www.richrainbows.com Open in urlscan Pro
18.202.254.38 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://richrainbows.com/aec/qbot.zip
Effective URL:
https://www.richrainbows.com/aec/qbot.zip
Submission Tags: falconsandbox
Submission: On February 25 via api (February 25th 2023, 1:31:18 am UTC) from US — Scanned from DE

Summary HTTP 226 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 32 IPs in 5 countries across 16 domains to perform 226 HTTP transactions. The main IP is 18.202.254.38, located in Dublin, Ireland and belongs to AMAZON-02, US. The main domain is www.richrainbows.com.
TLS certificate: Issued by R3 on January 24th 2023. Valid for: 3 months.

This is the only time www.richrainbows.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 38	18.202.254.38 18.202.254.38	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:400d:804::2008	15169 (GOOGLE) (GOOGLE)
7	2600:9000:206... 2600:9000:206f:ba00:4:c961:9640:93a1	16509 (AMAZON-02) (AMAZON-02)
11	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
1	192.243.61.225 192.243.61.225	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
1	2a00:1450:400... 2a00:1450:4001:813::200e	15169 (GOOGLE) (GOOGLE)
5	2606:4700::68... 2606:4700::6812:d73b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:829::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:830::200a	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:400d:80a::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:806::200a	15169 (GOOGLE) (GOOGLE)
10	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c0c::9a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
1	18.205.36.100 18.205.36.100	14618 (AMAZON-AES) (AMAZON-AES)
3	2a00:1450:400... 2a00:1450:400d:80a::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400d:80c::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82f::2004	15169 (GOOGLE) (GOOGLE)
11	2a00:1450:400... 2a00:1450:4001:803::2001	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:801::2002	15169 (GOOGLE) (GOOGLE)
2	2a02:2638:3::9 2a02:2638:3::9	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
4	2a02:2638::b 2a02:2638::b	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	2a02:2638::2 2a02:2638::2	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
44	2a02:2638::3 2a02:2638::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
4	178.250.0.160 178.250.0.160	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
45	2a02:2638::c 2a02:2638::c	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
8	2a02:2638:3::1a 2a02:2638:3::1a	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2a00:1450:400... 2a00:1450:4001:82b::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
226	32

38 18.202.254.38 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: lion.whogohost.com

richrainbows.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.richrainbows.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:400d:804::2008 (Ireland)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2600:9000:206f:ba00:4:c961:9640:93a1 (United States)

ASN16509 (AMAZON-02, US)

a.mailmunch.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.243.61.225 (Ashburn, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

thinkseducation.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

translate.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6812:d73b (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:829::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:400d:80a::2003 (Ireland)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

translate.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c0c::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.205.36.100 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-205-36-100.compute-1.amazonaws.com

forms.mailmunch.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:400d:80a::2002 (Ireland)

ASN15169 (GOOGLE, US)

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400d:80c::2002 (Ireland)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:803::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:801::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638:3::9 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

rtb.nl3.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:2638::b (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

ads.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638::2 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

rtb.fr.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

44 2a02:2638::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 178.250.0.160 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

cat.fr.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

45 2a02:2638::c (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

pix.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a02:2638:3::1a (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

csm.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
97	criteo.net static.criteo.net — Cisco Umbrella Rank: 625 pix.eu.criteo.net — Cisco Umbrella Rank: 7936 csm.eu.criteo.net — Cisco Umbrella Rank: 8487	525 KB
38	richrainbows.com 1 redirects richrainbows.com www.richrainbows.com	673 KB
22	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 102 tpc.googlesyndication.com — Cisco Umbrella Rank: 140	295 KB
12	criteo.com rtb.nl3.eu.criteo.com — Cisco Umbrella Rank: 13386 ads.eu.criteo.com — Cisco Umbrella Rank: 8414 rtb.fr.eu.criteo.com — Cisco Umbrella Rank: 15753 cat.fr.eu.criteo.com — Cisco Umbrella Rank: 9640	211 KB
12	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 35 stats.g.doubleclick.net — Cisco Umbrella Rank: 77	53 KB
8	mailmunch.co a.mailmunch.co — Cisco Umbrella Rank: 16302 forms.mailmunch.co — Cisco Umbrella Rank: 16892	130 KB
6	gstatic.com www.gstatic.com fonts.gstatic.com	85 KB
6	google.com translate.google.com — Cisco Umbrella Rank: 1204 region1.analytics.google.com — Cisco Umbrella Rank: 4370 adservice.google.com — Cisco Umbrella Rank: 73 www.google.com — Cisco Umbrella Rank: 2	30 KB
5	onesignal.com cdn.onesignal.com — Cisco Umbrella Rank: 3505 onesignal.com — Cisco Umbrella Rank: 1365	82 KB
4	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 183	194 KB
4	google.de www.google.de — Cisco Umbrella Rank: 6149 adservice.google.de — Cisco Umbrella Rank: 8947	1 KB
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 30	21 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 44	209 KB
3	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 306 translate.googleapis.com — Cisco Umbrella Rank: 845 fonts.googleapis.com — Cisco Umbrella Rank: 36	109 KB
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 855	606 B
1	thinkseducation.com thinkseducation.com
226	16

	Domain	Requested by
45	pix.eu.criteo.net	ads.eu.criteo.com www.richrainbows.com
44	static.criteo.net	ads.eu.criteo.com static.criteo.net
37	www.richrainbows.com	www.richrainbows.com
11	tpc.googlesyndication.com	googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com
11	pagead2.googlesyndication.com	www.richrainbows.com pagead2.googlesyndication.com www.googletagservices.com tpc.googlesyndication.com
10	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net www.richrainbows.com
8	csm.eu.criteo.net	ads.eu.criteo.com
7	a.mailmunch.co	www.richrainbows.com a.mailmunch.co ajax.googleapis.com
4	cat.fr.eu.criteo.com	ads.eu.criteo.com
4	ads.eu.criteo.com	googleads.g.doubleclick.net
4	www.googletagservices.com	googleads.g.doubleclick.net
4	www.gstatic.com	www.richrainbows.com www.gstatic.com
4	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
4	www.googletagmanager.com	www.richrainbows.com www.googletagmanager.com
3	onesignal.com	cdn.onesignal.com
2	fonts.gstatic.com	fonts.googleapis.com
2	rtb.fr.eu.criteo.com	googleads.g.doubleclick.net www.richrainbows.com
2	rtb.nl3.eu.criteo.com	googleads.g.doubleclick.net www.richrainbows.com
2	www.google.com	www.richrainbows.com tpc.googlesyndication.com
2	adservice.google.com	pagead2.googlesyndication.com
2	adservice.google.de	pagead2.googlesyndication.com
2	www.google.de	www.richrainbows.com
2	stats.g.doubleclick.net	www.googletagmanager.com www.google-analytics.com
2	cdn.onesignal.com	www.richrainbows.com cdn.onesignal.com
1	fonts.googleapis.com	a.mailmunch.co
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	forms.mailmunch.co	a.mailmunch.co
1	region1.analytics.google.com	www.googletagmanager.com
1	translate.googleapis.com
1	ajax.googleapis.com	a.mailmunch.co
1	translate.google.com	www.richrainbows.com
1	thinkseducation.com	www.richrainbows.com
1	richrainbows.com	1 redirects
226	33

This site contains links to these domains. Also see Links.

Domain
www.youtube.com
rumble.com
jegtheme.com
facebook.com
twitter.com
translate.google.com

Subject Issuer	Validity	Valid
richrainbows.com R3	`2023-01-24` - `2023-04-24`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-02-08` - `2023-05-03`	3 months	crt.sh
*.mailmunch.co Amazon	`2022-12-26` - `2024-01-24`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-02-08` - `2023-05-03`	3 months	crt.sh
allmygreatestlife.com R3	`2023-02-09` - `2023-05-10`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-02-08` - `2023-05-03`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-03` - `2023-06-02`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-02-08` - `2023-05-03`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-02-08` - `2023-05-03`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-02-08` - `2023-05-03`	3 months	crt.sh
forms.mailmunch.co R3	`2023-01-15` - `2023-04-15`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2023-02-08` - `2023-05-03`	3 months	crt.sh
*.google.de GTS CA 1C3	`2023-02-08` - `2023-05-03`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-02-08` - `2023-05-03`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-02-08` - `2023-05-03`	3 months	crt.sh
*.nl3.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-01-04` - `2023-04-05`	3 months	crt.sh
*.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-12-22` - `2023-03-26`	3 months	crt.sh
*.fr.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-02-18` - `2023-05-20`	3 months	crt.sh
*.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-01-13` - `2023-04-15`	3 months	crt.sh
*.eu.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-01-13` - `2023-04-17`	3 months	crt.sh

This page contains 15 frames:

Primary Page: https://www.richrainbows.com/aec/qbot.zip
Frame ID: DA25D5FD42991FA8EF584E14CABA8A14
Requests: 84 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230222/r20190131/zrt_lookup.html
Frame ID: 9A68B222229BE0962E95D95E553F8639
Requests: 1 HTTP requests in this frame

