0QHYQDlh-AmHzDLT_jyvxHH1uXmzrgtMLAx0kJ8SP4M0e2vlZ0n6rkHF8We3a9_XpnqbAtrzhSswhjOJ_pF0993_-c5aljubi_rZhATUWM9dYfdkiI9YXk7scR5eOjgpL4WTfozA_o-DiZndZwMmf6dVdAsEp1SQOC4M7zRNSeGQYmSIBph0PDWobJJQaH37qvBdmJ6Pwj059yua1OE1UwcZD5CVedt2tUoqdclmXhKofKcByycKe58QqCBLZl66CrZpNwSAxAcAGZ3pXk3QcLB6jKLAexKu_cGmK0yU6YpR7RyRyGKFRbkXUdkOtKw8VjmtoeWQesyDvntnwkReSOOXBV7pHuu6RqPsppyiL8SZJ2Zzl2P_KzB4O&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCHr5SYoHcYfayDvK7iQaU-biQDsme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItMjk3OTUzMzkwOTM5MjU4OKAB1bbS6gPIAQmpAhLw3Kgi_rI-qAMBqgTIAU_QSkqKV1ZnozVIWLpQzxRwIE695kN6gQ5bJd9IaIsR3_dDbRBOkQUxqcz3pxdwGMltkQehX7K5caEJcjx5oiHtifLxXIucyNlwgtALYDuwRddwYeLr9JtoVlync1fNJvQXw4cBU-TJypw9zE2WQ-E6J_DeichMFGp6keJwkM_0P6chIGp0BTKoA7cr9UTcWp-4WsjeUeoF_N0S2yNX4lQXwePnakpfzv6wYggoYs8iNkh1afxrOPyvaZnXowoYD6ymxCJnphxxgAbUoIrLpJuoo2ygBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0gMpYXphgXviFACc2PsyvsKiEVCA%26client%3Dca-pub-2979533909392588%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:6a00:1e:a43d:b640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
via: 1.1 83f1b8f73f37458f38e2ee1fc0b9e68c.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA56-P2
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://secure-gl.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin: *
cache-control: no-cache
cross-origin-resource-policy: cross-origin
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: R_mE3DdX2LsMTJIf2dA_leWIevC_hR41731ixViKzsH1s4vW6GiKGQ==
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 lg.php
cat.fr.eu.criteo.com/m/delivery/ Frame 9C60 43 B
347 B 189ms
23ms Image
image/gif 178.250.0.160
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.fr.eu.criteo.com/m/delivery/lg.php?cppv=3&cpp=1WRiGPdilEUGzUYjtvasR3GqREfbOGaZKTy5gxPwS5APj5hu6-YpPhadHtLySos_iXzwXXPaW1YMn5VFLFMUqKaNSdP_sIwjoSHr821Q_xnJtClrODoDU56Epk52wib6hhIFgWcVxTKi8nQCgLmdjaADongcl4QXTZjFJpQJPNm45jppVOVrXazGpzEPWUDYg9zgAoakQKffcDye-z9nRGCObIZWaV0FZ8CmIxVPEGJEvpbbCWAfoH22AmDW2TThklXqThT93ZL7mzet_N04_sYC8001ww56L7tfVBwZv6h8aC4Vh_0FYz5YuuBziqFf_lbEq1OAjj1DFaOPHTV4i1Hnti2Ams-Imqx-xIViQEke3emBi171ofVAe3rkj547KAjOxRTZ8kVYYlLy2yqZ2GUR-7iIVsQyact_N6L3X1dK5Rugx-MpIl46YZJtS_sUHr_wyg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.160 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:34 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 4295699
content-type: image/gif
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame EAC4 0
20 B 45ms
45ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BJGu4YoHcYfvHD9OsgQfvhZloAAAAADgB4AQC&bg=!ra6lrurNAAbDtiZlw7Y7ACkAdvg8WsBY61-VW8ftReMTEHec8DypKiLi4FQnIrIZ2kO6A8QPL9R9lgIAAAE_UgAAAExoAQcKAHS8bRolipJVdU5b-49gOWJa3eI4ajzenXPNgncEyckOO2G8NJhOcG0-AXdcHyeR9dPEKi_7L1cU2Dh4b6Z6v36tGVExUa9spraQ0z1IjLTrgvZPzCKbEHwoY3n9XCMMf7rFrFROlGdXrhjlsyKMpFJ4_OSODpkC1kLcSMKk8H7LOyuGLA4iTYhgdsP_35T6KJdMfudvEvJJG2oaNDqg_5pNmB45z90YdAn8TvGLAfc98_6Jr3YEONOhC7KOFK9B-uEPvPMgbHzHcS64eNCT0qNb7gpRWcH6SgrFCtLAueLN6N3iMq0wbMdIU9Nz97kDNUbatFyVh7Sg66973oarHnATp-8gA5poMlPV_sKah9jK4h2i4QOgvfi4G1cGERoYtCPQhAwQr3WgkPATjYcygkhMrweqK9JOT7B38QA8wrTNhbB_GUC8Xas84TUkX_P33_tlFZGnyIuiTQjwHtrVap3glmDpEIwia3eSrSYQ9DFdfK4Vg98WzTInAgcc9UAyMq_48glgp13BnxekLgceHbFF6v9eLzPiCw50fadH2AOQosNr8Neff0TpEIUpt0bOEckz8PcuXyAikeruTrYMn376jZ9tsEHk51B5_eAeTvO2e8SL-N-7GhrtTRVZUsLdoeMBGMBEE87HH2shGEdP16aH9BLOhxUD5jk4-fE3_uwRMs5ahnGhR-mmvP2nvrlFa0z3kTtygtM1uAZvzO_OfNmcFr57eyzEPXt5nWaAPC0ViVYjv8EMov-B8fKPZeEaPrrqjfXCT2mYVgEqaHxwVq0B5yKI3F1nu9Jlnz6pynjiVjamCtE_jHRwDs1c4PryVI5so6j6TKTId-V-kQZzq_V2r8DaekQ3QJsrmWuv4g5ot7dmLlrPB-z63SKTsKB2PFTsBsH6ct-pHHIJF-fL3vIDHpRb5uloSvTheLDYsvuAPyTGsKfeLEDIrFqJS5TwEE1orhiufThAHOexclAxiDg4ccT3NZDSCY5-Y-jPv1y57QGxQxQEMbmhno-ZhFM5u0ceDeqFmCcwhOzT9W7QQbXPGCgUeiv2S9jeClhJoMhAwZlxbxpReTWY04VCF4WADIrXsDh293_-tTmTNCVU7VEp4cVU48w7cyhoyOCPmA

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FC4D 0
20 B 45ms
45ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B_7YVYoHcYZrxD4-33wPmsqLICQAAAAA4AeAEAg&bg=!MTKlMnbNAAbDtiZlw7Y7ACkAdvg8WjmZDurIICo9RgkXRr7hXo5AnN0P6FJvenDjQ9Y356Pr_9poEAIAAAFjUgAAAEloAQeZAtmPIpU6uFFRMnfK1D2jBIi9-Z72pm0elhtQGwrjxhsBajfhh3Gi-6Rb8p0YTjf9cmDSVYpU-pJTzgYGP58tD1ObEhHKH17S9V6qzkjTtO_pdCwjx8ho5RpOLL9n0bckPk5rq-NlGH52p-1G4zrMbGZ63-lzQW1g7Z_ZLItreaTNWiHEM28l5s0U3hCura1yiyCrU-KcNYO49mB5ABQTgrkXi2K5UoPZJvtpOz4fRzvztLCND5bxFkhuc7a9OY68ZWpDq9-WLJNgImx02DiGhkCSxfLRQ5NnUAp1lBdH4feDFvlHGgUxC3aw1jsFN6Qr3Ky99Uk0WzYat8M8Zw2WCQry41L5OEbgalUbgGhnbqw23BVwSF4WcVcZY0ymkNAhu8UkkEeiQP-0iLYol_GaEHC4mZW76yoXJecE-zB_Y4AqAKu0w4izursdr1MTAW1OujwYNXgQNyD9AJMMkOGu-t7eXYeiT-lKIIjeGF2NLJQnNNMlaB8DC4__YbnHqmFKBXuriyV-IJl8pp11myHSVNsGlhfPT58cKFUYueQrt_xwSuPWN-xc8lOfdl-QwGrFkfUw5NdHiopEGPYhB3QDpyNLWtX4CgeKTgTvMQtVhqOLbmNbZ1Ik6jj2v54fJCu_xoi4zcKdZ4uHYnRZw_ajYjm1dfYL-M5N1FObUwBZjwMj6U6sDFIitLX3eSjrkJ0yTw3g3405tXv-1eUtTeQ4P3tvIGq5QopwH9iIUIY0KaTogDEMz-0RIbEgp2h6OHx2QbzgJtnUwBuDrlbKcr7jN4iSR8gUCzd_1lyOV3bYCo_wFUWukPeRa2NxgIvvWKo-VuE_9U08ibIA9LMHkAk8Xy53X78MYGKXAGZMakYaIsHoRZRKLg_aaXmrMrWlD-x_CT45eZqjIHxsyR4BbfkQRBvhOtu78ShXFSH4QKCM0h1g046Fq4yhHVtyl3mNLvoJarusSSuQQQVBMvs

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 86AE 12 KB
6 KB 17ms
17ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:35 GMT
content-encoding: gzip
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Jan 2023 18:56:35 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 86AE 7 KB
7 KB 63ms
19ms Image
image/png 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=176&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F2861%2F190124%2F8d6bc06124f044d4973e0db21c495799_logo.png&v=3&w=256&s=OoHbAbMjs34limBOASsMBFuJ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