Frame: data://truncated
Frame ID: CF848DE2DDF28102E158DD3F5786FF2B
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9538727938022233&output=html&adk=1812271804&adf=1573534164&lmt=1677288670&plat=3%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=212x675_r&format=0x0&url=https%3A%2F%2Fwww.richrainbows.com%2Faec%2Fqbot.zip&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1677288670470&bpp=6&bdt=534&idt=321&shv=r20230222&mjsv=m202302150101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=3110296830212&frm=20&pv=2&ga_vid=397696976.1677288671&ga_sid=1677288671&ga_hid=1401903725&ga_fc=1&ga_cid=1927876617.1677288671&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44777876%2C44759837%2C31071756%2C31072480&oid=2&pvsid=856095500874408&tmod=908495160&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=420
Frame ID: D94A1FD8BEC27CAC21F5B16C6424F650
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9538727938022233&output=html&h=280&slotname=9292693240&adk=328962951&adf=3025194257&pi=t.ma~as.9292693240&w=1200&fwrn=4&fwrnh=100&lmt=1677288670&rafmt=1&format=1200x280&url=https%3A%2F%2Fwww.richrainbows.com%2Faec%2Fqbot.zip&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1677288670476&bpp=3&bdt=539&idt=429&shv=r20230222&mjsv=m202302150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3110296830212&frm=20&pv=1&ga_vid=397696976.1677288671&ga_sid=1677288671&ga_hid=1401903725&ga_fc=1&ga_cid=1927876617.1677288671&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=0&ady=0&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44777876%2C44759837%2C31071756%2C31072480&oid=2&pvsid=856095500874408&tmod=908495160&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpEe%7Cp&abl=XS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=kXpTPLZDaI&p=https%3A//www.richrainbows.com&dtd=435
Frame ID: 1BD8FB347C4EC7F166A8805C09057C84
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9538727938022233&output=html&h=280&slotname=9292693240&adk=3400383200&adf=2587467011&pi=t.ma~as.9292693240&w=345&fwrn=4&fwrnh=100&lmt=1677288670&rafmt=1&format=345x280&url=https%3A%2F%2Fwww.richrainbows.com%2Faec%2Fqbot.zip&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1677288670479&bpp=1&bdt=543&idt=443&shv=r20230222&mjsv=m202302150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=3110296830212&frm=20&pv=1&ga_vid=397696976.1677288671&ga_sid=1677288671&ga_hid=1401903725&ga_fc=1&ga_cid=1927876617.1677288671&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1025&ady=527&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44777876%2C44759837%2C31071756%2C31072480&oid=2&pvsid=856095500874408&tmod=908495160&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeE%7Cp&abl=XS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=XttYYTGWxF&p=https%3A//www.richrainbows.com&dtd=448
Frame ID: 802A8E26B5ECCC45828769392B81ED34
Requests: 8 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y_lk3gAOUiEHg4WtAAC6axAIbELsFlqDqWVjwg&u=%7Ctq6IVDBjPrf957MAdMQU12HrKEHTKCCklMXweqR5WF0%3D%7C&c1=TEbw32HdmhlTb08vzaRE05Nor-kWNW37ds0oDHxEuxeKn7Xrp6ainli_Cmw5dJSudhYAqTqyTVLZ73Wbp2hSsQetf0nCCbBw5UDDa1cwUNSy9sHEMskIO5l1uCU2z_A35b6-wUWZtjboThnTX-XC_xMxK4qYRyWhCJAKkr1jUjlefx-Onr_nQ7arxFwZRBXNU4G-IRNq8EeQ6XMiCRvjROivDwFn7WH9kbpnu7MHQhA8MN40HvaqdEmbKB44mhCVGbLTEu8zT6k9LVfvbCJ68sQ9VRMzvxUR_CTFcxoZK0yNPfEX5m6oPbRVOS7XyCjz68VfgQCN6kTVVJRSod4V-HOuoGck84_GallOF5_2oJ_PhXtACpO9F2B42IgUTdgTRlcQ0EPjezsSB2Ref65hd9GJqy_2MEzmQFYCylmfIl9qXlESiHoCcUEVZ-jSyXaS7lh-RM0JD9rXFQcLTXdCpXtVnsM_YhjksKxrBhyrJyvo73uobk8CbhNM7VXfon7p-UrL1kYNn3vZzuCWv4h5kt7Cjx7-KMIHa9wDnCeIqRn4zTSCsSEwiD-19E3wXNjgMM8qQDhPrbQiTKrqE8Qjv3Gt05wMjbqqwXEuAadPJ9zbhFSV0aPW8yiiwx252LvN&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCKf0X3mT5Y6GkOa2LjuwP6_SCsAvJntKxXNX24taTAcCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi05NTM4NzI3OTM4MDIyMjMzyAEJqQLD_Cs5UbKxPqgDAaoE-AFP0Mj6VQjCA8Bz7qLSHAKFueGWY3Nv_gVx8KDnhcpvHkeI-vjduU0kT35ANo2mt3akS_DJ9TC_0h7CvZYRMwwRN2fzkgq68BhuzF9CFasw2v1hNb2BrXXCzK4yJRF7Z9skXjAy0wPH9jHSyHosn2JntJFFxP_77MdHDb46Xs8zylpy67FJ7kTd-SmXp0xRyGImCIDtxyiSWEGW-7Gl0pdC7jAvd9q5B51QPLJ4Z1hCPBgX87uBt1ifOzvLkDbIvXWr4QJEnOqjhCn5wEF414lKNTE-wD9fMlj3C-fkYLfiAFC7cQjKWDuiDaU9kv5qyE4D6o1kwIenZIAGq5-pzdqi4vUnoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1mGd0w-ZDMDmhNFA6sC-nB9F7Ldg%26client%3Dca-pub-9538727938022233%26adurl%3D
Frame ID: 4B5316F33439ACFDA634AF7774D081B4
Requests: 19 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y_lk3gAOg9IHg4dCAA9qBTxs3-1KzPPxmY_z6Q&u=%7CSkYjTyvq6EXJn8hd7AQnyCCc7lXBd4IgVJ%2BPOahhmsI%3D%7C&c1=TEbw32HdmhlTb08vzaRE05Nor-kWNW37ds0oDHxEuxeKn7Xrp6ainli_Cmw5dJSudhYAqTqyTVJUGqNRryn5F6wbhZxWii85p_XIY2ky4V5oFCiPXaIpIVgTcUUSB97WNxnv7RgFR1etgBx_EGwXmlLPCIvpdnxYEbLSsaaUviEib-W8dFT4AcfHIkFjPhMiWeyEYSkwXn1-X4k_Jwsqp0cAzZ0lWP-CCLqJBAYmWxRDaqxlPlPsGxYPhje5SOKJbRZRPqwsBv1ZtpFJT9CCWo83vpn3TR1dYsKiTRXm2NWOLh3O5_wry9EBcZtuEFHqU63RCdbIuRLz8apw1yVG7ibu2v17LnsJdJtNeXkzotColX08LvHRzyqZE1N5tomWDJmFn1z8nvGx6vXU5we9zlV0-xPDQjRxZxpBrOrSZQSv-0G5SaHLmNtufbMNV7H7JKANMMpqnL8eTPu-S3wVY1h9t7_0bqbV6lQfT7vJggwGIMoM8buze2owJx-DDzbUzn_t4Tcf-GjIDX3pxHNqSqgt4iyxv5ujKdNo3lvRxo80_mrWh54YoMMR3HcCYEPIK1c5GgRBs2TaTu4lVNi7m9JwHn2Tao_bBZ-1mjhYRc6UVbU5nosgbw&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCyK_23mT5Y9KHOsKOjuwPhdS94AzJntKxXJWil_dwwI23ARABIABgleKQgqAHggEXY2EtcHViLTk1Mzg3Mjc5MzgwMjIyMzPIAQmpAsvgOcE6tLE-qAMBqgT3AU_QzKW7AGbWxHkz4Lgwc3G-oPErGMWfjRd6o5xW-LhwLo9qIavWHwD8V2rKIvRnvaQopQs3PCdYpjUzW6VP93_OYXt7t6kmAyCtN6YSP6q4aGfhNqnoqlL5WJJgznj-CMsPuAKPUYfWE4pKEwLuQVa08fftswEwMQcBGuSge249cIjbmMbnZ2iZO5oEgL4GKC8CWLufFMmuq8Xq6ovpFa7mWAaa4anYYt02YzPD0hXhhCZdu2T54K-8_EhSFUIOyGm5fypb3XR3HPnE9ce_lOrGtJggbsxhAUjRfEcI6joan2fq1FGc9Y-3mzikmWeown8bPSpWoRiABqufqc3aouL1J6AGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1Re_J31vty17vMr_aX3yBBy2AUKQ%26client%3Dca-pub-9538727938022233%26adurl%3D
Frame ID: 2FFB68E26A3EE100985EC61EB04C62B9
Requests: 20 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230222/r20110914/zrt_lookup.html?fsb=1
Frame ID: 300B438F01A03A762E2D5C7785609B4D
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230222/r20110914/zrt_lookup.html?fsb=1
Frame ID: D81964B26E8978FE6DF5EFD16D320F93
Requests: 8 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y_lk3gAOAxkKd6kPAA684xOjH2SLdYdf1X7piA&u=%7Ctq6IVDBjPreWhnij%2FEGeDRfBTp%2FsadJW%2F1k%2BwjZBcu0%3D%7C&c1=TEbw32HdmhlTb08vzaRE0-J3aJQULXRb6S19EAZ80X2gBTzv4Dq5xMxb2AiDpyinZYbjjDWoUakj_vOW-2yxcdN9EEMU4bfVBpqrY4J3iqL55gB3IiZO2uKqow7l2Q-K_KDUToBsIKJaaDQ625biEE_h443_yRNSQQL19xxUJ2DPkPuVuJcE5RPjp4YKhjWBCfeKzPiWfNRgSf_eY_0ESt1c5SBS2CWrz-9lt28htgomooHH34OZxoiO5vsH3aGES6GJIMSInBszY28519wRgzyvP_7Q8LUCEraafIhiErumQzvCw2aJjzgkG8keUGtRnoHwavWYjpgVONAJffPHw4mdD0umxftTm4q_RBJHmyF2L8UJN8hduZjY6ZdIURAAM9aGK0PfqFjfwW1KyspeHLyT1OUitEjgXbMxjRD3Wp2nopb3wkQabOG-eYSg5dey-bcMV0SM3d9yHDBf9sydjSc2MLjnSth2Spjp4cNSQPQtVji-UqJYDl1mdEKtOIZ6wuMfRz0gPPoQYBfMHeMfhb1FK8N06CD03o1Ia6MVIwG1NBA0zKhJOLYf_H8qz_T07NQBqA0f1OXeaTvq47e_4OHymbTUNAPaWLfTnXagcy18cvlcG6p8LpqGg4_EF4tZ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCf-JG3mT5Y5mGOI_S3gPj-bq4CMme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItOTUzODcyNzkzODAyMjIzM8gBCakCy-A5wTq0sT6oAwGqBPcBT9BGuKPtz6EEkZL7vIrHUXYUOLpEUar52E-iKqsoaXXmr283_SJiOHGeZIOnoxGCOpRB02xBChfYfx_9BRDjdPlK53H0CGYoNQZgN8sWvYJJap_4TKAAlWfk9rWHV6ROQem-7uI1V8IFw2l4u4TNWYANFRXnqGrMWePUbj7ntMYoDy5_R0xC7Gbwbgh0w43_odv7SCfdMHGXq8RPIoujCyvoPROCiFY4T5XRNKrg1wd9Pk_nMvaS1IAKxbdsR9TBiz4XmHXdnYYGFoyzvlb4ZM0sIjQ1gR89X8n9veSjUsrSTF-1VgdeymloiVrYxe-55oUL33gTeIAGq5-pzdqi4vUnoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2S8j9MuTOOMiCFoC2gpm9mg9lcWQ%26client%3Dca-pub-9538727938022233%26adurl%3D
Frame ID: 7AE7DD5CF71074D89506C883EB337FFE
Requests: 35 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y_lk3gAOAxoKd6kPAA68430lmTVd6rZ2gGQRrA&u=%7Ctq6IVDBjPrf%2FkLz5InNBEVqzNeYzbv8Qu%2FSjDGAEC10%3D%7C&c1=TEbw32HdmhlTb08vzaRE05Nor-kWNW37ds0oDHxEuxeKn7Xrp6ainli_Cmw5dJSudhYAqTqyTVKScDTkoyLUyYksoS_JOn_-Ny1WjPU3ths0gwk1HltjmAoyq7gnBe6AOw3c5nJkHMMJHCoahGLfxB6AgXVgJI-bhBIXDr4XjxHP1NSfrv5JN5bNo_k_iD6TX4kwt5y8E_uwGrehlr5b6Wai062UQKow7FQ_hZNtU6i7EhT7L0Xe0AU1BpyJkJv-Z6mIiG4BjUloq_Kj_mvEvhMiO705iA4L2YocMh38ZonaQOjcrLXiNfZkYpaGpTuBTMc7tOOjSdnIYi0Q5SziAr39ZACY2CY3ioBkTUqTID8fNk2cSeQ88H0knJ4qjRRunFRm9UmTb3BXfcICq2aNN3Ni3pOqLzqw0nzRhsT1P515ntQfrU_BUcchz1kuo3PUPQCEzkMCkLNSzfxr0Ma_c1HSnT2cuKNm46qkoPBGQO63gvORwqEK85pf7mlWuQsEG-5wsNqngY0RYBgUyN_mjrwnrM3N3AngShujKWtbv7m8crOHSYarPCQ_CH8T_uy_yRtD99vZfIHh81QSUGGBgwv8Z2gDunHmMJBEcMD9itpZZLQZBiTd7PUCOdK0I_V2&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCHfi33mT5Y5qGOI_S3gPj-bq4CMme0rFc9eqhhogBwI23ARABIABgleKQgqAHggEXY2EtcHViLTk1Mzg3Mjc5MzgwMjIyMzPIAQmpAsvgOcE6tLE-qAMBqgT4AU_Qs9iviv5QRqJWrbwtQG8CyU603rhv7t6HI1YDpprUNann54UzKym0-2Pk1SqaxTw2W5MPjgye1pFwzSy9w75gnDvbg2RG4EelhJDwXxbnMu0QEjI9RPTMRzKostXakwMW9pjs19ta3J2u2JYml3zdA-VSQGX19UprBg0_IdZpUGsnzmhGkW3u0fCiJyXo9-zPIchJj0-zgyM75PtaJwF7P2YiIP1El4s6Kza1UHw9vVOhw57OtUXYDAxnJMnV6ppS-Pl39i61Dm1L8pVKze6cfmMkd-9rK2A6rUCFu_sDgGHL1uri1styKmKgw-Gg2gFEp33VM8JYgAarn6nN2qLi9SegBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_1oClthW14P-nzylg4mXann3K-zhA%26client%3Dca-pub-9538727938022233%26adurl%3D
Frame ID: E0E5F1EFBBDB0071EB0395E115588CBF
Requests: 31 HTTP requests in this frame

Frame: https://a.mailmunch.co/v2/themes/mailmunch/postman/popover/index.css
Frame ID: 334399B230675CC206DF6D245D4EEA24
Requests: 7 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: CD14F4367D87341F8A32D1C09C97FF05
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: A4C95942847B06FB1AD771666EDEB7C2
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Page not found - Rich Rainbows

Page URL History Show full URLs

https://richrainbows.com/aec/qbot.zip HTTP 301
https://www.richrainbows.com/aec/qbot.zip Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

OneSignal (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

cdn\.onesignal\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

226
Requests

100 %
HTTPS

87 %
IPv6

16
Domains

33
Subdomains

32
IPs

5
Countries

2620 kB
Transfer

6870 kB
Size

9
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://www.youtube.com/channel/UCIBuQKSwukL6iLJR93S3MHw
Title: Video

Search URL Search Domain Scan URL

URL: https://rumble.com/c/c-1117853
Title: Rumble Video

Search URL Search Domain Scan URL

URL: http://jegtheme.com/
Title: JNews

Search URL Search Domain Scan URL

URL: http://facebook.com/

Search URL Search Domain Scan URL

URL: http://twitter.com/

Search URL Search Domain Scan URL

URL: https://translate.google.com/
Title: Google Übersetzer

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://richrainbows.com/aec/qbot.zip HTTP 301
https://www.richrainbows.com/aec/qbot.zip Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

226 HTTP transactions
10 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

404
Not Found

Primary Request qbot.zip Show response
www.richrainbows.com/aec/
Redirect Chain

https://richrainbows.com/aec/qbot.zip
https://www.richrainbows.com/aec/qbot.zip

121 KB
25 KB

515ms
421ms

Document
text/html

18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache / PHP/7.4.33
Resource Hash: 914ba9fc129376a958d08ed29de9313cbb843e0e6ed20a6fa681b6f7f6adee3a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 25468
Content-Type: text/html; charset=UTF-8
Date: Sat, 25 Feb 2023 01:31:09 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
cache-control: no-cache, must-revalidate, max-age=0
display: staticcontent_sol
expires: Fri, 24 Feb 2023 01:31:09 UTC
link: <https://www.richrainbows.com/wp-json/>; rel="https://api.w.org/"
pagespeed: off
vary: Accept-Encoding,Origin,User-Agent
x-middleton-display: staticcontent_sol
x-powered-by: PHP/7.4.33

Redirect headers

Connection: Keep-Alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Sat, 25 Feb 2023 01:31:09 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
cache-control: no-cache, must-revalidate, max-age=0
display: staticcontent_sol
expires: Fri, 24 Feb 2023 01:31:09 UTC
location: https://www.richrainbows.com/aec/qbot.zip
pagespeed: off
vary: Accept-Encoding,Origin,User-Agent
x-middleton-display: staticcontent_sol
x-powered-by: PHP/7.4.33
x-redirect-by: WordPress

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
44 KB 193ms
76ms Script
application/javascript 2a00:1450:400d:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-125458244-2

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:804::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

88456d116b77dface92f5947c252d572b805d57d8f6dbbb113111ae33da3395f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:10 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44561
x-xss-protection: 0
last-modified: Sat, 25 Feb 2023 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 25 Feb 2023 01:31:10 GMT

GET
H/1.1 200
OK blocks.style.build.css
www.richrainbows.com/wp-content/plugins/structured-content/dist/ 5 KB
2 KB 32ms
32ms Stylesheet
text/css 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.richrainbows.com/wp-content/plugins/structured-content/dist/blocks.style.build.css?ver=1.5.0
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: 45ec54f6edf49e36dc01d93b61e9b3209c78e6efa525f5c31cbd654013963ad9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:09 GMT
Content-Encoding: gzip
Last-Modified: Fri, 14 Oct 2022 13:36:26 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 1837

GET
H/1.1 200
OK style.min.css
www.richrainbows.com/wp-includes/css/dist/block-library/ 93 KB
13 KB 69ms
36ms Stylesheet
text/css 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.richrainbows.com/wp-includes/css/dist/block-library/style.min.css?ver=6.1.1
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: c324ef26b20264369e4568dc9ef1c5cb1f325f6bc4e8b7c01f7fe93fa353276a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Content-Encoding: gzip
Last-Modified: Wed, 16 Nov 2022 11:28:51 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 12518

GET
H/1.1 200
OK classic-themes.min.css
www.richrainbows.com/wp-includes/css/ 217 B
488 B 84ms
30ms Stylesheet
text/css 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.richrainbows.com/wp-includes/css/classic-themes.min.css?ver=1
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: 5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Nov 2022 04:49:35 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 189

GET
H/1.1 200
OK style.css
www.richrainbows.com/wp-content/plugins/google-language-translator/css/ 126 KB
10 KB 91ms
35ms Stylesheet
text/css 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.richrainbows.com/wp-content/plugins/google-language-translator/css/style.css?ver=6.0.18
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: e2fb63ea3b3d832a17e88ce1bdc0ec080117e17f1c9331697c822015e501cb13

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Content-Encoding: gzip
Last-Modified: Sun, 05 Feb 2023 05:00:13 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 9776

GET
H/1.1 200
OK toolbar.css
www.richrainbows.com/wp-content/plugins/google-language-translator/css/ 6 KB
2 KB 92ms
32ms Stylesheet
text/css 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.richrainbows.com/wp-content/plugins/google-language-translator/css/toolbar.css?ver=6.0.18
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: 306a340d77c015bebd34348e2df7636595f40e1fc50273d1a4cba9321d5e82ce

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Content-Encoding: gzip
Last-Modified: Sun, 05 Feb 2023 05:00:13 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1772

GET
H/1.1 200
OK js_composer.min.css
www.richrainbows.com/wp-content/plugins/js_composer_/assets/css/ 474 KB
45 KB 113ms
50ms Stylesheet
text/css 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.richrainbows.com/wp-content/plugins/js_composer_/assets/css/js_composer.min.css?ver=6.8.0
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: 521457922129a04fbc4524021ac47021659a1e1931c5dfe1a0e13be5dcaaefba

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Content-Encoding: gzip
Last-Modified: Sat, 05 Feb 2022 14:28:59 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 45824

GET
H/1.1 200
OK frontend.min.css
www.richrainbows.com/wp-content/themes/jnews/assets/dist/ 588 KB
92 KB 118ms
56ms Stylesheet
text/css 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.richrainbows.com/wp-content/themes/jnews/assets/dist/frontend.min.css?ver=10.8.1
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: 9d8d3bf6f41af46fb0867a68d3c40ed22af46635c354a80fd257d9e9dbf95f28

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Content-Encoding: gzip
Last-Modified: Wed, 16 Nov 2022 11:28:02 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Transfer-Encoding: chunked
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100

GET
H/1.1 200
OK js-composer-frontend.css
www.richrainbows.com/wp-content/themes/jnews/assets/css/ 3 KB
590 B 103ms
34ms Stylesheet
text/css 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.richrainbows.com/wp-content/themes/jnews/assets/css/js-composer-frontend.css?ver=10.8.1
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: 1c468f25c66a9aeaa637ca5244f64ec7f967734b2dc2aa92b667cf5316155e81

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Content-Encoding: gzip
Last-Modified: Wed, 16 Nov 2022 11:27:59 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 292

GET
H/1.1 200
OK style.css
www.richrainbows.com/wp-content/themes/jnews/ 427 B
590 B 111ms
28ms Stylesheet
text/css 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.richrainbows.com/wp-content/themes/jnews/style.css?ver=10.8.1
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: 32b1523c71aa131b100e09ca28353ee1ca699d6900ec4dce56d01215236473c1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Content-Encoding: gzip
Last-Modified: Wed, 16 Nov 2022 11:28:15 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 292

GET
H/1.1 200
OK darkmode.css
www.richrainbows.com/wp-content/themes/jnews/assets/css/ 46 KB
7 KB 125ms
33ms Stylesheet
text/css 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.richrainbows.com/wp-content/themes/jnews/assets/css/darkmode.css?ver=10.8.1
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: 3fadf99638094a841349a5bc82be83289b9b7c795838626f5ab8462763bad224

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Content-Encoding: gzip
Last-Modified: Wed, 16 Nov 2022 11:27:59 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 6943

GET
H/1.1 200
OK scheme.css
www.richrainbows.com/wp-content/themes/jnews/data/import/travel/ 3 KB
1 KB 131ms
39ms Stylesheet
text/css 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.richrainbows.com/wp-content/themes/jnews/data/import/travel/scheme.css?ver=10.8.1
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: 457ab542be1badc8c3c0992615605534f3a65dce73d2e609a6a433dc02dac346

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Content-Encoding: gzip
Last-Modified: Wed, 16 Nov 2022 11:28:14 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 897

GET
H/1.1 200
OK plugin.css
www.richrainbows.com/wp-content/plugins/jnews-social-login/assets/css/ 2 KB
890 B 134ms
31ms Stylesheet
text/css 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.richrainbows.com/wp-content/plugins/jnews-social-login/assets/css/plugin.css?ver=10.0.3
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: 4c62c820213f1ab28757a744fd3d15b65fc1ac9e148c8db2c50eb8a20959f930

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Content-Encoding: gzip
Last-Modified: Fri, 14 Oct 2022 13:35:22 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 592

GET
H/1.1 200
OK frontend-gtag.min.js Show response
www.richrainbows.com/wp-content/plugins/google-analytics-for-wordpress/assets/js/ 12 KB
3 KB 143ms
31ms Script
application/javascript 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.richrainbows.com/wp-content/plugins/google-analytics-for-wordpress/assets/js/frontend-gtag.min.js?ver=8.12.1
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: abc9faa4970e07db7d506d6b2a98e4c86223be305c7541ced54ea2e15f99a76e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Content-Encoding: gzip
Last-Modified: Fri, 13 Jan 2023 05:01:13 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 3246

GET
H/1.1 200
OK jquery.min.js Show response
www.richrainbows.com/wp-includes/js/jquery/ 88 KB
31 KB 170ms
43ms Script
application/javascript 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.richrainbows.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.1
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Nov 2022 04:49:52 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 30995

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 114 KB
45 KB 86ms
84ms Script
application/javascript 2a00:1450:400d:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-198259637-1

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:804::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a9d3ae8ca199ab0a5a9fb9f8bbb331e73f845c235db36fff0047cabd00795ae6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:10 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 45581
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 25 Feb 2023 01:31:10 GMT

GET
H2 200 site.js Show response
a.mailmunch.co/app/v1/ 25 KB
9 KB 103ms
6ms Script
text/javascript 2600:9000:206f:ba00:4:c961:9640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://a.mailmunch.co/app/v1/site.js
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:ba00:4:c961:9640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 159043fcb16dd5c9a4b6a80581f7a91dc5987665ea5f7851da6c29fba0615a64

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 23 Feb 2023 03:03:25 GMT
content-encoding: gzip
via: 1.1 1c5b98f7bd5001d6fe1040daa237afc6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 167266
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 8416
last-modified: Wed, 22 Feb 2023 05:50:45 GMT
server: AmazonS3
etag: "312a1d6e55bd8e1c031a7c5dcaa89c54"
access-control-max-age: 3000
access-control-allow-methods: HEAD, GET, POST, PUT, DELETE
content-type: text/javascript
access-control-allow-origin: *
access-control-expose-headers: ETag
cache-control: max-age=172800
accept-ranges: bytes
x-amz-cf-id: MFF5vUePl9PS7eoAGMzuOcymKvOeIhJv9h_RnXE-vabPlfZFdOHQ0A==

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 146 KB
49 KB 159ms
57ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-9538727938022233

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6932bed79e5ac3de1f11992e5ba2181c64f6fae79984f71f958f705934253693

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.richrainbows.com/
Origin: https://www.richrainbows.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:10 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49556
x-xss-protection: 0
server: cafe
etag: 2481645958184560843
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sat, 25 Feb 2023 01:31:10 GMT

GET
H/1.1 200
OK Logo-4.png
www.richrainbows.com/wp-content/uploads/2021/04/ 19 KB
19 KB 35ms
35ms Image
image/png 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.richrainbows.com/wp-content/uploads/2021/04/Logo-4.png
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: 34a6d3e62530a99fc99942085b6232db56e3b370c3983006ba11d4693a4400df

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Last-Modified: Mon, 12 Apr 2021 04:01:33 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 19473

GET
H/1.1 200
OK Logo-light.png
www.richrainbows.com/wp-content/uploads/2021/04/ 28 KB
28 KB 33ms
31ms Image
image/png 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.richrainbows.com/wp-content/uploads/2021/04/Logo-light.png
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: 6eb558464403c82bde31f373ddfcba8d5ead0ea875003e285b3ac0ae99159e1b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Last-Modified: Mon, 12 Apr 2021 04:28:27 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 28589

GET
H/1.1 403
Forbidden invoke.js
thinkseducation.com/7e6bd9794e25c7e6341b1085743d03cc/ 0
0 604ms
96ms Script
text/html 192.243.61.225
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://thinkseducation.com/7e6bd9794e25c7e6341b1085743d03cc/invoke.js
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.243.61.225 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

GET
H/1.1 200
OK app.build.js Show response
www.richrainbows.com/wp-content/plugins/structured-content/dist/ 2 KB
1 KB 31ms
31ms Script
application/javascript 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.richrainbows.com/wp-content/plugins/structured-content/dist/app.build.js?ver=1.5.0
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: 3986673333826891a3b1d289891efd0689a800f8dbd7a897e016ed1f80e429ea

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Content-Encoding: gzip
Last-Modified: Fri, 14 Oct 2022 13:36:26 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 754

GET
H/1.1 200
OK scripts.js Show response
www.richrainbows.com/wp-content/plugins/google-language-translator/js/ 13 KB
3 KB 36ms
36ms Script
application/javascript 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.richrainbows.com/wp-content/plugins/google-language-translator/js/scripts.js?ver=6.0.18
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: e621665022bb960e60fcbed829f30a54d28484a7e2d8e46f7e5025a06608b5bf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Content-Encoding: gzip
Last-Modified: Sun, 05 Feb 2023 05:00:13 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 3164

GET
H2 200 element.js Show response
translate.google.com/translate_a/ 79 KB
28 KB 155ms
56ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://translate.google.com/translate_a/element.js?cb=GoogleLanguageTranslatorInit

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ee154362c6475b7af759965c24b13331aa28db7eb96cc1aa3a63217eb3c48930

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 25 Feb 2023 01:31:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK jquery.me-ga-events.js Show response
www.richrainbows.com/wp-content/plugins/marctv-mediaelement-tracking/js/ 3 KB
976 B 37ms
34ms Script
application/javascript 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.richrainbows.com/wp-content/plugins/marctv-mediaelement-tracking/js/jquery.me-ga-events.js?ver=1.6
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: 8e95bc4eaefb870c080c072f2d84c53569261166e8ae45d01004ce4941877686

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Content-Encoding: gzip
Last-Modified: Thu, 29 Jul 2021 12:15:24 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 664

GET
H/1.1 200
OK hoverIntent.min.js Show response
www.richrainbows.com/wp-includes/js/ 1 KB
1018 B 32ms
29ms Script
application/javascript 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.richrainbows.com/wp-includes/js/hoverIntent.min.js?ver=1.10.2
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: ed5b5df9ceacfe76857ac51964972b0b417a215b2f50e837fd6b64bad7339c40

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Content-Encoding: gzip
Last-Modified: Wed, 25 May 2022 04:48:07 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 706

GET
H/1.1 200
OK imagesloaded.min.js Show response
www.richrainbows.com/wp-includes/js/ 5 KB
2 KB 35ms
32ms Script
application/javascript 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.richrainbows.com/wp-includes/js/imagesloaded.min.js?ver=4.1.4
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Content-Encoding: gzip
Last-Modified: Sat, 10 Apr 2021 09:05:38 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=95
Content-Length: 1834

GET
H/1.1 200
OK frontend.min.js Show response
www.richrainbows.com/wp-content/themes/jnews/assets/dist/ 298 KB
85 KB 44ms
41ms Script
application/javascript 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.richrainbows.com/wp-content/themes/jnews/assets/dist/frontend.min.js?ver=10.8.1
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: caab0986316add32c22877ef8958c4af71919089270e72794a1bf46370d1dcc0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Content-Encoding: gzip
Last-Modified: Wed, 16 Nov 2022 11:28:02 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Transfer-Encoding: chunked
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98

GET
H/1.1 200
OK plugin.js Show response
www.richrainbows.com/wp-content/plugins/jnews-like/assets/js/ 2 KB
1 KB 38ms
34ms Script
application/javascript 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.richrainbows.com/wp-content/plugins/jnews-like/assets/js/plugin.js?ver=10.0.0
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: 5be824d9bcb5759cd56f553489f8271f962892a10f571aafafc416168d325b65

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Content-Encoding: gzip
Last-Modified: Wed, 22 Dec 2021 16:04:59 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 956

GET
H/1.1 200
OK plugin.js Show response
www.richrainbows.com/wp-content/plugins/jnews-social-login/assets/js/ 990 B
795 B 43ms
41ms Script
application/javascript 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.richrainbows.com/wp-content/plugins/jnews-social-login/assets/js/plugin.js?ver=10.0.3
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: c1242fa94be3c8b4f77e19e0098a00ce4714e76b48fcf9fb6c6fb95e978bc5df

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Content-Encoding: gzip
Last-Modified: Fri, 14 Oct 2022 13:35:22 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=94
Content-Length: 483

GET
H2 200 OneSignalSDK.js Show response
cdn.onesignal.com/sdks/ 9 KB
3 KB 80ms
18ms Script
application/javascript 2606:4700::6812:d73b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=6.1.1

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:d73b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b3565ea346e63fda91cc67ba8fc11e95b7482d5873a4f4c6a47c4185b772d9a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:10 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
age: 1533
etag: W/"5ffd70753209ca4d09cfef90e7c44df3"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 79ecae0d4d3f68ec-FRA
access-control-allow-headers: OneSignal-Subscription-Id
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Tue, 28 Feb 2023 01:31:10 GMT

GET
H/1.1 200
OK preloader.gif
www.richrainbows.com/wp-content/themes/jnews/assets/dist/image/ 4 KB
5 KB 31ms
31ms Image
image/gif 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.richrainbows.com/wp-content/themes/jnews/assets/dist/image/preloader.gif
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/wp-content/themes/jnews/assets/dist/frontend.min.css?ver=10.8.1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: e2e60e9eae839d6b2e857c708f6d02ae6069141594b941a1590cd5c5435d42f4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/wp-content/themes/jnews/assets/dist/frontend.min.css?ver=10.8.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Last-Modified: Wed, 16 Nov 2022 11:28:01 GMT
Server: Apache
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=95
Content-Length: 4399

GET
H/1.1 200
OK fontawesome-webfont.woff2
www.richrainbows.com/wp-content/themes/jnews/assets/dist/font/ 75 KB
76 KB 45ms
42ms Font
font/woff2 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.richrainbows.com/wp-content/themes/jnews/assets/dist/font/fontawesome-webfont.woff2
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/wp-content/themes/jnews/assets/dist/frontend.min.css?ver=10.8.1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer: https://www.richrainbows.com/wp-content/themes/jnews/assets/dist/frontend.min.css?ver=10.8.1
Origin: https://www.richrainbows.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Content-Encoding: gzip
Last-Modified: Wed, 16 Nov 2022 11:28:00 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Transfer-Encoding: chunked
Content-Type: font/woff2
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98

GET
H/1.1 200
OK jeg-empty.png
www.richrainbows.com/wp-content/themes/jnews/assets/img/ 70 B
310 B 39ms
33ms Image
image/png 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.richrainbows.com/wp-content/themes/jnews/assets/img/jeg-empty.png
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: 67ebf650147a9122e94ff1b25a78a82e903b92b877821c1479de69f00f59d429

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Last-Modified: Wed, 16 Nov 2022 11:28:06 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=93
Content-Length: 70

GET
H/1.1 200
OK jegicon.woff
www.richrainbows.com/wp-content/themes/jnews/assets/dist/font/ 7 KB
7 KB 34ms
33ms Font
font/woff 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.richrainbows.com/wp-content/themes/jnews/assets/dist/font/jegicon.woff
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/wp-content/themes/jnews/assets/dist/frontend.min.css?ver=10.8.1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: e2d3127da85763e024971c6192f78becbdf85db231b3d088c9f8b3777d444ede

Request headers

Referer: https://www.richrainbows.com/wp-content/themes/jnews/assets/dist/frontend.min.css?ver=10.8.1
Origin: https://www.richrainbows.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Content-Encoding: gzip
Last-Modified: Wed, 16 Nov 2022 11:28:00 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: font/woff
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 7126

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 118ms
35ms Script
text/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-125458244-2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 25 Feb 2023 00:54:44 GMT
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
server: Golfe2
age: 2186
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20085
expires: Sat, 25 Feb 2023 02:54:44 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
44 KB 79ms
79ms Script
application/javascript 2a00:1450:400d:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-198259637-1&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-125458244-2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:804::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ef1ba7901f9deb04256074788d75a22a8e5ecc1bf6117227f5b2bbfabf58ca37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:10 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 44584
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 25 Feb 2023 01:31:10 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.11.3/ 94 KB
33 KB 123ms
38ms Script
text/javascript 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js