2a29e79bd75cc83eade181c4acc1c198786539997766b648bc21ed5aa7698408

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 10:55:21 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 28873
vary: Origin
x-cache: hit cached
content-type: image/png
cache-control: public, max-age=29172533
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 7142
expires: Wed, 14 Dec 2022 02:24:15 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 86AE 1 KB
1 KB 63ms
20ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FV%2FlogoVogt-Medical-Vertrieb-GmbH-84462DE.gif%3Feb%3D1&v=3&w=400&s=Sxk_m_1Q9C7pk7-3Vv1lolK9&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

025d47e5f33d8f6867a73d3f1915f57c263947e145365e8cd25a9a762cd6f5d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 10:32:05 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 30268
vary: Origin
x-cache: hit cached
content-type: image/webp
cache-control: public, max-age=2076936
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 1174
expires: Thu, 03 Feb 2022 11:27:43 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 86AE 2 KB
2 KB 73ms
30ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FL%2FlogoLandesamt-fur-Zentrale-Polizeiliche-Dienste-NRW-66057DE.gif%3Feb%3D1&v=3&w=400&s=4cQdjkAT3WhxUgmsczHWi-AX&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

bc31dd1668b538cb276b888ece7b1bc77aa3ef5fda2652aa92501e0502f3587f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:55:39 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 55
vary: Origin
x-cache: hit cached
content-type: image/webp
cache-control: public, max-age=224
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 2072
expires: Mon, 10 Jan 2022 11:08:59 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 86AE 1 KB
2 KB 63ms
20ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2F9%2FlogoHOYER-GmbH-Internationale-Fachspedition-37379DE-2006101647.gif%3Feb%3D1&v=3&w=400&s=SGr6G-HXmOl7iwtyg_1PLmJR&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

7f8b6e031b559271d1e647eca13727e1ffef7903218b74a220ebfa2149626432

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:55:08 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 86
vary: Origin
x-cache: hit cached
content-type: image/webp
cache-control: public, max-age=37
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 1502
expires: Mon, 10 Jan 2022 11:25:01 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 86AE 1006 B
1 KB 63ms
20ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FE%2FlogoEuropcell-GmbH-42344DE.gif%3Feb%3D1&v=3&w=400&s=RgHnXWDe7SKj9BgAYhCoFAt5&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

5920a1edbafda8fd0c96a81d87b575f64a129d2c4e4883bf0ed5e5726263d0d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 10:10:49 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 31545
vary: Origin
x-cache: hit cached
content-type: image/webp
cache-control: public, max-age=1899615
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 1006
expires: Tue, 01 Feb 2022 09:51:05 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 86AE 2 KB
2 KB 73ms
30ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FW%2FlogoWeener-Plastik-GmbH-50032DE.gif%3Feb%3D1&v=3&w=400&s=Aaj1FWkv0qqx34HxIdgGoizh&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

273ce72a147ee0dc19a19f0e612efa0f5a080e9a86d01df66054fbd21b21408f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 10:43:21 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 29593
vary: Origin
x-cache: hit cached
content-type: image/webp
cache-control: public, max-age=246711
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 2236
expires: Thu, 13 Jan 2022 07:15:13 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 86AE 0
127 B 824ms
14ms Ping
text/plain 178.250.2.150
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=WGC6o9iuH0A_m3V4KYmxAAG6pdDMLWWYYbrjzog7Xa1q5oa8h20RHR-rrXpObGvaZj8mffhevR3A0J_rwtyI2kCkdVvQqbHVGaL28Tp-qlPhAo0SIy_mEcXqBWg1jkc2ch0MiU88NPgNYErsbHDESzxV-ZfYdcGCi6J1xencG1dDdNkfU3MqXosbTLlRW8shns_vm0UBbyqb4Fp5JpSf2lm5aRZ1g3zDi95Wf4TzGwcdeE0dRWwkOkvmkEU4JDoKcgRlvA&sds=2&rev=80076&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.150 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 10 Jan 2022 18:56:35 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 86AE 2 KB
1 KB 21ms
21ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:35 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Jan 2023 18:56:35 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 86AE 2 KB
1 KB 17ms
17ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:35 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Jan 2023 18:56:35 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 9C60 12 KB
6 KB 21ms
20ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:35 GMT
content-encoding: gzip
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Jan 2023 18:56:35 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 9C60 7 KB
7 KB 24ms
24ms Image
image/png 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

2a29e79bd75cc83eade181c4acc1c198786539997766b648bc21ed5aa7698408

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 10:55:21 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 28873
vary: Origin
x-cache: hit cached
content-type: image/png
cache-control: public, max-age=29172533
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 7142
expires: Wed, 14 Dec 2022 02:24:15 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 9C60 1 KB
1 KB 22ms
22ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FV%2FlogoVogt-Medical-Vertrieb-GmbH-84462DE.gif%3Feb%3D1&v=3&w=800&s=SoYk7_-aATzvP9ZsmzxyJVEK&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

025d47e5f33d8f6867a73d3f1915f57c263947e145365e8cd25a9a762cd6f5d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 10:39:08 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 29846
vary: Origin
x-cache: hit cached
content-type: image/webp
cache-control: public, max-age=2076514
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 1174
expires: Thu, 03 Feb 2022 11:27:43 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 9C60 1 KB
2 KB 25ms
25ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2F9%2FlogoHOYER-GmbH-Internationale-Fachspedition-37379DE-2006101647.gif%3Feb%3D1&v=3&w=800&s=2tn0EiI7azzPXEudDSVjjL-b&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

7f8b6e031b559271d1e647eca13727e1ffef7903218b74a220ebfa2149626432

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:54:25 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 130
vary: Origin
x-cache: hit graced cached
content-type: image/webp
cache-control: public, max-age=1316
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 1502
expires: Mon, 10 Jan 2022 12:32:33 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 9C60 1 KB
1 KB 23ms
23ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2F6%2FlogoMalag-Soltau-GmbH-202821DE.gif%3Feb%3D1&v=3&w=800&s=rzhimeR9XiBimlyWktuYuBoB&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

59da68d309d0d84ad1120a3edde2b2908b03a0e79cd54871d7f32d8d430018aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 10:46:56 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 29378
vary: Origin
x-cache: hit cached
content-type: image/webp
cache-control: public, max-age=444106
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 1032
expires: Sat, 15 Jan 2022 14:08:43 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 9C60 2 KB
2 KB 24ms
24ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FL%2FlogoLandesamt-fur-Zentrale-Polizeiliche-Dienste-NRW-66057DE.gif%3Feb%3D1&v=3&w=800&s=vYLMtKnM7MUvR-eeF_q6lJec&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

bc31dd1668b538cb276b888ece7b1bc77aa3ef5fda2652aa92501e0502f3587f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:54:41 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 113
vary: Origin
x-cache: hit cached
content-type: image/webp
cache-control: public, max-age=1581
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 2072
expires: Mon, 10 Jan 2022 11:08:59 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 9C60 2 KB
2 KB 23ms
23ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FP%2FlogoPASCOE-pharmazeutische-Praeparate-GmbH-97952DE.gif%3Feb%3D1&v=3&w=800&s=rMW4K-aehBth19_iHHY5S2by&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

ec2-54-72-0-164.eu-west-1.compute.amazonaws.com

Software

Finatra /

Resource Hash

30e57d5fd144867c74c24531910af3948d5f4ddea32a13d9205f7f02b4fda6be

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 11:07:39 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 28136
vary: Origin
x-cache: hit cached
content-type: image/webp
cache-control: public, max-age=559731
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 1620
expires: Sun, 16 Jan 2022 22:36:30 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 9C60 0
127 B 770ms
14ms Ping
text/plain 178.250.2.150
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=z8s8INiuH0A_m3V4IM0eyYkbMkSXn241_FRC3BMtTsxuwCZhzwMHdRrkzwBmpPAtzkZHArlykZpd5VzA77Ow4ddmDKmGEbYtX_-9XSOhnkSamzBonKRqfXRfp3qSlGKnuSHQOhG_C2IeadSM7M-v4QWvJ9qy4Q0kEEJgc5YJpeomQ3LPJh-6_voF_VYaVCLHxeD6XWyfYeOP-m8HCWPefQtVOA61FnUJwx1zP4hJPxc_RsC7TuqPLUrtNghxWw7O9Z4tAQ&sds=2&rev=80076&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.150 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 10 Jan 2022 18:56:36 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 9C60 2 KB
1 KB 18ms
17ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:35 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Jan 2023 18:56:35 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 9C60 2 KB
1 KB 17ms
17ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:35 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Jan 2023 18:56:35 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 1DDC 42 B
64 B 48ms
48ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv4fN_oY0NYKYmeCdUKDHx1sGrDsxjce78Q13kspHugiUEyKd2m7fIA_V1zMWhNHRzZflPhg1OmHoHHwZNLCRSxKtO7uGNlfM_w9nSqxwMHkZ5RrPOGhQ&sai=AMfl-YQs5s1LpJVQmSIl5OFJADr6sQ_ymqzdDSsi3GjvR15kwlcJFYbTvRoiNr1N2ODRjjGZthKIDyPE54LFWrO-vgjIZcPWMW96cp_08g8gFMJV0gmkUljik0eUh55n&sig=Cg0ArKJSzHD-3cVex1I5EAE&cid=CAASEuRowSLuBKxTbVvakrBuJnmlpw&id=lidar2&mcvt=1043&p=541,1039,791,1339&mtos=1043,1043,1043,1043,1043&tos=1043,0,0,0,0&v=20220105&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=1556906017&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1641840994131&rpt=236&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 rs Show response
ad4m.at/ Frame ECC5 1 KB
2 KB 57ms
56ms XHR
text/plain 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/rs
Requested by: Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 60bb836d91484e85736627e1622b720eb16f9ad1cb078dac79ba747f0f3de1e0

Request headers

Referer
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/json

Response headers

cf-ray: 6cb8204e09d883a6-MXP
date: Mon, 10 Jan 2022 18:56:35 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jDBg0OENXi0%2BkjNwEMJKtHoMtNGxZrSs7N%2F3TzTPUKo9AJ0vkhgYv1spw7Eu3m%2Fv%2BC0BQb6ZqNuFo%2BXTnSkcem%2BxyQuMT5JAav%2FYJH7uNQ9qhQ%2FZP7yUxEkfcR4jmM0wabpvRVI%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain
access-control-allow-origin: https://as.ad4m.at
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
access-control-allow-credentials: true
content-encoding: br
x-backend-server: aa-reachservice-group-europe-west1-n794

OPTIONS
H3 200 rs
ad4m.at/ Frame 0
0 98ms
75ms Preflight
text/plain 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/rs
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://as.ad4m.at
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 10 Jan 2022 18:56:35 GMT
content-type: text/plain
content-length: 24
access-control-allow-origin: https://as.ad4m.at
access-control-allow-credentials: true
access-control-max-age: 1800
access-control-allow-methods: GET,PATCH,POST,OPTIONS,DELETE
access-control-allow-headers: content-type
allow: HEAD,POST,GET,OPTIONS
x-backend-server: aa-reachservice-group-europe-west1-n794
via: 1.1 google
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vrrlyPd4Al3Kyt9%2F2sQpGU5SHOUYO5ikiKfg6GFjUoai46hgURkQ6HcQhbOCwTlvoTPz2QwBOcMUdHQ9aXB5kDJ7BduHoCXImPFw7N7roKsSHLE28fdZSN6EOnArFqWgHlhJFPI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6cb8204d987283a6-MXP

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
9 KB 21ms
21ms XHR
application/json 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220104&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

853720d2f2236a6f005a4c6d99802ac3db675741c6df70f05902f7009b90e240

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 10 Jan 2022 18:56:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8719
x-xss-protection: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 44FB 42 B
64 B 44ms
43ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsunejkovKS-kafcG8oXy1OiEsnAl2S6WQYzrq5kC7W2RoDdMpVmy2s0UBjiCqXb2mb3ANSV06myf1cozxq8WZzQ6OUSs2Dl5nXLfezfzDaZINWxN6R4IQ&sai=AMfl-YQtjW0L6iAMvEk1_AjyN2hGRH6ZJNI-WNwLcklmRzLl7D8fGW_OB4vPoeraW_qrKXHdaC5zUCToU4QeZe9pZPirdBdLP0zlvm_38hEZhvyQntgR8B07SeC6tOE982g&sig=Cg0ArKJSzNgMNLSoSGXyEAE&cid=CAASFeRoLPVrTp_I1jzFzLu0g3RpbP6New&id=lidar2&mcvt=1000&p=193,277,283,1005&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220105&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=4116272111&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1641840994127&rpt=308&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://02f88dcdce02562d3d599fe3f6e4bdba.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 10 Jan 2022 18:56:35 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 6E40 13 KB
5 KB 7ms
6ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/

Response headers

cross-origin-resource-policy: cross-origin
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
date: Mon, 10 Jan 2022 18:46:21 GMT
expires: Tue, 10 Jan 2023 18:46:21 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 614
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 9FD8 783 B
535 B 35ms
17ms Document
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

ff1e716800e1e5c7769129f439ac7623a331c4640b89bdf480664b1348230c46

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-+PTY2o6Xyo+JAtZnnXvKIQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Mon, 10 Jan 2022 18:56:35 GMT
date: Mon, 10 Jan 2022 18:56:35 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-+PTY2o6Xyo+JAtZnnXvKIQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 r8nbwAJIoZCxWYvDNzL2FR480laaoV7LX6_itKNPK9o.js Show response
pagead2.googlesyndication.com/bg/ Frame 6E40 35 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/r8nbwAJIoZCxWYvDNzL2FR480laaoV7LX6_itKNPK9o.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

afc9dbc00248a190b1598bc33732f6151e3cd2569aa15ecb5fafe2b4a34f2bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 09 Jan 2022 12:26:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 109805
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13292
x-xss-protection: 0
last-modified: Tue, 21 Dec 2021 11:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 09 Jan 2023 12:26:30 GMT

GET
H3 200 rar Show response
as.ad4m.at/ad/ Frame AA98 7 KB
4 KB 42ms
41ms Document
text/html 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://as.ad4m.at/ad/rar?a=19456%2C37798%2C43784&b=3bgFpf14UB6QC7HrHAtEt997f8TWTRead%2CR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=WrpSrfYdsYJxSYH5HjtDCXXGaPTET4QF2%2CQpKH4fdjUVpVhxH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=300&d=250&e=_OwIB0kJgnoo72azEguFwak0n4wXvwyG&g=a32850147392e3b86dbf8470661b2130%2F1923534534431354413&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1641840995555&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1kaxse13jzfjvjy1f1samqdr813pwhj3vjc1yq69s1tkxkya135qg3gzm8pybfcafnr427sa5kjryevrbj5qn3mc0hqw2hdck4amaqtmmejnd1pygvqz83seh2vp1f8tx8hpk4jjc1k74kma6nxrxrde7wsgwjvrqnmnds3fggm09e8m8rwr5k7zbrcgqct4w496x0sn68dqm7h5w28g4gpcfeh1w2ze97txc0sqfjmeg4wana4gyvds3j8s9287wat3p8rd4mhc6nt1hb3g%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCmheAYoHcYeHzDs-JiQbS4q6ICZDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQJeJQrmqPuyPqgDAaoEyQFP0NxSdZeeTExkgWPitZqixMwE86hW8nIaVVf-Wp7a1uZXqw3noJ66w82HtQrBmB5WwEwz09if_TcbGKEyXgMPhv7l1Cmqo9ra3nxDh6rz9Rz9vbU_lVp89sQFeWc4RECSRGnECDC1SpgsB_6lQEvZIY0KmMCulVNlWu0Auersl7IB9imDrg6i3PiM6y97a4PRJ-SNrp3Oes0fjy0ESqvjgDCH0zwDZNrIbJAWXJwvILGXQCYRxbDsvDHJuKcqjnJUrp4JHFFz-_KABry2mfOd_o_LMaAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%252526num%25253D1%252526sig%25253DAOD64_3zykky8NkaC4naf844LOUCHczl4g%252526client%25253Dca-pub-2979533909392588%252526adurl%25253D&y=1&z=0

Requested by

Host: ad4m.at
URL: https://ad4m.at/r62eglto.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

93e91ddc1f52cb035d34685be53f8d03c2cf06d32c6f8060acfac2b7c5b8b1e6

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri ;child-src ;connect-src ;default-src 'self';font-src ;form-action 'none';frame-ancestors * data:;frame-src ;img-src data:;manifest-src 'none';media-src 'none';navigate-to ;object-src 'none';prefetch-src 'none';script-src 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
Strict-Transport-Security	max-age=86400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://as.ad4m.at/ad/dr?ed=1jd43kbsaygz9zdcf69j8gfac3kjt91j8s606ea0keww1f73xa2je76kbnagjey7qt1vtk2kp8t86a5kf0dw1fvxxh3t1vkwv54q347cmqnng4f22sxjbjeyntqt1dn69c8mca10jgway49zt648e65x1qgrg8zgprxyeqfshg1k7qnmxyb1yvjzm3qmqz7y9q3vyh5cd1mv45d9r9va0qy8e10psv8a14w2h0hwz85c426ts75852n47f5q8xwn6tf8xt0cm46tjsbwee3g3xvvq1wdk2vyd8971c9mpkjf1qcbgw2q0mehkyaw2h34d5c2gg1zfcpcv30z9jtsarkp3b6kxhmkmgnz7e01qqn09k6maqrfcgaxn58ecwqzv9fv4f5xvsrkexebawq9yxqqm7nf7egw5ryc1sa84s64ja6dz1tmg&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCmheAYoHcYeHzDs-JiQbS4q6ICZDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQJeJQrmqPuyPqgDAaoEyQFP0NxSdZeeTExkgWPitZqixMwE86hW8nIaVVf-Wp7a1uZXqw3noJ66w82HtQrBmB5WwEwz09if_TcbGKEyXgMPhv7l1Cmqo9ra3nxDh6rz9Rz9vbU_lVp89sQFeWc4RECSRGnECDC1SpgsB_6lQEvZIY0KmMCulVNlWu0Auersl7IB9imDrg6i3PiM6y97a4PRJ-SNrp3Oes0fjy0ESqvjgDCH0zwDZNrIbJAWXJwvILGXQCYRxbDsvDHJuKcqjnJUrp4JHFFz-_KABry2mfOd_o_LMaAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_3zykky8NkaC4naf844LOUCHczl4g%26client%3Dca-pub-2979533909392588%26adurl%3D

Response headers

date: Mon, 10 Jan 2022 18:56:35 GMT
content-type: text/html; charset=utf-8
strict-transport-security: max-age=86400; includeSubDomains; preload
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
x-download-options: noopen
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
x-xss-protection: 1; mode=block
cross-origin-embedder-policy: unsafe-none
content-security-policy: block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-ancestors * data:;frame-src *;img-src * data:;manifest-src 'none';media-src 'none';navigate-to *;object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
referrer-policy: same-origin
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
expires: 0
surrogate-control: no-store
pragma: no-cache
cross-origin-opener-policy: unsafe-none
via: 1.1 google
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6cb8204e79ae5bf5-FRA
content-encoding: br

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 9FD8 0
0 47ms
47ms Image
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220104&jk=4150545889650970&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H3 200 default.css
as.ad4m.at/ad/style/0.1.18/one-ad/ Frame AA98 81 KB
11 KB 29ms
29ms Stylesheet
text/css 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://as.ad4m.at/ad/style/0.1.18/one-ad/default.css