Requested by

Host: a.mailmunch.co
URL: https://a.mailmunch.co/app/v1/site.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Fri, 24 Feb 2023 15:20:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36645
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33507
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 24 Feb 2024 15:20:25 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 219 KB
77 KB 81ms
80ms Script
application/javascript 2a00:1450:400d:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-QKYKECMFBX&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-198259637-1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:804::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

31b70d0799fc133e6eb224843e4e1eb4faa8016b7e519fba31bfdc3affa7b015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:10 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 78483
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 25 Feb 2023 01:31:10 GMT

GET
H2 200 m=el_main_css
www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.cYEbrOmw59Q.L.W.O/d=0/rs=AN8SPfpU282joXDlbkUblMtWLWoZn4bb2g/ 25 KB
5 KB 183ms
47ms Stylesheet
text/css 2a00:1450:400d:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.cYEbrOmw59Q.L.W.O/d=0/rs=AN8SPfpU282joXDlbkUblMtWLWoZn4bb2g/m=el_main_css

Requested by

Host:
URL: /_/translate_http/_/js/k=translate_http.tr.de.qi2MF_E4MGg.O/d=1/rs=AN8SPfoX2s-GGB0096SAc0g-DZh1WJeMRw/m=el_conf

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

be772df30b158452751d2fcd53efb89b37e4e9dc366a1f525f80ab04c8823f10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 23 Feb 2023 12:49:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 132096
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4450
x-xss-protection: 0
last-modified: Wed, 08 Feb 2023 02:19:28 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="rosetta"
vary: Accept-Encoding
report-to: {"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 23 Feb 2024 12:49:34 GMT

GET
H2 200 m=el_main Show response
translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.de.qi2MF_E4MGg.O/d=1/exm=el_conf/ed=1/rs=AN8SPfoX2s-GGB0096SAc0g-DZh1WJeMRw/ 209 KB
75 KB 118ms
36ms Script
text/javascript 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.de.qi2MF_E4MGg.O/d=1/exm=el_conf/ed=1/rs=AN8SPfoX2s-GGB0096SAc0g-DZh1WJeMRw/m=el_main

Requested by

Host:
URL: /_/translate_http/_/js/k=translate_http.tr.de.qi2MF_E4MGg.O/d=1/rs=AN8SPfoX2s-GGB0096SAc0g-DZh1WJeMRw/m=el_conf

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b45627ac6d0181263d04b8b8d7aaaffa8a71b4798f669021ba1a5ca89dbc9344

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Fri, 24 Feb 2023 15:31:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 35975
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 75874
x-xss-protection: 0
last-modified: Wed, 22 Feb 2023 22:14:37 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="rosetta"
vary: Accept-Encoding
report-to: {"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 24 Feb 2024 15:31:35 GMT

GET
H/1.1 200
OK cu-350x250.jpg
www.richrainbows.com/wp-content/uploads/2022/05/ 7 KB
8 KB 37ms
36ms Image
image/jpeg 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.richrainbows.com/wp-content/uploads/2022/05/cu-350x250.jpg?v=1652253989
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: 1c30a46fd8cce117a8be0a8c71962d86756db1e46455a0e92a43f0c59b8e4e35

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Last-Modified: Wed, 11 May 2022 07:26:28 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 7558

GET
H/1.1 200
OK cheerful-young-african-man-pointing_171337-9659-350x250.webp
www.richrainbows.com/wp-content/uploads/2022/04/ 5 KB
5 KB 39ms
37ms Image
image/webp 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.richrainbows.com/wp-content/uploads/2022/04/cheerful-young-african-man-pointing_171337-9659-350x250.webp
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: a98c5d9f8e22bff778c8469a1e8f632d5a5b744b9db69b39eca34d73541273a4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Content-Encoding: gzip
Last-Modified: Tue, 26 Apr 2022 22:17:31 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: image/webp
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=92
Content-Length: 5021

GET
H/1.1 200
OK OldAgeNE-Post-350x250.jpg
www.richrainbows.com/wp-content/uploads/2022/04/ 8 KB
8 KB 38ms
37ms Image
image/jpeg 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.richrainbows.com/wp-content/uploads/2022/04/OldAgeNE-Post-350x250.jpg?v=1650095592
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: 438c16691430de4cd7b08b94b712827b4560637ca3991ea489eeae9e2ba84405

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Last-Modified: Sat, 16 Apr 2022 07:53:12 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=95
Content-Length: 8145

GET
H/1.1 200
OK d1b8272dba69e9a3384f47797aa71e93-350x250.jpg
www.richrainbows.com/wp-content/uploads/2022/04/ 12 KB
12 KB 37ms
36ms Image
image/jpeg 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.richrainbows.com/wp-content/uploads/2022/04/d1b8272dba69e9a3384f47797aa71e93-350x250.jpg?v=1649368051
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: 026cb623b7667cfaa93c24838517dd297c0f632e520b8b6654b8d5e3f6b223b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Last-Modified: Thu, 07 Apr 2022 21:47:30 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=94
Content-Length: 12311

GET
H/1.1 200
OK plr-350x250.webp
www.richrainbows.com/wp-content/uploads/2022/03/ 4 KB
4 KB 40ms
39ms Image
image/webp 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.richrainbows.com/wp-content/uploads/2022/03/plr-350x250.webp
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: 0ab2acefa0e8ef009542dd58eab41f4cecf5f53ab724fffb4c29003f56485825

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Content-Encoding: gzip
Last-Modified: Fri, 18 Mar 2022 10:14:14 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: image/webp
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 4243

GET
H/1.1 200
OK What-are-the-symptoms-of-PID-in-a-female-350x250.jpg
www.richrainbows.com/wp-content/uploads/2022/03/ 6 KB
6 KB 41ms
40ms Image
image/jpeg 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.richrainbows.com/wp-content/uploads/2022/03/What-are-the-symptoms-of-PID-in-a-female-350x250.jpg?v=1647527469
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: e5b554bc52501a9f695af89711a6e90f3246bcddcfa4cae5d3f86880285cc31e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Last-Modified: Thu, 17 Mar 2022 14:31:09 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 6371

GET
H/1.1 200
OK Please-4-350x250.png
www.richrainbows.com/wp-content/uploads/2022/03/ 109 KB
110 KB 37ms
34ms Image
image/png 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.richrainbows.com/wp-content/uploads/2022/03/Please-4-350x250.png?v=1647073337
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: 563e58b530a3499ea174d7d90b6ca3de9d8445f46565e516e266c882c74f1f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/aec/qbot.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Last-Modified: Sat, 12 Mar 2022 08:22:09 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=95
Content-Length: 111998

GET
H2 200 OneSignalPageSDKES6.js Show response
cdn.onesignal.com/sdks/ 283 KB
68 KB 21ms
21ms Script
application/javascript 2606:4700::6812:d73b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151515

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=6.1.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:d73b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3c3af293c92bffe2f5f6f31753be6de274bf677ee5c4de05428cf394d63d4941

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:10 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
age: 1532
etag: W/"725985d8b3cb9e8905cfe4c97cc83600"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 79ecae0e5df568ec-FRA
access-control-allow-headers: OneSignal-Subscription-Id
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Tue, 28 Feb 2023 01:31:10 GMT

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202302150101/ 366 KB
120 KB 141ms
68ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202302150101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-9538727938022233&plah=www.richrainbows.com&bust=31072480

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-9538727938022233

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

92f0834adff37a796b424547b59afc6e1dd6aae0c3721a57fa1d93b1a50ae77c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:10 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 123294
x-xss-protection: 0
server: cafe
etag: 14278412055095336123
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 25 Feb 2023 01:31:10 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230222/r20190131/ Frame 9A68 10 KB
5 KB 119ms
35ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230222/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-9538727938022233

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.richrainbows.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 29872
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 24 Feb 2023 17:13:18 GMT
etag: 10353107486223812946
expires: Fri, 10 Mar 2023 17:13:18 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ 475 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7b8774ee42aac08bc5a2e690896b80dc20953e86dc152dc5b344b589df74273e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK flags.png
www.richrainbows.com/wp-content/plugins/google-language-translator/images/ 54 KB
54 KB 34ms
33ms Image
image/png 18.202.254.38
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.richrainbows.com/wp-content/plugins/google-language-translator/images/flags.png
Requested by: Host: www.richrainbows.com
URL: https://www.richrainbows.com/wp-content/plugins/google-language-translator/css/style.css?ver=6.0.18
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.202.254.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: lion.whogohost.com
Software: Apache /
Resource Hash: d64c12a76a61096f3a14aa795d12c3fc0de8e5781ef2e1af3b66517e65d7f00e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/wp-content/plugins/google-language-translator/css/style.css?ver=6.0.18
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Last-Modified: Sun, 05 Feb 2023 05:00:13 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 54996

GET
H2 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
1 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 00:52:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2306
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 859
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sat, 25 Feb 2023 01:52:44 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
258 B 56ms
21ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-QKYKECMFBX&gtm=45je32m0&_p=1401903725&_gaz=1&cid=397696976.1677288671&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1677288670&sct=1&seg=0&dl=https%3A%2F%2Fwww.richrainbows.com%2Faec%2Fqbot.zip&dt=Page%20not%20found%20-%20Rich%20Rainbows&en=page_view&_fv=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-QKYKECMFBX&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 25 Feb 2023 01:31:10 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.richrainbows.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
258 B 62ms
20ms Ping
text/plain 2a00:1450:400c:c0c::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-QKYKECMFBX&cid=397696976.1677288671&gtm=45je32m0&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-QKYKECMFBX&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c0c::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 25 Feb 2023 01:31:10 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.richrainbows.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 143ms
51ms Image
image/gif 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-QKYKECMFBX&cid=397696976.1677288671&gtm=45je32m0&aip=1&z=973895081

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 25 Feb 2023 01:31:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 styles.css
a.mailmunch.co/app/v1/ 21 KB
3 KB 8ms
8ms Stylesheet
text/css 2600:9000:206f:ba00:4:c961:9640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://a.mailmunch.co/app/v1/styles.css
Requested by: Host: a.mailmunch.co
URL: https://a.mailmunch.co/app/v1/site.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:ba00:4:c961:9640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 437e6e23bb4219f1dd245da75b1729666e71fbf31985189fa35be75702b8cab9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Fri, 24 Feb 2023 19:03:16 GMT
content-encoding: gzip
via: 1.1 1c5b98f7bd5001d6fe1040daa237afc6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 23274
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 2274
last-modified: Fri, 24 Feb 2023 13:23:58 GMT
server: AmazonS3
etag: "01ee3c276f7a44ae37b7f21683a1e0e0"
access-control-max-age: 3000
access-control-allow-methods: HEAD, GET, POST, PUT, DELETE
content-type: text/css
access-control-allow-origin: *
access-control-expose-headers: ETag
cache-control: max-age=172800
accept-ranges: bytes
x-amz-cf-id: 0a8Dd3fDo2Hp_RCbBKCq3Rqfyd4dsVZ5D-YgX7mMGlVv0NWKwBib6w==

GET
H/1.1 200
OK 916417 Show response
forms.mailmunch.co/sites/ 130 B
616 B 356ms
114ms XHR
application/json 18.205.36.100
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://forms.mailmunch.co/sites/916417
Requested by: Host: a.mailmunch.co
URL: https://a.mailmunch.co/app/v1/site.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.205.36.100 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-205-36-100.compute-1.amazonaws.com
Software: Cowboy / Express
Resource Hash: a49495023d3298265b38fc8315f3f0303c1705e638499a85fba34e7745059481

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sat, 25 Feb 2023 01:31:10 GMT
Via: 1.1 vegur
Server: Cowboy
X-Powered-By: Express
Etag: W/"82-r3HeoSj/AsAiVgWublSy+nj6Hfc"
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-MM-Comp-Tracking, X-MM-EU-Continent, X-MM-T
Connection: keep-alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, X-MM-Form-Tool, X-MM-Coupons
Content-Length: 130

GET
H2 200 web Show response
onesignal.com/api/v1/sync/8b03d93f-913d-481d-b99b-9470fda53085/ 5 KB
2 KB 75ms
65ms Script
text/javascript 2606:4700::6812:d73b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/sync/8b03d93f-913d-481d-b99b-9470fda53085/web?callback=__jp0

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151515

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:d73b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

34fe228fb7c3c822de1901da489d062bf4ce0ce41fe7a12743266af69d833583

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:10 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: MISS
content-encoding: br
x-permitted-cross-domain-policies: none
strict-transport-security: max-age=15552000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: ce5bbaf2-abf7-4273-b292-0313746f8d24
x-runtime: 0.030190
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"34fe228fb7c3c822de1901da489d062b"
x-download-options: noopen
vary: Origin, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600
cf-ray: 79ecae0f7eab68ec-FRA
access-control-allow-headers: SDK-Version
expires: Sat, 25 Feb 2023 02:31:10 GMT

GET
DATA 200
OK truncated Show response
/ Frame CF84 1 KB
1 KB Document
text/html

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 10908b6e6cfaeb149b47a6dc31aaa65aca0cf22158c74096c384bbc47285914a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Content-Type: text/html;charset=UTF-8

GET
H2 200 translate_24dp.png
www.gstatic.com/images/branding/product/1x/ 846 B
1 KB 49ms
47ms Image
image/png 2a00:1450:400d:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/branding/product/1x/translate_24dp.png

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a861509b658aa24fc3aed2867ac3c061e7d818d90b9990959afc6d1b5d4ff99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:06:21 GMT
x-content-type-options: nosniff
age: 1489
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 846
x-xss-protection: 0
last-modified: Thu, 14 Oct 2021 09:08:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sun, 25 Feb 2024 01:06:21 GMT

GET
H2 200 googlelogo_color_42x16dp.png
www.gstatic.com/images/branding/googlelogo/1x/ 910 B
1023 B 49ms
48ms Image
image/png 2a00:1450:400d:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/branding/googlelogo/1x/googlelogo_color_42x16dp.png

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6318394f737c66f0e2ccfcd88e3935c6667633a1b95fa29fba2b75431d55eef2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 23 Feb 2023 23:31:56 GMT
x-content-type-options: nosniff
age: 93554
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 910
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 23 Feb 2024 23:31:56 GMT

GET
H2 200 translate_24dp.png
www.gstatic.com/images/branding/product/2x/ 2 KB
2 KB 48ms
48ms Image
image/png 2a00:1450:400d:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/branding/product/2x/translate_24dp.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.cYEbrOmw59Q.L.W.O/d=0/rs=AN8SPfpU282joXDlbkUblMtWLWoZn4bb2g/m=el_main_css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.cYEbrOmw59Q.L.W.O/d=0/rs=AN8SPfpU282joXDlbkUblMtWLWoZn4bb2g/m=el_main_css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Fri, 24 Feb 2023 13:38:41 GMT
x-content-type-options: nosniff
age: 42749
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1842
x-xss-protection: 0
last-modified: Thu, 14 Oct 2021 09:08:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sat, 24 Feb 2024 13:38:41 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 45ms
45ms XHR
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j99&a=1401903725&t=pageview&_s=1&dl=https%3A%2F%2Fwww.richrainbows.com%2Faec%2Fqbot.zip&dp=%2F404.html%3Fpage%3D%2Faec%2Fqbot.zip%26from%3D&ul=en-us&de=UTF-8&dt=Page%20not%20found%20-%20Rich%20Rainbows&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBAAUIhAAAAACAAI~&jid=2144802312&gjid=1111581874&cid=397696976.1677288671&tid=UA-125458244-2&_gid=1927876617.1677288671&_r=1&gtm=457e32m0&did=dZGIzZG&gdid=dZGIzZG&z=1576809998