Requested by

Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19456%2C37798%2C43784&b=3bgFpf14UB6QC7HrHAtEt997f8TWTRead%2CR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=WrpSrfYdsYJxSYH5HjtDCXXGaPTET4QF2%2CQpKH4fdjUVpVhxH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=300&d=250&e=_OwIB0kJgnoo72azEguFwak0n4wXvwyG&g=a32850147392e3b86dbf8470661b2130%2F1923534534431354413&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1641840995555&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1kaxse13jzfjvjy1f1samqdr813pwhj3vjc1yq69s1tkxkya135qg3gzm8pybfcafnr427sa5kjryevrbj5qn3mc0hqw2hdck4amaqtmmejnd1pygvqz83seh2vp1f8tx8hpk4jjc1k74kma6nxrxrde7wsgwjvrqnmnds3fggm09e8m8rwr5k7zbrcgqct4w496x0sn68dqm7h5w28g4gpcfeh1w2ze97txc0sqfjmeg4wana4gyvds3j8s9287wat3p8rd4mhc6nt1hb3g%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCmheAYoHcYeHzDs-JiQbS4q6ICZDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQJeJQrmqPuyPqgDAaoEyQFP0NxSdZeeTExkgWPitZqixMwE86hW8nIaVVf-Wp7a1uZXqw3noJ66w82HtQrBmB5WwEwz09if_TcbGKEyXgMPhv7l1Cmqo9ra3nxDh6rz9Rz9vbU_lVp89sQFeWc4RECSRGnECDC1SpgsB_6lQEvZIY0KmMCulVNlWu0Auersl7IB9imDrg6i3PiM6y97a4PRJ-SNrp3Oes0fjy0ESqvjgDCH0zwDZNrIbJAWXJwvILGXQCYRxbDsvDHJuKcqjnJUrp4JHFFz-_KABry2mfOd_o_LMaAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%252526num%25253D1%252526sig%25253DAOD64_3zykky8NkaC4naf844LOUCHczl4g%252526client%25253Dca-pub-2979533909392588%252526adurl%25253D&y=1&z=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0442de55e3838ce2b8cfca9a7ad2a6bcecfd94844453c13b38d7a9f1d31944b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://as.ad4m.at/ad/rar?a=19456%2C37798%2C43784&b=3bgFpf14UB6QC7HrHAtEt997f8TWTRead%2CR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=WrpSrfYdsYJxSYH5HjtDCXXGaPTET4QF2%2CQpKH4fdjUVpVhxH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=300&d=250&e=_OwIB0kJgnoo72azEguFwak0n4wXvwyG&g=a32850147392e3b86dbf8470661b2130%2F1923534534431354413&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1641840995555&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1kaxse13jzfjvjy1f1samqdr813pwhj3vjc1yq69s1tkxkya135qg3gzm8pybfcafnr427sa5kjryevrbj5qn3mc0hqw2hdck4amaqtmmejnd1pygvqz83seh2vp1f8tx8hpk4jjc1k74kma6nxrxrde7wsgwjvrqnmnds3fggm09e8m8rwr5k7zbrcgqct4w496x0sn68dqm7h5w28g4gpcfeh1w2ze97txc0sqfjmeg4wana4gyvds3j8s9287wat3p8rd4mhc6nt1hb3g%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCmheAYoHcYeHzDs-JiQbS4q6ICZDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQJeJQrmqPuyPqgDAaoEyQFP0NxSdZeeTExkgWPitZqixMwE86hW8nIaVVf-Wp7a1uZXqw3noJ66w82HtQrBmB5WwEwz09if_TcbGKEyXgMPhv7l1Cmqo9ra3nxDh6rz9Rz9vbU_lVp89sQFeWc4RECSRGnECDC1SpgsB_6lQEvZIY0KmMCulVNlWu0Auersl7IB9imDrg6i3PiM6y97a4PRJ-SNrp3Oes0fjy0ESqvjgDCH0zwDZNrIbJAWXJwvILGXQCYRxbDsvDHJuKcqjnJUrp4JHFFz-_KABry2mfOd_o_LMaAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%252526num%25253D1%252526sig%25253DAOD64_3zykky8NkaC4naf844LOUCHczl4g%252526client%25253Dca-pub-2979533909392588%252526adurl%25253D&y=1&z=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:35 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
age: 622845
cross-origin-embedder-policy: unsafe-none
cf-polished: origSize=83581
surrogate-control: no-store
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=86400; includeSubDomains; preload
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: same-origin
expires: 0
last-modified: Mon, 03 Jan 2022 13:55:50 GMT
server: cloudflare
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-download-options: noopen
report-to: {"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cache-control: max-age=3600, must-revalidate, proxy-revalidate
cf-ray: 6cb8204edaca5bf5-FRA
cf-bgj: minify

GET
H2 200 D694B3AB12381C049B127B34DC11A792684BA8B6EE8B598D6E4045678591B7D0DC6B2CEF7528F06BB05FC11826A1D16CF24DA68FCFC2416343996FBFC05A3155
assets.ad4m.at/logo/ Frame AA98 53 KB
54 KB 35ms
35ms Image
image/webp 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/D694B3AB12381C049B127B34DC11A792684BA8B6EE8B598D6E4045678591B7D0DC6B2CEF7528F06BB05FC11826A1D16CF24DA68FCFC2416343996FBFC05A3155
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19456%2C37798%2C43784&b=3bgFpf14UB6QC7HrHAtEt997f8TWTRead%2CR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=WrpSrfYdsYJxSYH5HjtDCXXGaPTET4QF2%2CQpKH4fdjUVpVhxH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=300&d=250&e=_OwIB0kJgnoo72azEguFwak0n4wXvwyG&g=a32850147392e3b86dbf8470661b2130%2F1923534534431354413&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1641840995555&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1kaxse13jzfjvjy1f1samqdr813pwhj3vjc1yq69s1tkxkya135qg3gzm8pybfcafnr427sa5kjryevrbj5qn3mc0hqw2hdck4amaqtmmejnd1pygvqz83seh2vp1f8tx8hpk4jjc1k74kma6nxrxrde7wsgwjvrqnmnds3fggm09e8m8rwr5k7zbrcgqct4w496x0sn68dqm7h5w28g4gpcfeh1w2ze97txc0sqfjmeg4wana4gyvds3j8s9287wat3p8rd4mhc6nt1hb3g%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCmheAYoHcYeHzDs-JiQbS4q6ICZDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQJeJQrmqPuyPqgDAaoEyQFP0NxSdZeeTExkgWPitZqixMwE86hW8nIaVVf-Wp7a1uZXqw3noJ66w82HtQrBmB5WwEwz09if_TcbGKEyXgMPhv7l1Cmqo9ra3nxDh6rz9Rz9vbU_lVp89sQFeWc4RECSRGnECDC1SpgsB_6lQEvZIY0KmMCulVNlWu0Auersl7IB9imDrg6i3PiM6y97a4PRJ-SNrp3Oes0fjy0ESqvjgDCH0zwDZNrIbJAWXJwvILGXQCYRxbDsvDHJuKcqjnJUrp4JHFFz-_KABry2mfOd_o_LMaAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%252526num%25253D1%252526sig%25253DAOD64_3zykky8NkaC4naf844LOUCHczl4g%252526client%25253Dca-pub-2979533909392588%252526adurl%25253D&y=1&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f7cdf71044448cb736733f5163fff96081d51ba4101567d61d22ee5998a7a399

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-goog-hash: crc32c=V11ayA==, md5=Cid9We/KA2mmmDZF4nNlng==
date: Mon, 10 Jan 2022 18:56:35 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 679077
cf-polished: origFmt=png, origSize=115129
x-guploader-uploadid: ADPycduo0UTEdnOX-MiABea3R9RVC-wUFGbcbM88E97re81Z722vGl7PPS0-v7ZFyRoBHDbyGT1R2Iixydz_fKctb0kf50Zd5w
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 54564
last-modified: Tue, 09 Feb 2021 15:11:24 GMT
server: cloudflare
etag: "0a277d59efca0369a6983645e273659e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2j3EXOy5TYtgU%2BugelHNeoaJPoVsSL56ne4WfC1mjeJUSVLHgWdX0C2F8SHtLbuuLhH9G7%2B23A49gGndCrHjiiLZvBemqgSB5Iv56MUz79Afv3jFHg6qmkQ4vIWe2hq0U73fGa%2BF7E%2BjH3n0"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1612883484779402
content-type: image/webp
expires: Tue, 11 Jan 2022 18:56:35 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 115129
accept-ranges: bytes
cf-ray: 6cb8204eee1559a1-MXP
cf-bgj: imgq:85,h2pri

GET
H2 200 94776D1EA84A2C016C3E2F4F2FF5CAFAE59DCE9271B62B383432451DCE910FAAE81B73D3436E567532B91B0BB75A1A9BC40155D0E940C698B45E520EC40D2A19
assets.ad4m.at/product_image/ Frame AA98 10 KB
11 KB 30ms
29ms Image
image/webp 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/product_image/94776D1EA84A2C016C3E2F4F2FF5CAFAE59DCE9271B62B383432451DCE910FAAE81B73D3436E567532B91B0BB75A1A9BC40155D0E940C698B45E520EC40D2A19
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19456%2C37798%2C43784&b=3bgFpf14UB6QC7HrHAtEt997f8TWTRead%2CR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=WrpSrfYdsYJxSYH5HjtDCXXGaPTET4QF2%2CQpKH4fdjUVpVhxH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=300&d=250&e=_OwIB0kJgnoo72azEguFwak0n4wXvwyG&g=a32850147392e3b86dbf8470661b2130%2F1923534534431354413&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1641840995555&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1kaxse13jzfjvjy1f1samqdr813pwhj3vjc1yq69s1tkxkya135qg3gzm8pybfcafnr427sa5kjryevrbj5qn3mc0hqw2hdck4amaqtmmejnd1pygvqz83seh2vp1f8tx8hpk4jjc1k74kma6nxrxrde7wsgwjvrqnmnds3fggm09e8m8rwr5k7zbrcgqct4w496x0sn68dqm7h5w28g4gpcfeh1w2ze97txc0sqfjmeg4wana4gyvds3j8s9287wat3p8rd4mhc6nt1hb3g%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCmheAYoHcYeHzDs-JiQbS4q6ICZDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQJeJQrmqPuyPqgDAaoEyQFP0NxSdZeeTExkgWPitZqixMwE86hW8nIaVVf-Wp7a1uZXqw3noJ66w82HtQrBmB5WwEwz09if_TcbGKEyXgMPhv7l1Cmqo9ra3nxDh6rz9Rz9vbU_lVp89sQFeWc4RECSRGnECDC1SpgsB_6lQEvZIY0KmMCulVNlWu0Auersl7IB9imDrg6i3PiM6y97a4PRJ-SNrp3Oes0fjy0ESqvjgDCH0zwDZNrIbJAWXJwvILGXQCYRxbDsvDHJuKcqjnJUrp4JHFFz-_KABry2mfOd_o_LMaAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%252526num%25253D1%252526sig%25253DAOD64_3zykky8NkaC4naf844LOUCHczl4g%252526client%25253Dca-pub-2979533909392588%252526adurl%25253D&y=1&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6aa4aec3bf9cf0b1c0b6ac8db92c9c0126c3642e0ceb730601a0d2db7083cac3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-goog-hash: crc32c=Wi8YDA==, md5=y9zKcIdRhNFPsyrXXLJEgg==
date: Mon, 10 Jan 2022 18:56:35 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 435466
cf-polished: qual=85, origFmt=jpeg, origSize=57873
x-guploader-uploadid: ADPycduBvlQ_VH8QgMQ6RSmNEG9iZIgX-gset4Q9oGtVWTB7LgmqW2KRD9iZPoaeTEMCJhETCX8056aSWauHKsNGupjyCQ9emg
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 10528
last-modified: Tue, 19 Oct 2021 12:57:42 GMT
server: cloudflare
etag: "cbdcca70875184d14fb32ad75cb24482"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=haG70s2yjLjXb6AUCdPjOV%2BJvOzrdGHpnIerfh%2FDePKSBKLdQvz0BJawWCaEjurJQiBQ%2BpXlpT42U%2FlfVo2DY4XuyUdV7e8sdYkcF8NqxVP8bbc1wkaUiiaclPx24rNVeIbgO5IOpY1QzP%2BW"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1634648262044462
content-type: image/webp
expires: Tue, 11 Jan 2022 18:56:35 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 57873
accept-ranges: bytes
cf-ray: 6cb8204eee1a59a1-MXP
cf-bgj: imgq:85,h2pri

GET
H/1.1

200
OK

/
partner.o2online.de/a/ Frame AA98
Redirect Chain

https://www.telefonica-partner.de/tpv.php?t=117679V1226132702M&subid=oneid3bgFpf14UB6QC7HrHAtEt997f8TWTReadoneid__asuid_OwIB0kJgnoo72azEguFwak0n4wXvwyGasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_...
https://www.lead-alliance.net/tpv.php?t=117679V1226132702M&subid=oneid3bgFpf14UB6QC7HrHAtEt997f8TWTReadoneid__asuid_OwIB0kJgnoo72azEguFwak0n4wXvwyGasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_cons...
https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117679&s_id=2022011019563561871183019X117679V1226132702MSoneid3bgFpf14UB6QC7HrHAtEt997f8TWTReadoneid__asuid_OwIB0k...

49 B
1 KB

46ms
20ms

Image
image/gif

78.46.85.162
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117679&s_id=2022011019563561871183019X117679V1226132702MSoneid3bgFpf14UB6QC7HrHAtEt997f8TWTReadoneid__asuid_OwIB0kJgnoo72azEguFwak0n4wXvwyGasuid__suite_Netmix_Reach43_TopRotaMonth&spid=2022011019563561871183019X117679V1226132702MSoneid3bgFpf14UB6QC7HrHAtEt997f8TWTReadoneid__asuid_OwIB0kJgnoo72azEguFwak0n4wXvwyGasuid__suite_Netmix_Reach43_TopRotaMonth&wfid=117679
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19456%2C37798%2C43784&b=3bgFpf14UB6QC7HrHAtEt997f8TWTRead%2CR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=WrpSrfYdsYJxSYH5HjtDCXXGaPTET4QF2%2CQpKH4fdjUVpVhxH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=300&d=250&e=_OwIB0kJgnoo72azEguFwak0n4wXvwyG&g=a32850147392e3b86dbf8470661b2130%2F1923534534431354413&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1641840995555&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1kaxse13jzfjvjy1f1samqdr813pwhj3vjc1yq69s1tkxkya135qg3gzm8pybfcafnr427sa5kjryevrbj5qn3mc0hqw2hdck4amaqtmmejnd1pygvqz83seh2vp1f8tx8hpk4jjc1k74kma6nxrxrde7wsgwjvrqnmnds3fggm09e8m8rwr5k7zbrcgqct4w496x0sn68dqm7h5w28g4gpcfeh1w2ze97txc0sqfjmeg4wana4gyvds3j8s9287wat3p8rd4mhc6nt1hb3g%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCmheAYoHcYeHzDs-JiQbS4q6ICZDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQJeJQrmqPuyPqgDAaoEyQFP0NxSdZeeTExkgWPitZqixMwE86hW8nIaVVf-Wp7a1uZXqw3noJ66w82HtQrBmB5WwEwz09if_TcbGKEyXgMPhv7l1Cmqo9ra3nxDh6rz9Rz9vbU_lVp89sQFeWc4RECSRGnECDC1SpgsB_6lQEvZIY0KmMCulVNlWu0Auersl7IB9imDrg6i3PiM6y97a4PRJ-SNrp3Oes0fjy0ESqvjgDCH0zwDZNrIbJAWXJwvILGXQCYRxbDsvDHJuKcqjnJUrp4JHFFz-_KABry2mfOd_o_LMaAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%252526num%25253D1%252526sig%25253DAOD64_3zykky8NkaC4naf844LOUCHczl4g%252526client%25253Dca-pub-2979533909392588%252526adurl%25253D&y=1&z=0
Protocol: HTTP/1.1
Server: 78.46.85.162 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: nonstopads1.sunbonet.de
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 10 Jan 2022 18:56:35 GMT
X-NODEIP: 78.46.85.162
Server: nginx/1.10.3 (Ubuntu)
RM-PrivacyPolicy: https://www.nonstoppartner.net/
P3P: policyref="https://a.nonstoppartner.net/w3c/p3p.a.xml", CP="NOI CUR OUR STP"
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=10
Content-Length: 49

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
x-content-type-options: nosniff
server: nginx
content-type: text/html; charset=UTF-8
location: https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117679&s_id=2022011019563561871183019X117679V1226132702MSoneid3bgFpf14UB6QC7HrHAtEt997f8TWTReadoneid__asuid_OwIB0kJgnoo72azEguFwak0n4wXvwyGasuid__suite_Netmix_Reach43_TopRotaMonth&spid=2022011019563561871183019X117679V1226132702MSoneid3bgFpf14UB6QC7HrHAtEt997f8TWTReadoneid__asuid_OwIB0kJgnoo72azEguFwak0n4wXvwyGasuid__suite_Netmix_Reach43_TopRotaMonth&wfid=117679
cache-control: no-store, no-cache, must-revalidate
x-xss-protection: 1; mode=block
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 DF9A32151D42BCC835EC0C9BE62CF0094313EE46FD4E5D3DC0F1217B7F8F1AD49F0F4DDF5D50AE1511A12D11F97A6BCA3DF8CE9D056CE7A3DC11AF6ED1255D71
assets.ad4m.at/logo/ Frame AA98 9 KB
10 KB 53ms
52ms Image
image/webp 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/DF9A32151D42BCC835EC0C9BE62CF0094313EE46FD4E5D3DC0F1217B7F8F1AD49F0F4DDF5D50AE1511A12D11F97A6BCA3DF8CE9D056CE7A3DC11AF6ED1255D71
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19456%2C37798%2C43784&b=3bgFpf14UB6QC7HrHAtEt997f8TWTRead%2CR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=WrpSrfYdsYJxSYH5HjtDCXXGaPTET4QF2%2CQpKH4fdjUVpVhxH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=300&d=250&e=_OwIB0kJgnoo72azEguFwak0n4wXvwyG&g=a32850147392e3b86dbf8470661b2130%2F1923534534431354413&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1641840995555&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1kaxse13jzfjvjy1f1samqdr813pwhj3vjc1yq69s1tkxkya135qg3gzm8pybfcafnr427sa5kjryevrbj5qn3mc0hqw2hdck4amaqtmmejnd1pygvqz83seh2vp1f8tx8hpk4jjc1k74kma6nxrxrde7wsgwjvrqnmnds3fggm09e8m8rwr5k7zbrcgqct4w496x0sn68dqm7h5w28g4gpcfeh1w2ze97txc0sqfjmeg4wana4gyvds3j8s9287wat3p8rd4mhc6nt1hb3g%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCmheAYoHcYeHzDs-JiQbS4q6ICZDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQJeJQrmqPuyPqgDAaoEyQFP0NxSdZeeTExkgWPitZqixMwE86hW8nIaVVf-Wp7a1uZXqw3noJ66w82HtQrBmB5WwEwz09if_TcbGKEyXgMPhv7l1Cmqo9ra3nxDh6rz9Rz9vbU_lVp89sQFeWc4RECSRGnECDC1SpgsB_6lQEvZIY0KmMCulVNlWu0Auersl7IB9imDrg6i3PiM6y97a4PRJ-SNrp3Oes0fjy0ESqvjgDCH0zwDZNrIbJAWXJwvILGXQCYRxbDsvDHJuKcqjnJUrp4JHFFz-_KABry2mfOd_o_LMaAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%252526num%25253D1%252526sig%25253DAOD64_3zykky8NkaC4naf844LOUCHczl4g%252526client%25253Dca-pub-2979533909392588%252526adurl%25253D&y=1&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5eeedf9055f9efab9127642b4c44135be9f404caa7ce08e51a5ea734dfd28828