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.richrainbows.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 25 Feb 2023 01:31:10 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.richrainbows.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 45ms
44ms XHR
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j99&aip=1&a=1401903725&t=pageview&_s=1&dl=https%3A%2F%2Fwww.richrainbows.com%2Faec%2Fqbot.zip&ul=en-us&de=UTF-8&dt=Page%20not%20found%20-%20Rich%20Rainbows&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDACUIhBAAAACAAI~&jid=609900102&gjid=1348056261&cid=397696976.1677288671&tid=UA-198259637-1&_gid=1927876617.1677288671&_r=1&gtm=457e32m0&did=dZGIzZG%2CdZTNiMT&gdid=dZGIzZG.dZTNiMT&z=237656152

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.richrainbows.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 25 Feb 2023 01:31:10 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.richrainbows.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 399 B
606 B 185ms
69ms Script
text/javascript 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.richrainbows.com&callback=_gfp_s_&client=ca-pub-9538727938022233

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202302150101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-9538727938022233&plah=www.richrainbows.com&bust=31072480

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

094111b52c1a0561f5b2a21a31b25a9bb7c81aeed022e8df8e15582371c2021b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 254
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
531 B 202ms
69ms Script
application/javascript 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.richrainbows.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
456 B 195ms
76ms Script
application/javascript 2a00:1450:400d:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.richrainbows.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame D94A 85 KB
20 KB 169ms
168ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9538727938022233&output=html&adk=1812271804&adf=1573534164&lmt=1677288670&plat=3%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=212x675_r&format=0x0&url=https%3A%2F%2Fwww.richrainbows.com%2Faec%2Fqbot.zip&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1677288670470&bpp=6&bdt=534&idt=321&shv=r20230222&mjsv=m202302150101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=3110296830212&frm=20&pv=2&ga_vid=397696976.1677288671&ga_sid=1677288671&ga_hid=1401903725&ga_fc=1&ga_cid=1927876617.1677288671&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44777876%2C44759837%2C31071756%2C31072480&oid=2&pvsid=856095500874408&tmod=908495160&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=420

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

92353b9acf750ffc441bee747493041ab0d3868835896f08adc40a23456ffd6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.richrainbows.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 20379
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 25 Feb 2023 01:31:11 GMT
expires: Sat, 25 Feb 2023 01:31:11 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 1BD8 23 KB
10 KB 132ms
132ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9538727938022233&output=html&h=280&slotname=9292693240&adk=328962951&adf=3025194257&pi=t.ma~as.9292693240&w=1200&fwrn=4&fwrnh=100&lmt=1677288670&rafmt=1&format=1200x280&url=https%3A%2F%2Fwww.richrainbows.com%2Faec%2Fqbot.zip&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1677288670476&bpp=3&bdt=539&idt=429&shv=r20230222&mjsv=m202302150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3110296830212&frm=20&pv=1&ga_vid=397696976.1677288671&ga_sid=1677288671&ga_hid=1401903725&ga_fc=1&ga_cid=1927876617.1677288671&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=0&ady=0&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44777876%2C44759837%2C31071756%2C31072480&oid=2&pvsid=856095500874408&tmod=908495160&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpEe%7Cp&abl=XS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=kXpTPLZDaI&p=https%3A//www.richrainbows.com&dtd=435

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5009e0df8da87941f3955827640393d1a50264d37c9963f8baa5f39cec90826c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.richrainbows.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 9979
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 25 Feb 2023 01:31:11 GMT
expires: Sat, 25 Feb 2023 01:31:11 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 802A 23 KB
10 KB 153ms
152ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9538727938022233&output=html&h=280&slotname=9292693240&adk=3400383200&adf=2587467011&pi=t.ma~as.9292693240&w=345&fwrn=4&fwrnh=100&lmt=1677288670&rafmt=1&format=345x280&url=https%3A%2F%2Fwww.richrainbows.com%2Faec%2Fqbot.zip&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1677288670479&bpp=1&bdt=543&idt=443&shv=r20230222&mjsv=m202302150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=3110296830212&frm=20&pv=1&ga_vid=397696976.1677288671&ga_sid=1677288671&ga_hid=1401903725&ga_fc=1&ga_cid=1927876617.1677288671&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1025&ady=527&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44777876%2C44759837%2C31071756%2C31072480&oid=2&pvsid=856095500874408&tmod=908495160&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeE%7Cp&abl=XS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=XttYYTGWxF&p=https%3A//www.richrainbows.com&dtd=448

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

77fdcadd2a7c156aeb1ce5c9d5d925015661ad85c44eda4b0d7cc5ed07171724

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.richrainbows.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 9988
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 25 Feb 2023 01:31:11 GMT
expires: Sat, 25 Feb 2023 01:31:11 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
151 B 20ms
19ms XHR
text/plain 2a00:1450:400c:c0c::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-198259637-1&cid=397696976.1677288671&jid=609900102&gjid=1348056261&_gid=1927876617.1677288671&_u=aGDACUIhBAAAACAAI~&z=93067491

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.richrainbows.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Sat, 25 Feb 2023 01:31:10 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.richrainbows.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 settings-1677268754.json Show response
a.mailmunch.co/forms-cache/916417/ 5 KB
2 KB 465ms
441ms XHR
application/json 2600:9000:206f:ba00:4:c961:9640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://a.mailmunch.co/forms-cache/916417/settings-1677268754.json
Requested by: Host: a.mailmunch.co
URL: https://a.mailmunch.co/app/v1/site.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:ba00:4:c961:9640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 12ff42a6dd94226b7476a424b64ae6377a3424c0915f858d128447580f8cfff9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:12 GMT
content-encoding: gzip
via: 1.1 910fc18161f0602555cc5b6397ca26f2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
last-modified: Fri, 24 Feb 2023 19:59:21 GMT
server: AmazonS3
etag: W/"a2e19bf9d6cbe6b7194b0a483c29b806"
access-control-max-age: 3000
access-control-allow-methods: HEAD, GET, POST, PUT, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: ETag
cache-control: max-age=31556952
vary: Accept-Encoding
x-amz-cf-id: KezKWS754mnNZwbLQD99ZFoy88HdAx-lU98CUFuTuV_XJJkMEMMtaA==

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
408 B 140ms
51ms Image
image/gif 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-198259637-1&cid=397696976.1677288671&jid=609900102&_u=aGDACUIhBAAAACAAI~&z=132718500

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 25 Feb 2023 01:31:11 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 50ms
50ms Image
image/gif 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-198259637-1&cid=397696976.1677288671&jid=609900102&_u=aGDACUIhBAAAACAAI~&z=132718500

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 25 Feb 2023 01:31:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 OneSignalSDKStyles.css
onesignal.com/sdks/ 82 KB
9 KB 26ms
25ms Stylesheet
text/css 2606:4700::6812:d73b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/sdks/OneSignalSDKStyles.css?v=2

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151515

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:d73b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
age: 1533
etag: W/"4e9aaefffd5f8ae7dc83361aa2294190"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=2592000
cf-ray: 79ecae11ea9c695b-FRA
access-control-allow-headers: OneSignal-Subscription-Id
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Mon, 27 Mar 2023 01:31:11 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230222/r20110914/client/ Frame 1BD8 3 KB
1 KB 134ms
47ms Script
text/javascript 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230222/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9538727938022233&output=html&h=280&slotname=9292693240&adk=328962951&adf=3025194257&pi=t.ma~as.9292693240&w=1200&fwrn=4&fwrnh=100&lmt=1677288670&rafmt=1&format=1200x280&url=https%3A%2F%2Fwww.richrainbows.com%2Faec%2Fqbot.zip&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1677288670476&bpp=3&bdt=539&idt=429&shv=r20230222&mjsv=m202302150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3110296830212&frm=20&pv=1&ga_vid=397696976.1677288671&ga_sid=1677288671&ga_hid=1401903725&ga_fc=1&ga_cid=1927876617.1677288671&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=0&ady=0&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44777876%2C44759837%2C31071756%2C31072480&oid=2&pvsid=856095500874408&tmod=908495160&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpEe%7Cp&abl=XS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=kXpTPLZDaI&p=https%3A//www.richrainbows.com&dtd=435

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Fri, 24 Feb 2023 11:58:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48765
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 10 Mar 2023 11:58:26 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230222/r20110914/client/ Frame 1BD8 20 KB
8 KB 123ms
37ms Script
text/javascript 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230222/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5e713a207017a40f54387d0e25bbb3cbbe1b3d10338cdd4a7342cc1486b19140

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Fri, 24 Feb 2023 18:59:03 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23528
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8274
x-xss-protection: 0
server: cafe
etag: 9471482037410804447
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 10 Mar 2023 18:59:03 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1BD8 158 KB
49 KB 127ms
46ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

82d63ecef7851ffd217020b3817b0206328488879b0c782f9b67d43bd1479a2a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49360
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1677104061356577"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 25 Feb 2023 01:31:11 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 1BD8 0
0 86ms
84ms Fetch
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CbX5R3mT5Y6GkOa2LjuwP6_SCsAvJntKxXNX24taTAcCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi05NTM4NzI3OTM4MDIyMjMzyAEJqQLD_Cs5UbKxPqgDAaoE9QFP0Mj6VQjCA8Bz7qLSHAKFueGWY3Nv_gVx8KDnhcpvHkeI-vjduU0kT35ANo2mt3akS_DJ9TC_0h7CvZYRMwwRN2fzkgq68BhuzF9CFasw2v1hNb2BrXXCzK4yJRF7Z9skXjAy0wPH9jHSyHosn2JntJFFxP_77MdHDb46Xs8zylpy67FJ7kTd-SmXp0xRyGImCIDtxyiSWEGW-7Gl0pdC7jAvd9q5B51QPLJ4Z1hCPBgX87uBt1ifOzvLkDbIvXWr4QJEnOqjhCn5wEF414kINxCsR7DDIedrH0Q0XREaCUSxxwLkQLkWxZibYEF05FaGQAl3f4AGq5-pzdqi4vUnoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQIAKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi05NTM4NzI3OTM4MDIyMjMzGAA&sigh=OxmNGqPuxN0&uach_m=[UACH]&cid=CAQSGwDUE5ymtr7m14osyoNjxFm5SiwAa08Blvn6kBgB

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9538727938022233&output=html&h=280&slotname=9292693240&adk=328962951&adf=3025194257&pi=t.ma~as.9292693240&w=1200&fwrn=4&fwrnh=100&lmt=1677288670&rafmt=1&format=1200x280&url=https%3A%2F%2Fwww.richrainbows.com%2Faec%2Fqbot.zip&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1677288670476&bpp=3&bdt=539&idt=429&shv=r20230222&mjsv=m202302150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3110296830212&frm=20&pv=1&ga_vid=397696976.1677288671&ga_sid=1677288671&ga_hid=1401903725&ga_fc=1&ga_cid=1927876617.1677288671&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=0&ady=0&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44777876%2C44759837%2C31071756%2C31072480&oid=2&pvsid=856095500874408&tmod=908495160&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpEe%7Cp&abl=XS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=kXpTPLZDaI&p=https%3A//www.richrainbows.com&dtd=435
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 25 Feb 2023 01:31:11 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 25 Feb 2023 01:31:11 GMT

GET
H2 200 notify
rtb.nl3.eu.criteo.com/google/auction/ Frame 1BD8 0
0 48ms
15ms Fetch 2a02:2638:3::9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.nl3.eu.criteo.com/google/auction/notify?profile=14&payload=kMWCFMz6RLAJmAKdg2ICAgAAAMavHVL1PMA1EN5k-WMTDf8Y4GtB9Kw-AAASAAAKDkFRVUJBUVlCQVFFQkFR&wp=Y_lk3gAOUiEHg4WtAAC6axAIbELsFlqDqWVjwg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:10 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
server-processing-duration-in-ticks: 179447
content-length: 0

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 4B53 132 KB
45 KB 135ms
99ms Document
text/html 2a02:2638::b
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=Y_lk3gAOUiEHg4WtAAC6axAIbELsFlqDqWVjwg&u=%7Ctq6IVDBjPrf957MAdMQU12HrKEHTKCCklMXweqR5WF0%3D%7C&c1=TEbw32HdmhlTb08vzaRE05Nor-kWNW37ds0oDHxEuxeKn7Xrp6ainli_Cmw5dJSudhYAqTqyTVLZ73Wbp2hSsQetf0nCCbBw5UDDa1cwUNSy9sHEMskIO5l1uCU2z_A35b6-wUWZtjboThnTX-XC_xMxK4qYRyWhCJAKkr1jUjlefx-Onr_nQ7arxFwZRBXNU4G-IRNq8EeQ6XMiCRvjROivDwFn7WH9kbpnu7MHQhA8MN40HvaqdEmbKB44mhCVGbLTEu8zT6k9LVfvbCJ68sQ9VRMzvxUR_CTFcxoZK0yNPfEX5m6oPbRVOS7XyCjz68VfgQCN6kTVVJRSod4V-HOuoGck84_GallOF5_2oJ_PhXtACpO9F2B42IgUTdgTRlcQ0EPjezsSB2Ref65hd9GJqy_2MEzmQFYCylmfIl9qXlESiHoCcUEVZ-jSyXaS7lh-RM0JD9rXFQcLTXdCpXtVnsM_YhjksKxrBhyrJyvo73uobk8CbhNM7VXfon7p-UrL1kYNn3vZzuCWv4h5kt7Cjx7-KMIHa9wDnCeIqRn4zTSCsSEwiD-19E3wXNjgMM8qQDhPrbQiTKrqE8Qjv3Gt05wMjbqqwXEuAadPJ9zbhFSV0aPW8yiiwx252LvN&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCKf0X3mT5Y6GkOa2LjuwP6_SCsAvJntKxXNX24taTAcCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi05NTM4NzI3OTM4MDIyMjMzyAEJqQLD_Cs5UbKxPqgDAaoE-AFP0Mj6VQjCA8Bz7qLSHAKFueGWY3Nv_gVx8KDnhcpvHkeI-vjduU0kT35ANo2mt3akS_DJ9TC_0h7CvZYRMwwRN2fzkgq68BhuzF9CFasw2v1hNb2BrXXCzK4yJRF7Z9skXjAy0wPH9jHSyHosn2JntJFFxP_77MdHDb46Xs8zylpy67FJ7kTd-SmXp0xRyGImCIDtxyiSWEGW-7Gl0pdC7jAvd9q5B51QPLJ4Z1hCPBgX87uBt1ifOzvLkDbIvXWr4QJEnOqjhCn5wEF414lKNTE-wD9fMlj3C-fkYLfiAFC7cQjKWDuiDaU9kv5qyE4D6o1kwIenZIAGq5-pzdqi4vUnoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1mGd0w-ZDMDmhNFA6sC-nB9F7Ldg%26client%3Dca-pub-9538727938022233%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::b , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