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-goog-hash: crc32c=euqM8A==, md5=F0uw3DVkfiBLCaoSCWVgSg==
date: Mon, 10 Jan 2022 18:56:35 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1817905
cf-polished: origFmt=png, origSize=24833
x-guploader-uploadid: ADPycdtd_qzJJ2j8fLhc4MnJy8Pr9WXO00HsOwNKEMijhkjdKL7lwbsOmTLi6JDxSHzxUMKw-IAs7yuzXaCBOIMf-G4xdCME-A
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 9258
last-modified: Tue, 09 Feb 2021 15:11:57 GMT
server: cloudflare
etag: "174bb0dc35647e204b09aa120965604a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m9shVw1z5f2Ji3eoTZzx2YSzby18XdHrFhS3Ogb%2B8Vz1wonWMvIEQSLRcH4AYKos4vfKfQAQi0bV%2B%2B9Q0sKdirbhQlILb35yQlor17n3qyN%2BaK0%2FrhFOBkzNJf5fDUVm%2FqSmQ1mHAfRva%2FYy"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1612883517528266
content-type: image/webp
expires: Tue, 11 Jan 2022 18:56:35 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 24833
accept-ranges: bytes
cf-ray: 6cb8204eee1c59a1-MXP
cf-bgj: imgq:85,h2pri

GET
H2 200 4DE97418EB5F5BE9A71C11FD95916F9836DEEEC46AE84ACFA7D2376456F7A7C74F106F12C1A70D7E3A981D479BA3AF50577133602BE1F8B4B02B50A143BD72D1
assets.ad4m.at/product_image/ Frame AA98 19 KB
20 KB 51ms
50ms Image
image/webp 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/product_image/4DE97418EB5F5BE9A71C11FD95916F9836DEEEC46AE84ACFA7D2376456F7A7C74F106F12C1A70D7E3A981D479BA3AF50577133602BE1F8B4B02B50A143BD72D1
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19456%2C37798%2C43784&b=3bgFpf14UB6QC7HrHAtEt997f8TWTRead%2CR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=WrpSrfYdsYJxSYH5HjtDCXXGaPTET4QF2%2CQpKH4fdjUVpVhxH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=300&d=250&e=_OwIB0kJgnoo72azEguFwak0n4wXvwyG&g=a32850147392e3b86dbf8470661b2130%2F1923534534431354413&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1641840995555&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1kaxse13jzfjvjy1f1samqdr813pwhj3vjc1yq69s1tkxkya135qg3gzm8pybfcafnr427sa5kjryevrbj5qn3mc0hqw2hdck4amaqtmmejnd1pygvqz83seh2vp1f8tx8hpk4jjc1k74kma6nxrxrde7wsgwjvrqnmnds3fggm09e8m8rwr5k7zbrcgqct4w496x0sn68dqm7h5w28g4gpcfeh1w2ze97txc0sqfjmeg4wana4gyvds3j8s9287wat3p8rd4mhc6nt1hb3g%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCmheAYoHcYeHzDs-JiQbS4q6ICZDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQJeJQrmqPuyPqgDAaoEyQFP0NxSdZeeTExkgWPitZqixMwE86hW8nIaVVf-Wp7a1uZXqw3noJ66w82HtQrBmB5WwEwz09if_TcbGKEyXgMPhv7l1Cmqo9ra3nxDh6rz9Rz9vbU_lVp89sQFeWc4RECSRGnECDC1SpgsB_6lQEvZIY0KmMCulVNlWu0Auersl7IB9imDrg6i3PiM6y97a4PRJ-SNrp3Oes0fjy0ESqvjgDCH0zwDZNrIbJAWXJwvILGXQCYRxbDsvDHJuKcqjnJUrp4JHFFz-_KABry2mfOd_o_LMaAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%252526num%25253D1%252526sig%25253DAOD64_3zykky8NkaC4naf844LOUCHczl4g%252526client%25253Dca-pub-2979533909392588%252526adurl%25253D&y=1&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ff52cd6fa87197e500ac404574525aeeb1b9d184f90a74e19197f6fc159e6107

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-goog-hash: crc32c=JbWtsw==, md5=JJTrR/gVHMvTHm8bHvL8+Q==
date: Mon, 10 Jan 2022 18:56:35 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 431113
cf-polished: qual=85, origFmt=jpeg, origSize=136162
x-guploader-uploadid: ADPycdsmmKvxIcqqi1Q5Q_6_EnaAruD9aepjCK4C0UVCDZqISyqWkpn-MBvHZ7TNW7AgQjcUGEz1whNbRfcGlzlhkA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 19842
last-modified: Thu, 21 Oct 2021 09:14:42 GMT
server: cloudflare
etag: "2494eb47f8151ccbd31e6f1b1ef2fcf9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1c8lIYdH1n538Z3EzBcBwL699GGahA%2BSJBX91F%2FFEg0ORWJWt5p4l0qiLxLZ7zdSNFmYxIa66fI6zJLqxWVdhPECd9i3GnWffqPZv17jQ6ud6H7JJ0J9UHGHhx1si%2FEASs%2BjJD84rSmf1ZQP"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1634807682206403
content-type: image/webp
expires: Tue, 11 Jan 2022 18:56:35 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 136162
accept-ranges: bytes
cf-ray: 6cb8204eee1f59a1-MXP
cf-bgj: imgq:85,h2pri

GET
H/1.1

200
OK

/
partner.blau.de/a/ Frame AA98
Redirect Chain

https://www.telefonica-partner.de/tpv.php?t=117663V1225131106M&subid=oneidR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7oneid__asuid_OwIB0kJgnoo72azEguFwak0n4wXvwyGasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_...
https://www.lead-alliance.net/tpv.php?t=117663V1225131106M&subid=oneidR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7oneid__asuid_OwIB0kJgnoo72azEguFwak0n4wXvwyGasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_cons...
https://partner.blau.de/a/?i=pview&client=blau&camp=pview&l=de&nw=lea1&affiliate=117663&s_id=2022011019563561871182995X117663V1225131106MSoneidR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7oneid__asuid_OwIB0kJg...

49 B
1 KB

45ms
18ms

Image
image/gif

46.4.41.145
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partner.blau.de/a/?i=pview&client=blau&camp=pview&l=de&nw=lea1&affiliate=117663&s_id=2022011019563561871182995X117663V1225131106MSoneidR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7oneid__asuid_OwIB0kJgnoo72azEguFwak0n4wXvwyGasuid__suite_Netmix_Reach43_TopRotaMonth
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19456%2C37798%2C43784&b=3bgFpf14UB6QC7HrHAtEt997f8TWTRead%2CR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=WrpSrfYdsYJxSYH5HjtDCXXGaPTET4QF2%2CQpKH4fdjUVpVhxH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=300&d=250&e=_OwIB0kJgnoo72azEguFwak0n4wXvwyG&g=a32850147392e3b86dbf8470661b2130%2F1923534534431354413&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1641840995555&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1kaxse13jzfjvjy1f1samqdr813pwhj3vjc1yq69s1tkxkya135qg3gzm8pybfcafnr427sa5kjryevrbj5qn3mc0hqw2hdck4amaqtmmejnd1pygvqz83seh2vp1f8tx8hpk4jjc1k74kma6nxrxrde7wsgwjvrqnmnds3fggm09e8m8rwr5k7zbrcgqct4w496x0sn68dqm7h5w28g4gpcfeh1w2ze97txc0sqfjmeg4wana4gyvds3j8s9287wat3p8rd4mhc6nt1hb3g%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCmheAYoHcYeHzDs-JiQbS4q6ICZDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQJeJQrmqPuyPqgDAaoEyQFP0NxSdZeeTExkgWPitZqixMwE86hW8nIaVVf-Wp7a1uZXqw3noJ66w82HtQrBmB5WwEwz09if_TcbGKEyXgMPhv7l1Cmqo9ra3nxDh6rz9Rz9vbU_lVp89sQFeWc4RECSRGnECDC1SpgsB_6lQEvZIY0KmMCulVNlWu0Auersl7IB9imDrg6i3PiM6y97a4PRJ-SNrp3Oes0fjy0ESqvjgDCH0zwDZNrIbJAWXJwvILGXQCYRxbDsvDHJuKcqjnJUrp4JHFFz-_KABry2mfOd_o_LMaAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%252526num%25253D1%252526sig%25253DAOD64_3zykky8NkaC4naf844LOUCHczl4g%252526client%25253Dca-pub-2979533909392588%252526adurl%25253D&y=1&z=0
Protocol: HTTP/1.1
Server: 46.4.41.145 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: nonstopads2.sunbonet.de
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 10 Jan 2022 18:56:35 GMT
X-NODEIP: 46.4.41.145
Server: nginx/1.10.3 (Ubuntu)
RM-PrivacyPolicy: https://www.nonstoppartner.net/
P3P: policyref="https://a.nonstoppartner.net/w3c/p3p.a.xml", CP="NOI CUR OUR STP"
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=10
Content-Length: 49

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
x-content-type-options: nosniff
server: nginx
content-type: text/html; charset=UTF-8
location: https://partner.blau.de/a/?i=pview&client=blau&camp=pview&l=de&nw=lea1&affiliate=117663&s_id=2022011019563561871182995X117663V1225131106MSoneidR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7oneid__asuid_OwIB0kJgnoo72azEguFwak0n4wXvwyGasuid__suite_Netmix_Reach43_TopRotaMonth
cache-control: no-store, no-cache, must-revalidate
x-xss-protection: 1; mode=block
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 C35143419725FFAB72E7F85B0896E2CE1CF38E8530EF6A0FABB9A59404159EF275766FB79658D3B5D6644C20EACFACC3D3AEC4962CC34DBF676104F9A9E97E4B
assets.ad4m.at/logo/ Frame AA98 12 KB
12 KB 32ms
32ms Image
image/webp 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/C35143419725FFAB72E7F85B0896E2CE1CF38E8530EF6A0FABB9A59404159EF275766FB79658D3B5D6644C20EACFACC3D3AEC4962CC34DBF676104F9A9E97E4B
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19456%2C37798%2C43784&b=3bgFpf14UB6QC7HrHAtEt997f8TWTRead%2CR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=WrpSrfYdsYJxSYH5HjtDCXXGaPTET4QF2%2CQpKH4fdjUVpVhxH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=300&d=250&e=_OwIB0kJgnoo72azEguFwak0n4wXvwyG&g=a32850147392e3b86dbf8470661b2130%2F1923534534431354413&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1641840995555&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1kaxse13jzfjvjy1f1samqdr813pwhj3vjc1yq69s1tkxkya135qg3gzm8pybfcafnr427sa5kjryevrbj5qn3mc0hqw2hdck4amaqtmmejnd1pygvqz83seh2vp1f8tx8hpk4jjc1k74kma6nxrxrde7wsgwjvrqnmnds3fggm09e8m8rwr5k7zbrcgqct4w496x0sn68dqm7h5w28g4gpcfeh1w2ze97txc0sqfjmeg4wana4gyvds3j8s9287wat3p8rd4mhc6nt1hb3g%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCmheAYoHcYeHzDs-JiQbS4q6ICZDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQJeJQrmqPuyPqgDAaoEyQFP0NxSdZeeTExkgWPitZqixMwE86hW8nIaVVf-Wp7a1uZXqw3noJ66w82HtQrBmB5WwEwz09if_TcbGKEyXgMPhv7l1Cmqo9ra3nxDh6rz9Rz9vbU_lVp89sQFeWc4RECSRGnECDC1SpgsB_6lQEvZIY0KmMCulVNlWu0Auersl7IB9imDrg6i3PiM6y97a4PRJ-SNrp3Oes0fjy0ESqvjgDCH0zwDZNrIbJAWXJwvILGXQCYRxbDsvDHJuKcqjnJUrp4JHFFz-_KABry2mfOd_o_LMaAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%252526num%25253D1%252526sig%25253DAOD64_3zykky8NkaC4naf844LOUCHczl4g%252526client%25253Dca-pub-2979533909392588%252526adurl%25253D&y=1&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 47ec02e18941bc1fe215e0bf1b47eaef6dd674b8adfb18d17e980203a94b9ff4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-goog-hash: crc32c=L9xAnQ==, md5=7eHZFVWQuqeYNRiE/JSb0A==
date: Mon, 10 Jan 2022 18:56:35 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 431078
cf-polished: qual=85, origFmt=jpeg, origSize=42488
x-guploader-uploadid: ADPycduhuWOiD34Gm5EJJqOQXV87je8XZ25lul20omgCDWN0j0bVD997wQQRVEsmtYVP9nIyTUdy7eEwfGejeTwbJPtGk0EoyQ
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 12110
last-modified: Thu, 25 Jun 2020 11:29:58 GMT
server: cloudflare
etag: "ede1d9155590baa798351884fc949bd0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OykFwpj33%2FM88zypZjGaTEzcEmZvop4nevoYjFIfd0T13hL%2BLoTxipHJdgEtO5Pkc%2Bnc%2FTuWzX88aYPrXcTOQkA7jAdtcytYhmeWtotkN%2FNrCxS5Af1%2FKMEWi0gNXPkd1U1zTZhnf1kb68Az"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1593084598972955
content-type: image/webp
expires: Tue, 11 Jan 2022 18:56:35 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 42488
accept-ranges: bytes
cf-ray: 6cb8204eee2259a1-MXP
cf-bgj: imgq:85,h2pri

GET
H2 200 6B38C70234B9F3188DD5EE431E82865D3F73254228570FEAA8E0EC084126CA428EE25DBF94F692B9BBC7FE9C22F4F555A804B8157CE8832EEFA3C4F5253BE361
assets.ad4m.at/product_image/ Frame AA98 72 KB
73 KB 52ms
52ms Image
image/webp 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/product_image/6B38C70234B9F3188DD5EE431E82865D3F73254228570FEAA8E0EC084126CA428EE25DBF94F692B9BBC7FE9C22F4F555A804B8157CE8832EEFA3C4F5253BE361
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19456%2C37798%2C43784&b=3bgFpf14UB6QC7HrHAtEt997f8TWTRead%2CR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=WrpSrfYdsYJxSYH5HjtDCXXGaPTET4QF2%2CQpKH4fdjUVpVhxH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=300&d=250&e=_OwIB0kJgnoo72azEguFwak0n4wXvwyG&g=a32850147392e3b86dbf8470661b2130%2F1923534534431354413&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1641840995555&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1kaxse13jzfjvjy1f1samqdr813pwhj3vjc1yq69s1tkxkya135qg3gzm8pybfcafnr427sa5kjryevrbj5qn3mc0hqw2hdck4amaqtmmejnd1pygvqz83seh2vp1f8tx8hpk4jjc1k74kma6nxrxrde7wsgwjvrqnmnds3fggm09e8m8rwr5k7zbrcgqct4w496x0sn68dqm7h5w28g4gpcfeh1w2ze97txc0sqfjmeg4wana4gyvds3j8s9287wat3p8rd4mhc6nt1hb3g%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCmheAYoHcYeHzDs-JiQbS4q6ICZDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQJeJQrmqPuyPqgDAaoEyQFP0NxSdZeeTExkgWPitZqixMwE86hW8nIaVVf-Wp7a1uZXqw3noJ66w82HtQrBmB5WwEwz09if_TcbGKEyXgMPhv7l1Cmqo9ra3nxDh6rz9Rz9vbU_lVp89sQFeWc4RECSRGnECDC1SpgsB_6lQEvZIY0KmMCulVNlWu0Auersl7IB9imDrg6i3PiM6y97a4PRJ-SNrp3Oes0fjy0ESqvjgDCH0zwDZNrIbJAWXJwvILGXQCYRxbDsvDHJuKcqjnJUrp4JHFFz-_KABry2mfOd_o_LMaAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%252526num%25253D1%252526sig%25253DAOD64_3zykky8NkaC4naf844LOUCHczl4g%252526client%25253Dca-pub-2979533909392588%252526adurl%25253D&y=1&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 40ce033c8ee824b2a4e435541df84a0d95075fafa382deb7a91c02f9e15bbe1d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-goog-hash: crc32c=FQtvKA==, md5=fhrs2Vg2w7QpQT0tLI6VHw==
date: Mon, 10 Jan 2022 18:56:35 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 433684
cf-polished: origFmt=png, origSize=128410
x-guploader-uploadid: ADPycducuuZXfiqWp-319Ns5OzjiA0YggBErZRm0zUk95lx3LU-K63ekk1Txd7iCWNKxj-6claUMMb7jV0nqfK3pI5xGEZ1hmA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 73694
last-modified: Fri, 10 Dec 2021 12:01:51 GMT
server: cloudflare
etag: "7e1aecd95836c3b429413d2d2c8e951f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l%2BWEMpprgqaFaXFFmS0tSP3l3smq38h3NHvNjjZ9CNFDQF6yzDqdcRaki9Nj9Xd2GkcM3OG6Q%2F%2FtuYXQKY8neeTl06%2Fryw1kyall9kIfQZn8RDJiL9vrwvyDQHicAZKd9mUQzRlBBKStalWu"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1639137711863674
content-type: image/webp
expires: Tue, 11 Jan 2022 18:56:35 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 128410
accept-ranges: bytes
cf-ray: 6cb8204eee2659a1-MXP
cf-bgj: imgq:85,h2pri