741990218bbe2810881d4f189f11d4d1e7f3c07aa16dbd8211037576ef3dc220

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Sat, 25 Feb 2023 01:31:11 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=o2pvxeaONaVjGZKtElOwFUdUotTzRPn3kyR9_7XUtEbnAs7iczEdYIljc0Q0JSgu6dAW7W65o_hcsk0kUtivlrxfiUkyHjfDMLZmaAwn6gnXJY8PeE8r7cNt79u8Abz3JwpQwzFtWpWD-KSBrrQFbxEw3uYkOVh0kZtOVxX17l2E2KhBUiLiI-7ZGioy6f5Qo0D1uMpkNHpb-eW2vxK-3n0GJ4C9CM20E-6MXQPeTAVzrirhdWCUmFT65LlquBhtOgRcQA"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 80336716
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230222/r20110914/client/ Frame 802A 3 KB
1 KB 90ms
45ms Script
text/javascript 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230222/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9538727938022233&output=html&h=280&slotname=9292693240&adk=3400383200&adf=2587467011&pi=t.ma~as.9292693240&w=345&fwrn=4&fwrnh=100&lmt=1677288670&rafmt=1&format=345x280&url=https%3A%2F%2Fwww.richrainbows.com%2Faec%2Fqbot.zip&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1677288670479&bpp=1&bdt=543&idt=443&shv=r20230222&mjsv=m202302150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=3110296830212&frm=20&pv=1&ga_vid=397696976.1677288671&ga_sid=1677288671&ga_hid=1401903725&ga_fc=1&ga_cid=1927876617.1677288671&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1025&ady=527&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44777876%2C44759837%2C31071756%2C31072480&oid=2&pvsid=856095500874408&tmod=908495160&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeE%7Cp&abl=XS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=XttYYTGWxF&p=https%3A//www.richrainbows.com&dtd=448

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Fri, 24 Feb 2023 11:58:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48765
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 10 Mar 2023 11:58:26 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230222/r20110914/client/ Frame 802A 20 KB
8 KB 84ms
39ms Script
text/javascript 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230222/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9538727938022233&output=html&h=280&slotname=9292693240&adk=3400383200&adf=2587467011&pi=t.ma~as.9292693240&w=345&fwrn=4&fwrnh=100&lmt=1677288670&rafmt=1&format=345x280&url=https%3A%2F%2Fwww.richrainbows.com%2Faec%2Fqbot.zip&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1677288670479&bpp=1&bdt=543&idt=443&shv=r20230222&mjsv=m202302150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=3110296830212&frm=20&pv=1&ga_vid=397696976.1677288671&ga_sid=1677288671&ga_hid=1401903725&ga_fc=1&ga_cid=1927876617.1677288671&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1025&ady=527&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44777876%2C44759837%2C31071756%2C31072480&oid=2&pvsid=856095500874408&tmod=908495160&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeE%7Cp&abl=XS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=XttYYTGWxF&p=https%3A//www.richrainbows.com&dtd=448

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5e713a207017a40f54387d0e25bbb3cbbe1b3d10338cdd4a7342cc1486b19140

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Fri, 24 Feb 2023 18:59:03 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23528
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8274
x-xss-protection: 0
server: cafe
etag: 9471482037410804447
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 10 Mar 2023 18:59:03 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 802A 158 KB
48 KB 138ms
99ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9538727938022233&output=html&h=280&slotname=9292693240&adk=3400383200&adf=2587467011&pi=t.ma~as.9292693240&w=345&fwrn=4&fwrnh=100&lmt=1677288670&rafmt=1&format=345x280&url=https%3A%2F%2Fwww.richrainbows.com%2Faec%2Fqbot.zip&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1677288670479&bpp=1&bdt=543&idt=443&shv=r20230222&mjsv=m202302150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=3110296830212&frm=20&pv=1&ga_vid=397696976.1677288671&ga_sid=1677288671&ga_hid=1401903725&ga_fc=1&ga_cid=1927876617.1677288671&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1025&ady=527&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44777876%2C44759837%2C31071756%2C31072480&oid=2&pvsid=856095500874408&tmod=908495160&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeE%7Cp&abl=XS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=XttYYTGWxF&p=https%3A//www.richrainbows.com&dtd=448

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

82d63ecef7851ffd217020b3817b0206328488879b0c782f9b67d43bd1479a2a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49360
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1677104061356577"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 25 Feb 2023 01:31:11 GMT

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202302150101/ 150 KB
51 KB 56ms
56ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202302150101/reactive_library_fy2021.js?bust=31072480

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8ca545d8d7e0531dde6c66e3e6546db5a52f2812dc402665961da64056d98eea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52044
x-xss-protection: 0
server: cafe
etag: 12401963574962989206
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sat, 25 Feb 2023 01:31:11 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 802A 0
0 83ms
82ms Fetch
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CA64D3mT5Y9KHOsKOjuwPhdS94AzJntKxXJWil_dwwI23ARABIABgleKQgqAHggEXY2EtcHViLTk1Mzg3Mjc5MzgwMjIyMzPIAQmpAsvgOcE6tLE-qAMBqgT0AU_QzKW7AGbWxHkz4Lgwc3G-oPErGMWfjRd6o5xW-LhwLo9qIavWHwD8V2rKIvRnvaQopQs3PCdYpjUzW6VP93_OYXt7t6kmAyCtN6YSP6q4aGfhNqnoqlL5WJJgznj-CMsPuAKPUYfWE4pKEwLuQVa08fftswEwMQcBGuSge249cIjbmMbnZ2iZO5oEgL4GKC8CWLufFMmuq8Xq6ovpFa7mWAaa4anYYt02YzPD0hXhhCZdu2T54K-8_EhSFUIOyGm5fypb3XR3HPnE9ce_1ujnJh-v8t_enVxyrHquEjMOldHg-kkeQUeKPcobh0uwR9WfLpWABqufqc3aouL1J6AGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgECACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItOTUzODcyNzkzODAyMjIzMxgA&sigh=bedSa6brHjg&uach_m=[UACH]&cid=CAQSGwDUE5ymSzppEt-6nuUS4a1r8ar3uYGruvqRfBgB

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9538727938022233&output=html&h=280&slotname=9292693240&adk=3400383200&adf=2587467011&pi=t.ma~as.9292693240&w=345&fwrn=4&fwrnh=100&lmt=1677288670&rafmt=1&format=345x280&url=https%3A%2F%2Fwww.richrainbows.com%2Faec%2Fqbot.zip&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1677288670479&bpp=1&bdt=543&idt=443&shv=r20230222&mjsv=m202302150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=3110296830212&frm=20&pv=1&ga_vid=397696976.1677288671&ga_sid=1677288671&ga_hid=1401903725&ga_fc=1&ga_cid=1927876617.1677288671&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1025&ady=527&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44777876%2C44759837%2C31071756%2C31072480&oid=2&pvsid=856095500874408&tmod=908495160&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeE%7Cp&abl=XS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=XttYYTGWxF&p=https%3A//www.richrainbows.com&dtd=448

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9538727938022233&output=html&h=280&slotname=9292693240&adk=3400383200&adf=2587467011&pi=t.ma~as.9292693240&w=345&fwrn=4&fwrnh=100&lmt=1677288670&rafmt=1&format=345x280&url=https%3A%2F%2Fwww.richrainbows.com%2Faec%2Fqbot.zip&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1677288670479&bpp=1&bdt=543&idt=443&shv=r20230222&mjsv=m202302150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=3110296830212&frm=20&pv=1&ga_vid=397696976.1677288671&ga_sid=1677288671&ga_hid=1401903725&ga_fc=1&ga_cid=1927876617.1677288671&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1025&ady=527&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44777876%2C44759837%2C31071756%2C31072480&oid=2&pvsid=856095500874408&tmod=908495160&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeE%7Cp&abl=XS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=XttYYTGWxF&p=https%3A//www.richrainbows.com&dtd=448
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 25 Feb 2023 01:31:11 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 25 Feb 2023 01:31:11 GMT

GET
H2 200 notify
rtb.fr.eu.criteo.com/google/auction/ Frame 802A 0
0 62ms
16ms Fetch 2a02:2638::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.fr.eu.criteo.com/google/auction/notify?profile=14&payload=kMWCFMz6RNkCmAKdg2ICAgAAAMavHVL1PMA1EN5k-WPAqUHA_5xW7vrxAAASAAAKDkFRVUJCUVlCQlFFQkJR&wp=Y_lk3gAOg9IHg4dCAA9qBTxs3-1KzPPxmY_z6Q

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9538727938022233&output=html&h=280&slotname=9292693240&adk=3400383200&adf=2587467011&pi=t.ma~as.9292693240&w=345&fwrn=4&fwrnh=100&lmt=1677288670&rafmt=1&format=345x280&url=https%3A%2F%2Fwww.richrainbows.com%2Faec%2Fqbot.zip&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1677288670479&bpp=1&bdt=543&idt=443&shv=r20230222&mjsv=m202302150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=3110296830212&frm=20&pv=1&ga_vid=397696976.1677288671&ga_sid=1677288671&ga_hid=1401903725&ga_fc=1&ga_cid=1927876617.1677288671&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1025&ady=527&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44777876%2C44759837%2C31071756%2C31072480&oid=2&pvsid=856095500874408&tmod=908495160&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeE%7Cp&abl=XS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=XttYYTGWxF&p=https%3A//www.richrainbows.com&dtd=448

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:10 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
server-processing-duration-in-ticks: 283930
content-length: 0

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 2FFB 169 KB
51 KB 114ms
112ms Document
text/html 2a02:2638::b
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=Y_lk3gAOg9IHg4dCAA9qBTxs3-1KzPPxmY_z6Q&u=%7CSkYjTyvq6EXJn8hd7AQnyCCc7lXBd4IgVJ%2BPOahhmsI%3D%7C&c1=TEbw32HdmhlTb08vzaRE05Nor-kWNW37ds0oDHxEuxeKn7Xrp6ainli_Cmw5dJSudhYAqTqyTVJUGqNRryn5F6wbhZxWii85p_XIY2ky4V5oFCiPXaIpIVgTcUUSB97WNxnv7RgFR1etgBx_EGwXmlLPCIvpdnxYEbLSsaaUviEib-W8dFT4AcfHIkFjPhMiWeyEYSkwXn1-X4k_Jwsqp0cAzZ0lWP-CCLqJBAYmWxRDaqxlPlPsGxYPhje5SOKJbRZRPqwsBv1ZtpFJT9CCWo83vpn3TR1dYsKiTRXm2NWOLh3O5_wry9EBcZtuEFHqU63RCdbIuRLz8apw1yVG7ibu2v17LnsJdJtNeXkzotColX08LvHRzyqZE1N5tomWDJmFn1z8nvGx6vXU5we9zlV0-xPDQjRxZxpBrOrSZQSv-0G5SaHLmNtufbMNV7H7JKANMMpqnL8eTPu-S3wVY1h9t7_0bqbV6lQfT7vJggwGIMoM8buze2owJx-DDzbUzn_t4Tcf-GjIDX3pxHNqSqgt4iyxv5ujKdNo3lvRxo80_mrWh54YoMMR3HcCYEPIK1c5GgRBs2TaTu4lVNi7m9JwHn2Tao_bBZ-1mjhYRc6UVbU5nosgbw&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCyK_23mT5Y9KHOsKOjuwPhdS94AzJntKxXJWil_dwwI23ARABIABgleKQgqAHggEXY2EtcHViLTk1Mzg3Mjc5MzgwMjIyMzPIAQmpAsvgOcE6tLE-qAMBqgT3AU_QzKW7AGbWxHkz4Lgwc3G-oPErGMWfjRd6o5xW-LhwLo9qIavWHwD8V2rKIvRnvaQopQs3PCdYpjUzW6VP93_OYXt7t6kmAyCtN6YSP6q4aGfhNqnoqlL5WJJgznj-CMsPuAKPUYfWE4pKEwLuQVa08fftswEwMQcBGuSge249cIjbmMbnZ2iZO5oEgL4GKC8CWLufFMmuq8Xq6ovpFa7mWAaa4anYYt02YzPD0hXhhCZdu2T54K-8_EhSFUIOyGm5fypb3XR3HPnE9ce_lOrGtJggbsxhAUjRfEcI6joan2fq1FGc9Y-3mzikmWeown8bPSpWoRiABqufqc3aouL1J6AGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1Re_J31vty17vMr_aX3yBBy2AUKQ%26client%3Dca-pub-9538727938022233%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9538727938022233&output=html&h=280&slotname=9292693240&adk=3400383200&adf=2587467011&pi=t.ma~as.9292693240&w=345&fwrn=4&fwrnh=100&lmt=1677288670&rafmt=1&format=345x280&url=https%3A%2F%2Fwww.richrainbows.com%2Faec%2Fqbot.zip&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1677288670479&bpp=1&bdt=543&idt=443&shv=r20230222&mjsv=m202302150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=3110296830212&frm=20&pv=1&ga_vid=397696976.1677288671&ga_sid=1677288671&ga_hid=1401903725&ga_fc=1&ga_cid=1927876617.1677288671&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1025&ady=527&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44777876%2C44759837%2C31071756%2C31072480&oid=2&pvsid=856095500874408&tmod=908495160&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeE%7Cp&abl=XS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=XttYYTGWxF&p=https%3A//www.richrainbows.com&dtd=448

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::b , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

2a5cbfc989d3e75d8c5b321ecb75f20874d5fb343f8630fff6a4d2665e2c87ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Sat, 25 Feb 2023 01:31:11 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=uXJ-f-aONaVjGZKtBrVqtHHk-9WI-5-nG2CQuowUF4Nqgns52_5bxUOsk4AvALk3pGmtRdlcA95uQT5X8zJ6yWOO6NOF2brnxR4IFv7Ma777_DCMkIAjGnLEeyvnUFgPN2r7O9tAdtS_P_DWaadTRpJe7Um4-ZVfS-Fc8y3WHGhXzCyl2EMGheQajxSaHpX0TrAFwAVXNZ1SRMhFu0f4IgXUQUgj5iJW8NXYHR8IvF9EaMKdv08fJ4jaspP5Qa0V2V2aZQ"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 89663299
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 icon Show response
onesignal.com/api/v1/apps/8b03d93f-913d-481d-b99b-9470fda53085/ 44 B
522 B 50ms
39ms Fetch
application/json 2606:4700::6812:d73b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/apps/8b03d93f-913d-481d-b99b-9470fda53085/icon

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151515

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:d73b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e51140cdcd044ad76335646936ec53196a169aace83a8b266bc1c182a944609b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: MISS
x-permitted-cross-domain-policies: none
strict-transport-security: max-age=15552000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44
x-xss-protection: 1; mode=block
x-request-id: da8f5bd1-6bbb-4278-8de9-d1d23ff8a5de
x-runtime: 0.009503
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"e51140cdcd044ad76335646936ec5319"
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Accept, Origin, Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=0, private, must-revalidate
accept-ranges: bytes
cf-ray: 79ecae12bbf0364b-FRA
access-control-allow-headers: SDK-Version

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 71ms
68ms Script
application/javascript 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.richrainbows.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 71ms
69ms Script
application/javascript 2a00:1450:400d:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.richrainbows.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230222/r20110914/ Frame 300B 10 KB
4 KB 38ms
38ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230222/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.richrainbows.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 13112
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 24 Feb 2023 21:52:39 GMT
etag: 10353107486223812946
expires: Fri, 10 Mar 2023 21:52:39 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230222/r20110914/ Frame D819 10 KB
4 KB 38ms
38ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230222/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.richrainbows.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 13112
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 24 Feb 2023 21:52:39 GMT
etag: 10353107486223812946
expires: Fri, 10 Mar 2023 21:52:39 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 4B53 2 KB
1 KB 53ms
17ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y_lk3gAOUiEHg4WtAAC6axAIbELsFlqDqWVjwg&u=%7Ctq6IVDBjPrf957MAdMQU12HrKEHTKCCklMXweqR5WF0%3D%7C&c1=TEbw32HdmhlTb08vzaRE05Nor-kWNW37ds0oDHxEuxeKn7Xrp6ainli_Cmw5dJSudhYAqTqyTVLZ73Wbp2hSsQetf0nCCbBw5UDDa1cwUNSy9sHEMskIO5l1uCU2z_A35b6-wUWZtjboThnTX-XC_xMxK4qYRyWhCJAKkr1jUjlefx-Onr_nQ7arxFwZRBXNU4G-IRNq8EeQ6XMiCRvjROivDwFn7WH9kbpnu7MHQhA8MN40HvaqdEmbKB44mhCVGbLTEu8zT6k9LVfvbCJ68sQ9VRMzvxUR_CTFcxoZK0yNPfEX5m6oPbRVOS7XyCjz68VfgQCN6kTVVJRSod4V-HOuoGck84_GallOF5_2oJ_PhXtACpO9F2B42IgUTdgTRlcQ0EPjezsSB2Ref65hd9GJqy_2MEzmQFYCylmfIl9qXlESiHoCcUEVZ-jSyXaS7lh-RM0JD9rXFQcLTXdCpXtVnsM_YhjksKxrBhyrJyvo73uobk8CbhNM7VXfon7p-UrL1kYNn3vZzuCWv4h5kt7Cjx7-KMIHa9wDnCeIqRn4zTSCsSEwiD-19E3wXNjgMM8qQDhPrbQiTKrqE8Qjv3Gt05wMjbqqwXEuAadPJ9zbhFSV0aPW8yiiwx252LvN&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCKf0X3mT5Y6GkOa2LjuwP6_SCsAvJntKxXNX24taTAcCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi05NTM4NzI3OTM4MDIyMjMzyAEJqQLD_Cs5UbKxPqgDAaoE-AFP0Mj6VQjCA8Bz7qLSHAKFueGWY3Nv_gVx8KDnhcpvHkeI-vjduU0kT35ANo2mt3akS_DJ9TC_0h7CvZYRMwwRN2fzkgq68BhuzF9CFasw2v1hNb2BrXXCzK4yJRF7Z9skXjAy0wPH9jHSyHosn2JntJFFxP_77MdHDb46Xs8zylpy67FJ7kTd-SmXp0xRyGImCIDtxyiSWEGW-7Gl0pdC7jAvd9q5B51QPLJ4Z1hCPBgX87uBt1ifOzvLkDbIvXWr4QJEnOqjhCn5wEF414lKNTE-wD9fMlj3C-fkYLfiAFC7cQjKWDuiDaU9kv5qyE4D6o1kwIenZIAGq5-pzdqi4vUnoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1mGd0w-ZDMDmhNFA6sC-nB9F7Ldg%26client%3Dca-pub-9538727938022233%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 4B53 2 KB
1 KB 53ms
18ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 4B53 308 B
636 B 25ms
19ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 4B53 293 B
621 B 27ms
22ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 lg.php
cat.fr.eu.criteo.com/delivery/ Frame 4B53 43 B
348 B 67ms
18ms Image
image/gif 178.250.0.160
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.fr.eu.criteo.com/delivery/lg.php?cppv=3&cpp=QA7-CbtN-RQUOohkDdd_K8QTT370YTDNYlEgENY1N_A0JaBRlThvYiklpveIyMWYaWpAf_tq1MLvU_PnDsh7vRLcvxZd9Icp3FkQRP-3DCbRVMWjOqPkBUprHBXuEorOg8xlTyOoje4ste6SJ2VF7d4RD4dF1hT6Ct9Dxhf28tWH9BD7Z6nDMw98IX2vJze4ozeLS-UIzN41BwHnkv8BpixomMH1OS4zQZUh6w6TRgqKSPXl39GJqdJGFbvi5eC1rgvDcHgdketb7EawjPLQj8CRAcgQqZj29woEOQK_tN4eLOPiFpu-daWpUgFKMgYqGI5ExCSHZX3gHft8gMwKdqErNxXzP1HNYTPxnS5hADWsX_pC0KxJaNrLDPzfPJKPXUd96sOwsncR3w2aJwU6uFH9FSirzn-GAk_A42SKnKDzCzfZ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.160 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 25 Feb 2023 01:31:10 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2898970
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 2FFB 2 KB
1 KB 48ms
21ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y_lk3gAOg9IHg4dCAA9qBTxs3-1KzPPxmY_z6Q&u=%7CSkYjTyvq6EXJn8hd7AQnyCCc7lXBd4IgVJ%2BPOahhmsI%3D%7C&c1=TEbw32HdmhlTb08vzaRE05Nor-kWNW37ds0oDHxEuxeKn7Xrp6ainli_Cmw5dJSudhYAqTqyTVJUGqNRryn5F6wbhZxWii85p_XIY2ky4V5oFCiPXaIpIVgTcUUSB97WNxnv7RgFR1etgBx_EGwXmlLPCIvpdnxYEbLSsaaUviEib-W8dFT4AcfHIkFjPhMiWeyEYSkwXn1-X4k_Jwsqp0cAzZ0lWP-CCLqJBAYmWxRDaqxlPlPsGxYPhje5SOKJbRZRPqwsBv1ZtpFJT9CCWo83vpn3TR1dYsKiTRXm2NWOLh3O5_wry9EBcZtuEFHqU63RCdbIuRLz8apw1yVG7ibu2v17LnsJdJtNeXkzotColX08LvHRzyqZE1N5tomWDJmFn1z8nvGx6vXU5we9zlV0-xPDQjRxZxpBrOrSZQSv-0G5SaHLmNtufbMNV7H7JKANMMpqnL8eTPu-S3wVY1h9t7_0bqbV6lQfT7vJggwGIMoM8buze2owJx-DDzbUzn_t4Tcf-GjIDX3pxHNqSqgt4iyxv5ujKdNo3lvRxo80_mrWh54YoMMR3HcCYEPIK1c5GgRBs2TaTu4lVNi7m9JwHn2Tao_bBZ-1mjhYRc6UVbU5nosgbw&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCyK_23mT5Y9KHOsKOjuwPhdS94AzJntKxXJWil_dwwI23ARABIABgleKQgqAHggEXY2EtcHViLTk1Mzg3Mjc5MzgwMjIyMzPIAQmpAsvgOcE6tLE-qAMBqgT3AU_QzKW7AGbWxHkz4Lgwc3G-oPErGMWfjRd6o5xW-LhwLo9qIavWHwD8V2rKIvRnvaQopQs3PCdYpjUzW6VP93_OYXt7t6kmAyCtN6YSP6q4aGfhNqnoqlL5WJJgznj-CMsPuAKPUYfWE4pKEwLuQVa08fftswEwMQcBGuSge249cIjbmMbnZ2iZO5oEgL4GKC8CWLufFMmuq8Xq6ovpFa7mWAaa4anYYt02YzPD0hXhhCZdu2T54K-8_EhSFUIOyGm5fypb3XR3HPnE9ce_lOrGtJggbsxhAUjRfEcI6joan2fq1FGc9Y-3mzikmWeown8bPSpWoRiABqufqc3aouL1J6AGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1Re_J31vty17vMr_aX3yBBy2AUKQ%26client%3Dca-pub-9538727938022233%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 2FFB 2 KB
1 KB 48ms
22ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 2FFB 308 B
636 B 24ms
20ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 2FFB 293 B
621 B 24ms
20ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 lg.php
cat.fr.eu.criteo.com/delivery/ Frame 2FFB 43 B
347 B 66ms
19ms Image
image/gif 178.250.0.160
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.fr.eu.criteo.com/delivery/lg.php?cppv=3&cpp=ygi8h7tN-RQUOohkDdd_K8QTT34EzOn_PGClTy4uuycHjXlG_eVn_K-oXiVx-9AuEfeBL5KAGLK0VNuXgyyg2_n9KGxBNffQF6BbnQc6rea6kalfWFbaiKCaRbZt3G7hnNJ10O_feiMXjgtxmm9vWm1Su2df-mT652KIa3qWlH3JSrVQbOGQHn6nhZlSC56ZdzKWKvYsLcxqkjG6sdDb4RkqAl4mEuLu5dwT0mFyEtof7rkH_wOwBwwFdAMDzKvim7afNdS2OdPvD6d6S2qdhEwK55YCfyALjgCSBaogvaXCzvh7SOe5s_FOBIOwtCI7W246MBY5aI7st4q5tbGSsxQIxlloMV_ysA74yNpl21bJ880Usk0W5BXAxiKblfJalQJOsD3MMXTry_usXFXpW85EyUucaRGozT6qMNXDx1TKw0Gr

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.160 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 3427980
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 1BD8 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a9b3a52a7911e1c2db90c1bdd506de0305c859694b6228301a34e364bbccc157

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 802A 221 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c9ee04f647e513caaa126c517a7641937d68665031f609b293de7cbf9eb3d4c3

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 7AE7 215 KB
58 KB 101ms
97ms Document
text/html 2a02:2638::b
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=Y_lk3gAOAxkKd6kPAA684xOjH2SLdYdf1X7piA&u=%7Ctq6IVDBjPreWhnij%2FEGeDRfBTp%2FsadJW%2F1k%2BwjZBcu0%3D%7C&c1=TEbw32HdmhlTb08vzaRE0-J3aJQULXRb6S19EAZ80X2gBTzv4Dq5xMxb2AiDpyinZYbjjDWoUakj_vOW-2yxcdN9EEMU4bfVBpqrY4J3iqL55gB3IiZO2uKqow7l2Q-K_KDUToBsIKJaaDQ625biEE_h443_yRNSQQL19xxUJ2DPkPuVuJcE5RPjp4YKhjWBCfeKzPiWfNRgSf_eY_0ESt1c5SBS2CWrz-9lt28htgomooHH34OZxoiO5vsH3aGES6GJIMSInBszY28519wRgzyvP_7Q8LUCEraafIhiErumQzvCw2aJjzgkG8keUGtRnoHwavWYjpgVONAJffPHw4mdD0umxftTm4q_RBJHmyF2L8UJN8hduZjY6ZdIURAAM9aGK0PfqFjfwW1KyspeHLyT1OUitEjgXbMxjRD3Wp2nopb3wkQabOG-eYSg5dey-bcMV0SM3d9yHDBf9sydjSc2MLjnSth2Spjp4cNSQPQtVji-UqJYDl1mdEKtOIZ6wuMfRz0gPPoQYBfMHeMfhb1FK8N06CD03o1Ia6MVIwG1NBA0zKhJOLYf_H8qz_T07NQBqA0f1OXeaTvq47e_4OHymbTUNAPaWLfTnXagcy18cvlcG6p8LpqGg4_EF4tZ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCf-JG3mT5Y5mGOI_S3gPj-bq4CMme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItOTUzODcyNzkzODAyMjIzM8gBCakCy-A5wTq0sT6oAwGqBPcBT9BGuKPtz6EEkZL7vIrHUXYUOLpEUar52E-iKqsoaXXmr283_SJiOHGeZIOnoxGCOpRB02xBChfYfx_9BRDjdPlK53H0CGYoNQZgN8sWvYJJap_4TKAAlWfk9rWHV6ROQem-7uI1V8IFw2l4u4TNWYANFRXnqGrMWePUbj7ntMYoDy5_R0xC7Gbwbgh0w43_odv7SCfdMHGXq8RPIoujCyvoPROCiFY4T5XRNKrg1wd9Pk_nMvaS1IAKxbdsR9TBiz4XmHXdnYYGFoyzvlb4ZM0sIjQ1gR89X8n9veSjUsrSTF-1VgdeymloiVrYxe-55oUL33gTeIAGq5-pzdqi4vUnoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2S8j9MuTOOMiCFoC2gpm9mg9lcWQ%26client%3Dca-pub-9538727938022233%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230222/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::b , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4c14187655c7504659fd46a0a4b7a43a7711948bbbcaf22f2ad9cbb1cef97a49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Sat, 25 Feb 2023 01:31:10 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=mgF8q-aONaVjGZKtivkBARZYdtgidauxAPPXrvT0jM2po49vp_9mWaMlarIOpO8NPUxH7MQWaCCS_lEmoyIp2eklJ2Bb9m8IwFFqB-cDNZqKjsrjOXMigC0d4qKYwjpS1J2q6t4RBxcAUmAOWGxkW7Op1ksUaqEhizZcZ5Q2ZoKXSNVcGJZKp88vf8XGhHmmInup9AbC_A7UgHcMHCf4COuZ-jdx32iBv6xq1q5gGgthPjqzObkuzfpe-__mChxR0jZsjA"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 80679914
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230222/r20110914/client/ Frame 300B 3 KB
1 KB 37ms
35ms Script
text/javascript 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230222/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230222/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Fri, 24 Feb 2023 11:58:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48765
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 10 Mar 2023 11:58:26 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230222/r20110914/client/ Frame 300B 20 KB
8 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230222/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230222/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5e713a207017a40f54387d0e25bbb3cbbe1b3d10338cdd4a7342cc1486b19140

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Fri, 24 Feb 2023 18:59:03 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23528
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8274
x-xss-protection: 0
server: cafe
etag: 9471482037410804447
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 10 Mar 2023 18:59:03 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 300B 158 KB
48 KB 51ms
51ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230222/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

82d63ecef7851ffd217020b3817b0206328488879b0c782f9b67d43bd1479a2a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49360
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1677104061356577"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 25 Feb 2023 01:31:11 GMT

GET
DATA 200
OK truncated
/ 582 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c1f6b66e052e0dba3f115f59a94d7304a27a73848db4b8995e2a2017ba79046b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame D819 0
0 83ms
82ms Fetch
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CSXX63mT5Y5qGOI_S3gPj-bq4CMme0rFc9eqhhogBwI23ARABIABgleKQgqAHggEXY2EtcHViLTk1Mzg3Mjc5MzgwMjIyMzPIAQmpAsvgOcE6tLE-qAMBqgT1AU_Qs9iviv5QRqJWrbwtQG8CyU603rhv7t6HI1YDpprUNann54UzKym0-2Pk1SqaxTw2W5MPjgye1pFwzSy9w75gnDvbg2RG4EelhJDwXxbnMu0QEjI9RPTMRzKostXakwMW9pjs19ta3J2u2JYml3zdA-VSQGX19UprBg0_IdZpUGsnzmhGkW3u0fCiJyXo9-zPIchJj0-zgyM75PtaJwF7P2YiIP1El4s6Kza1UHw9vVOhw57OtUXYDAxnJMnV6ppS-Pl39i61Dm1L8pVKzayeX_Gj-HN4lPwuDpC4HQMKlGt93MT6VH-6F8RSfP-MwoTuI25qgAarn6nN2qLi9SegBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBAgAoB-gsCCAGADAHQFQGAFwGyFxoKGBIUcHViLTk1Mzg3Mjc5MzgwMjIyMzMYAA&sigh=8aEXEJPoiC8&uach_m=[UACH]&cid=CAQSGwDUE5ymu73KDB15uwblkxiDq3zKERZ805Jh6xgB

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20230222/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 25 Feb 2023 01:31:11 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.fr.eu.criteo.com/google/auction/ Frame D819 0
0 18ms
18ms Fetch 2a02:2638::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.fr.eu.criteo.com/google/auction/notify?profile=14&payload=kMWCFMz6RO0HfJ2DYgICAAAAc9e4-KvHYlkQ3mT5Y7k9oAdJabkmGf4AABIAAAoOQVFVREJRWUJCUUVQQlE&wp=Y_lk3gAOAxoKd6kPAA68430lmTVd6rZ2gGQRrA

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
server-processing-duration-in-ticks: 346020
content-length: 0

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame E0E5 185 KB
55 KB 106ms
104ms Document
text/html 2a02:2638::b
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=Y_lk3gAOAxoKd6kPAA68430lmTVd6rZ2gGQRrA&u=%7Ctq6IVDBjPrf%2FkLz5InNBEVqzNeYzbv8Qu%2FSjDGAEC10%3D%7C&c1=TEbw32HdmhlTb08vzaRE05Nor-kWNW37ds0oDHxEuxeKn7Xrp6ainli_Cmw5dJSudhYAqTqyTVKScDTkoyLUyYksoS_JOn_-Ny1WjPU3ths0gwk1HltjmAoyq7gnBe6AOw3c5nJkHMMJHCoahGLfxB6AgXVgJI-bhBIXDr4XjxHP1NSfrv5JN5bNo_k_iD6TX4kwt5y8E_uwGrehlr5b6Wai062UQKow7FQ_hZNtU6i7EhT7L0Xe0AU1BpyJkJv-Z6mIiG4BjUloq_Kj_mvEvhMiO705iA4L2YocMh38ZonaQOjcrLXiNfZkYpaGpTuBTMc7tOOjSdnIYi0Q5SziAr39ZACY2CY3ioBkTUqTID8fNk2cSeQ88H0knJ4qjRRunFRm9UmTb3BXfcICq2aNN3Ni3pOqLzqw0nzRhsT1P515ntQfrU_BUcchz1kuo3PUPQCEzkMCkLNSzfxr0Ma_c1HSnT2cuKNm46qkoPBGQO63gvORwqEK85pf7mlWuQsEG-5wsNqngY0RYBgUyN_mjrwnrM3N3AngShujKWtbv7m8crOHSYarPCQ_CH8T_uy_yRtD99vZfIHh81QSUGGBgwv8Z2gDunHmMJBEcMD9itpZZLQZBiTd7PUCOdK0I_V2&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCHfi33mT5Y5qGOI_S3gPj-bq4CMme0rFc9eqhhogBwI23ARABIABgleKQgqAHggEXY2EtcHViLTk1Mzg3Mjc5MzgwMjIyMzPIAQmpAsvgOcE6tLE-qAMBqgT4AU_Qs9iviv5QRqJWrbwtQG8CyU603rhv7t6HI1YDpprUNann54UzKym0-2Pk1SqaxTw2W5MPjgye1pFwzSy9w75gnDvbg2RG4EelhJDwXxbnMu0QEjI9RPTMRzKostXakwMW9pjs19ta3J2u2JYml3zdA-VSQGX19UprBg0_IdZpUGsnzmhGkW3u0fCiJyXo9-zPIchJj0-zgyM75PtaJwF7P2YiIP1El4s6Kza1UHw9vVOhw57OtUXYDAxnJMnV6ppS-Pl39i61Dm1L8pVKze6cfmMkd-9rK2A6rUCFu_sDgGHL1uri1styKmKgw-Gg2gFEp33VM8JYgAarn6nN2qLi9SegBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_1oClthW14P-nzylg4mXann3K-zhA%26client%3Dca-pub-9538727938022233%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230222/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::b , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

5d426bc5ba4a82301389644e89f4727089e15fcb5eaa109bd3d0f38eb9ad39ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Sat, 25 Feb 2023 01:31:10 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=xgOWqOaONaVjGZKthh1KBnCrE-WaP6F7JHWtrFny6x2XRAL94dKi0GQk1xnmLnBohkUYGY1Z0HE4TD0NhYAb5OCSwW9NC740IQgJxlfItPPMaZLanslHdNdMwP_JxQaPMEZ3E_eJCFbPzEYQ40UEbMlKRwbK4ZT_kI3Ffr9KRuGhM_b5rlsK4JI4aX50rwsiCn72GJD7rLQCZP8zF1Z7CuXVqj6zms7-kEcY1X_Qs9FtBSMlSb3m4E__otgGdTP3VQw87g"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 82260189
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230222/r20110914/client/ Frame D819 3 KB
1 KB 36ms
35ms Script
text/javascript 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230222/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230222/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Fri, 24 Feb 2023 11:58:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48765
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 10 Mar 2023 11:58:26 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230222/r20110914/client/ Frame D819 20 KB
8 KB 38ms
37ms Script
text/javascript 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230222/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230222/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5e713a207017a40f54387d0e25bbb3cbbe1b3d10338cdd4a7342cc1486b19140

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Fri, 24 Feb 2023 18:59:03 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23528
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8274
x-xss-protection: 0
server: cafe
etag: 9471482037410804447
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 10 Mar 2023 18:59:03 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D819 158 KB
48 KB 51ms
50ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230222/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

82d63ecef7851ffd217020b3817b0206328488879b0c782f9b67d43bd1479a2a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49360
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1677104061356577"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 25 Feb 2023 01:31:11 GMT

GET
H2 200 montserrat-400.css
static.criteo.net/design/googlefont/montserrat/ Frame 4B53 2 KB
803 B 16ms
15ms Stylesheet
text/css 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/montserrat/montserrat-400.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a81d25118c6f7d835e9ca132b995b8aca46e3575ee4ab2136ab96ac8d5e4688b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:06:54 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391ef7e-675"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 montserrat-700.css
static.criteo.net/design/googlefont/montserrat/ Frame 4B53 2 KB
803 B 17ms
17ms Stylesheet
text/css 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/montserrat/montserrat-700.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

77a44f65bb6894c92e3c7ccab98de0fc357172221cc1dd45949ab938c0c7756a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:06:55 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391ef7f-675"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 4B53 12 KB
6 KB 17ms
16ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 4B53 11 KB
11 KB 134ms
44ms Image
image/png 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=556&m=0&partner=915&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F771%2F160923%2F58605b2e514c432f98cd3a75f9acc6b6_logo_n_horizontal.png&v=3&w=196&s=eaPMZTf4znptWKGH0Lv59U7l

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

a690dfaf60d7dac70959d80eb53b4b2234adb0479977f6802b1085d972611e66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:10 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=28513350
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 11279
expires: Sun, 21 Jan 2024 01:53:41 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 4B53 6 KB
7 KB 106ms
17ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F17%2F17065126KC_14_F.JPG&v=3&w=400&s=76ToJfZL9DQmJ8PTR3ji80HG&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

807c14c68eaa25cb70ad95aa6b1d8fed9314aaad76e179950e9b2975d1aba10b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 6590
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 4B53 13 KB
13 KB 120ms
31ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F12%2F12988665JM_14_F.JPG&v=3&w=400&s=AZiFNlGbbdI3HsX0ZVI_J6Ei&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

9a1e7ebe8c7ff87a27891ed2251c2d5c6a5cd4ea40eae24298414f9a0cb73b1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 13356
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 4B53 4 KB
4 KB 107ms
18ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F34%2F34995539HA_14_F.JPG&v=3&w=400&s=i9CQsiYD_xzEHFEimNBh0-4I&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

362f7aab0ebdefbc02de2717644a6d7db6c03ba665be2902a0d3263f86030feb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3702
expires: Tue, 20 Feb 2024 01:31:11 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 4B53 0
128 B 103ms
15ms Ping
text/plain 2a02:2638:3::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=o2pvxeaONaVjGZKtElOwFUdUotTzRPn3kyR9_7XUtEbnAs7iczEdYIljc0Q0JSgu6dAW7W65o_hcsk0kUtivlrxfiUkyHjfDMLZmaAwn6gnXJY8PeE8r7cNt79u8Abz3JwpQwzFtWpWD-KSBrrQFbxEw3uYkOVh0kZtOVxX17l2E2KhBUiLiI-7ZGioy6f5Qo0D1uMpkNHpb-eW2vxK-3n0GJ4C9CM20E-6MXQPeTAVzrirhdWCUmFT65LlquBhtOgRcQA&sds=2&rev=84699&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 4B53 2 KB
1 KB 17ms
16ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 4B53 2 KB
1 KB 16ms
16ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 embedded.js Show response
a.mailmunch.co/app/v1/ 4 KB
2 KB 8ms
8ms Script
text/javascript 2600:9000:206f:ba00:4:c961:9640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://a.mailmunch.co/app/v1/embedded.js
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:ba00:4:c961:9640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b846ef170dfb8305947448dbeeec8b1054f73573346678f1a4f9f72f981a4c3d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 23 Feb 2023 06:18:50 GMT
content-encoding: gzip
via: 1.1 1c5b98f7bd5001d6fe1040daa237afc6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 155542
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 1097
last-modified: Wed, 22 Feb 2023 05:50:45 GMT
server: AmazonS3
etag: "f1e1da930cc307763badc73ac9bf69d2"
access-control-max-age: 3000
access-control-allow-methods: HEAD, GET, POST, PUT, DELETE
content-type: text/javascript
access-control-allow-origin: *
access-control-expose-headers: ETag
cache-control: max-age=172800
accept-ranges: bytes
x-amz-cf-id: 5URU32Q3Q-kZiVJjVlr2xBwU4AMQeRw9U_owWCAKdhhd4aJHcXPHHQ==

GET
H2 200 popover.js Show response
a.mailmunch.co/app/v1/ 9 KB
3 KB 8ms
8ms Script
text/javascript 2600:9000:206f:ba00:4:c961:9640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://a.mailmunch.co/app/v1/popover.js
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:ba00:4:c961:9640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 81a7d8a047857c04f34dee91793ff2474128f76e8339511607f80a27179fc65b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 23 Feb 2023 19:10:54 GMT
content-encoding: gzip
via: 1.1 1c5b98f7bd5001d6fe1040daa237afc6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 109218
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 2274
last-modified: Thu, 23 Feb 2023 12:25:05 GMT
server: AmazonS3
etag: "2a310e1f32a79450336dfa82f4209a04"
access-control-max-age: 3000
access-control-allow-methods: HEAD, GET, POST, PUT, DELETE
content-type: text/javascript
access-control-allow-origin: *
access-control-expose-headers: ETag
cache-control: max-age=172800
accept-ranges: bytes
x-amz-cf-id: bEjSE0Z-FoPkflWrY6dFNf1USdpTzSe5EXHl6h-sg6d1gRVBfww6oA==

GET
H2 200 montserrat-400-latin.woff2
static.criteo.net/design/googlefont/montserrat/ Frame 4B53 12 KB
13 KB 47ms
16ms Font
application/octet-stream 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/montserrat/montserrat-400-latin.woff2

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/design/googlefont/montserrat/montserrat-400.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

5f9376c77618bf0ef43bcabf8228c9e2befde3731087b944e140a88c34066873

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://static.criteo.net/design/googlefont/montserrat/montserrat-400.css
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:06:54 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391ef7e-31a4"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 montserrat-700-latin.woff2
static.criteo.net/design/googlefont/montserrat/ Frame 4B53 13 KB
13 KB 62ms
33ms Font
application/octet-stream 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/montserrat/montserrat-700-latin.woff2

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/design/googlefont/montserrat/montserrat-700.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

28f403366c2c520bfff7d5a0883f1d53e1e87ba1c8202f3f29e6395a0b66806d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://static.criteo.net/design/googlefont/montserrat/montserrat-700.css
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:06:55 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391ef7f-3230"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 montserrat-400.css
static.criteo.net/design/googlefont/montserrat/ Frame 2FFB 2 KB
803 B 15ms
15ms Stylesheet
text/css 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/montserrat/montserrat-400.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a81d25118c6f7d835e9ca132b995b8aca46e3575ee4ab2136ab96ac8d5e4688b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:06:54 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391ef7e-675"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 montserrat-700.css
static.criteo.net/design/googlefont/montserrat/ Frame 2FFB 2 KB
803 B 17ms
17ms Stylesheet
text/css 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/montserrat/montserrat-700.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

77a44f65bb6894c92e3c7ccab98de0fc357172221cc1dd45949ab938c0c7756a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:06:55 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391ef7f-675"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 2FFB 12 KB
6 KB 17ms
17ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 2FFB 6 KB
7 KB 54ms
39ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F17%2F17065126KC_14_F.JPG&v=3&w=400&s=76ToJfZL9DQmJ8PTR3ji80HG&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

807c14c68eaa25cb70ad95aa6b1d8fed9314aaad76e179950e9b2975d1aba10b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 6590
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 2FFB 12 KB
12 KB 50ms
38ms Image
image/png 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=116&m=0&partner=915&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F771%2F160923%2F1c82ce7c2f3646fda040f07d7413b835_logo_n_horizontal.png&v=3&w=686&s=ln0477jE568tAtfAG_DMclWs

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

278b79f7fc149eb8ce484a5eeb7db0d160a8a34ab1437ce68bfa149b12d202f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:10 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=28513965
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 12498
expires: Sun, 21 Jan 2024 02:03:56 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 2FFB 3 KB
3 KB 55ms
43ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F17%2F17321428NM_14_F.JPG&v=3&w=400&s=pHsZY2jqASgWAvs0Zs4kaYvP&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

dc4fb614d588c4b753a2fb59956c6d17071150d46a7c544901160b6b1d97b7ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3066
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 2FFB 12 KB
12 KB 57ms
45ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F16%2F16197967IA_14_F.JPG&v=3&w=400&s=iGuyVtuj6VgrTgNfRNYCtWPr&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

43b620f6bc2a630299af929add4f9986dc92b49a0fcc8e107b4d49d252c4d5bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 12512
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 2FFB 7 KB
8 KB 60ms
50ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F17%2F17185702UL_14_F.JPG&v=3&w=400&s=jrDC-0CRpSBa69OOC2JWGMXD&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

3bd0d049ce762ae23530f52366dab8262419a7be7e5a27ec56814128f9b74dbf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:10 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 7566
expires: Tue, 20 Feb 2024 01:31:11 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 2FFB 0
127 B 25ms
15ms Ping
text/plain 2a02:2638:3::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=uXJ-f-aONaVjGZKtBrVqtHHk-9WI-5-nG2CQuowUF4Nqgns52_5bxUOsk4AvALk3pGmtRdlcA95uQT5X8zJ6yWOO6NOF2brnxR4IFv7Ma777_DCMkIAjGnLEeyvnUFgPN2r7O9tAdtS_P_DWaadTRpJe7Um4-ZVfS-Fc8y3