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 6E40 0
9 B 7ms
7ms Image
text/plain 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?HWzmVw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:56:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H/1.1 200
OK link.html Show response
track.webgains.com/ Frame AA98 1 KB
2 KB 233ms
112ms Script
text/html 46.236.13.147
PULSANT-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=3247721&wgcampaignid=1384975&js=1&nw=1&clickref=oneid64rFefw3feAxfeHmHYtECxVms2T1Tjga7oneid__asuid_OwIB0kJgnoo72azEguFwak0n4wXvwyGasuid__suite_Netmix_Reach43_TopRotaMonth&viewref=oneidMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3oneid__asuid_OwIB0kJgnoo72azEguFwak0n4wXvwyGasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd=0
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19456%2C37798%2C43784&b=3bgFpf14UB6QC7HrHAtEt997f8TWTRead%2CR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=WrpSrfYdsYJxSYH5HjtDCXXGaPTET4QF2%2CQpKH4fdjUVpVhxH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=300&d=250&e=_OwIB0kJgnoo72azEguFwak0n4wXvwyG&g=a32850147392e3b86dbf8470661b2130%2F1923534534431354413&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1641840995555&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1kaxse13jzfjvjy1f1samqdr813pwhj3vjc1yq69s1tkxkya135qg3gzm8pybfcafnr427sa5kjryevrbj5qn3mc0hqw2hdck4amaqtmmejnd1pygvqz83seh2vp1f8tx8hpk4jjc1k74kma6nxrxrde7wsgwjvrqnmnds3fggm09e8m8rwr5k7zbrcgqct4w496x0sn68dqm7h5w28g4gpcfeh1w2ze97txc0sqfjmeg4wana4gyvds3j8s9287wat3p8rd4mhc6nt1hb3g%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCmheAYoHcYeHzDs-JiQbS4q6ICZDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQJeJQrmqPuyPqgDAaoEyQFP0NxSdZeeTExkgWPitZqixMwE86hW8nIaVVf-Wp7a1uZXqw3noJ66w82HtQrBmB5WwEwz09if_TcbGKEyXgMPhv7l1Cmqo9ra3nxDh6rz9Rz9vbU_lVp89sQFeWc4RECSRGnECDC1SpgsB_6lQEvZIY0KmMCulVNlWu0Auersl7IB9imDrg6i3PiM6y97a4PRJ-SNrp3Oes0fjy0ESqvjgDCH0zwDZNrIbJAWXJwvILGXQCYRxbDsvDHJuKcqjnJUrp4JHFFz-_KABry2mfOd_o_LMaAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%252526num%25253D1%252526sig%25253DAOD64_3zykky8NkaC4naf844LOUCHczl4g%252526client%25253Dca-pub-2979533909392588%252526adurl%25253D&y=1&z=0
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN12703 (PULSANT-AS, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 35e182b0fbc3d00532f9dee1e40f3c20d44dcbf6380c73e53a0704b49ff107e9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 18:56:35 GMT
Last-Modified: Mon, 10 Jan 2022 18:56:35 GMT
Server: Apache
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: text/html;charset=utf-8
Content-Length: 1481
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 43ms
43ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20220104&jk=4150545889650970&bg=!cHOlczfNAAbDtiZlw7Y7ACkAdvg8WgskHvr-YtfILfI_nhHb8eXunqKy5OWPeJygDGDOqNnVhrBzzgIAAABjUgAAAA1oAQeZAn6LOBShs-Xh_zh_RGZ9gN3vDO6W2Y_FqGMoEi4hVvhfCgJXlO2e43_yTJcdeWHrSxZs2VaOtdSLBjrP7EudLfCiSsN5xC3_u2IOREB-yqCwlUuHfcvA1XAMo6UzwbrbFhoc0O6-aNcUT7cDacHBMsKTaUhw4GGYjM-xKcMhZCWi8a-RickgDf-D5mNnrPpQyqZVz5vnCgMteAvfbtxcebeK7XupDUUbLiW74KRJRwIT91FV9TK1Sd_eByFfkxZqVqvhAVi70KQDmh7yR5THmK12I6u788KGW8RDlcC010DS2yM31RvJw2_nm47S6e824aNdb8clzs62E_0uES2g5-LRCzvV4qznNfyBFv9UAXUVRIfIq74ne-6hJrUiy1ojus52WQCCyBVwVqDH3bxUeMJP6wei7IkohzgE5fKMJi9Osf5ygVjpBBNvsanrPH7rxsJhoZarF49d2cDRN4ZRZioO_Blr5XDFAvIATG-F7wi6bNp--IIVK5kZs6KDCkT_i6_5TdYFqppAiaWS29JsSPrSIT-VMrp7YFzSLyfZHbGOEcAyw2ZIXbPPd7ed73UQyJHArZibIjXBnMp06FV9EG4Tw5RYTox7OBpME0OPEPfjVuSEof3NRq9CTMvMmOF4mb-RpZ2vhXikkH4Dlxhp8HgSG2HP10SM2bxKaliEhtY8_eIAF0Ihetlj0Tay99oD41NbyKJKriB0UgmMQMZdX6UDy1siYiJjY0-pnJtfhdqvx4-thIQqkH1_DC0KS-zyYog7IK_seRVUCOPNIt9QJQu9etTUaelREcUrs14ELW9TrUTbIToPjJu_Ppmtrp3RmrTnW1ZIeZn2BGqaQK4UDQ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 37E1 42 B
64 B 40ms
40ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstkAChhH7T6rUBM_tDxFFAyEP3hpFhC_u5h646dN97ByjhIunSn6-eN0nnNGsG9EFbK4Ehyi8QITS8aSrJN1y9w&sig=Cg0ArKJSzGHaPhqaJBurEAE&cid=CAASF-RopWEKJR_4iqLjjG3esUAEa99STIi1&id=lidar2&mcvt=1000&p=0,0,90,728&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&v=20220105&bin=7&avms=nio&bs=0,0&mc=0.74&if=1&app=0&itpl=20&adk=2342716466&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1641840994193&rpt=613&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:35 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame AA98 51 KB
51 KB 25ms
8ms Script
application/javascript 18.66.97.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=3247721&wgcampaignid=1384975&js=1&nw=1&clickref=oneid64rFefw3feAxfeHmHYtECxVms2T1Tjga7oneid__asuid_OwIB0kJgnoo72azEguFwak0n4wXvwyGasuid__suite_Netmix_Reach43_TopRotaMonth&viewref=oneidMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3oneid__asuid_OwIB0kJgnoo72azEguFwak0n4wXvwyGasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-126.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c6ce2b47cde7cf913a3c34ddce355fa9c75012577dd34c35928add8676cb7fa0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-version-id: wvDglZsFnxZ0eZ1mUErJkFMo1VNidWYJ
via: 1.1 9015971351bc982a04ee209a022bb1f8.cloudfront.net (CloudFront)
last-modified: Tue, 09 Nov 2021 11:05:10 GMT
server: AmazonS3
age: 69091
etag: "ec0ced40cbb5211db06b8a36f209e442"
x-cache: Hit from cloudfront
content-type: application/javascript
date: Sun, 09 Jan 2022 23:45:04 GMT
x-amz-cf-pop: FRA56-P2
accept-ranges: bytes
content-length: 51794
x-amz-cf-id: t4jkDNQnt7dI-CnOr4WPnDV5HoOIc5Hpx7jbZF_HfxRz5qPCkT-wRA==

GET
H/1.1 200
OK link.html
track.webgains.com/ Frame AA98 25 KB
26 KB 94ms
36ms Image
image/png 46.236.13.147
PULSANT-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.webgains.com/link.html?wgcampaignid=1384975&viewref=oneid7epSqfW8gUGEAFrHXHgtAtr64fGT1TrKzTMoneid__asuidHHv7MWPvbODefU0XkvJ1OLlo7ws_6gCFasuid__suite_Netmix_Reach100_SSP_CONTROL_INDEX&wglinkid=3247721
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19456%2C37798%2C43784&b=3bgFpf14UB6QC7HrHAtEt997f8TWTRead%2CR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=WrpSrfYdsYJxSYH5HjtDCXXGaPTET4QF2%2CQpKH4fdjUVpVhxH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=300&d=250&e=_OwIB0kJgnoo72azEguFwak0n4wXvwyG&g=a32850147392e3b86dbf8470661b2130%2F1923534534431354413&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1641840995555&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1kaxse13jzfjvjy1f1samqdr813pwhj3vjc1yq69s1tkxkya135qg3gzm8pybfcafnr427sa5kjryevrbj5qn3mc0hqw2hdck4amaqtmmejnd1pygvqz83seh2vp1f8tx8hpk4jjc1k74kma6nxrxrde7wsgwjvrqnmnds3fggm09e8m8rwr5k7zbrcgqct4w496x0sn68dqm7h5w28g4gpcfeh1w2ze97txc0sqfjmeg4wana4gyvds3j8s9287wat3p8rd4mhc6nt1hb3g%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCmheAYoHcYeHzDs-JiQbS4q6ICZDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQJeJQrmqPuyPqgDAaoEyQFP0NxSdZeeTExkgWPitZqixMwE86hW8nIaVVf-Wp7a1uZXqw3noJ66w82HtQrBmB5WwEwz09if_TcbGKEyXgMPhv7l1Cmqo9ra3nxDh6rz9Rz9vbU_lVp89sQFeWc4RECSRGnECDC1SpgsB_6lQEvZIY0KmMCulVNlWu0Auersl7IB9imDrg6i3PiM6y97a4PRJ-SNrp3Oes0fjy0ESqvjgDCH0zwDZNrIbJAWXJwvILGXQCYRxbDsvDHJuKcqjnJUrp4JHFFz-_KABry2mfOd_o_LMaAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%252526num%25253D1%252526sig%25253DAOD64_3zykky8NkaC4naf844LOUCHczl4g%252526client%25253Dca-pub-2979533909392588%252526adurl%25253D&y=1&z=0
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN12703 (PULSANT-AS, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 4bcba6ca13d0bf1606176d2408363d0370505b999089d312da533a86406ba2e3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 18:56:35 GMT
Last-Modified: Mon, 10 Jan 2022 18:56:35 GMT
Server: Apache
Transfer-Encoding: chunked
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: image/png
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 68F2 42 B
64 B 40ms
40ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsudu07rIBuuZperhMqO1PzLmt6ODpU3si83tYMgyomZhbfnQGIsnPHQTKWwyA-IwhV8N6t4sTXL5yzvmUzVUvOC&sig=Cg0ArKJSzN0jJeqq0VkfEAE&cid=CAASF-Ro6-s95MEgozCaz_jhrv_CVMQUfrvp&id=lidar2&mcvt=1000&p=0,0,90,728&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220105&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=2715274491&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1641840994186&rpt=913&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 18:56:36 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 86AE 0
127 B 13ms
13ms Ping
text/plain 178.250.2.150
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.150 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 10 Jan 2022 18:56:36 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

POST
H2 200 all
csm.eu.criteo.net/ Frame 9C60 0
127 B 13ms
13ms Ping
text/plain 178.250.2.150
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.150 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 10 Jan 2022 18:56:36 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame AA98 16 B
232 B 82ms
82ms Fetch
application/json 54.72.0.164
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.72.0.164 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/7.4.25

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 10 Jan 2022 18:56:36 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/7.4.25
x-frame-options: SAMEORIGIN
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 110ms
31ms Preflight 54.72.0.164
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.72.0.164 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-72-0-164.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://as.ad4m.at
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 10 Jan 2022 18:56:36 GMT
server: nginx
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 9C60 1 KB
1 KB 16ms
16ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS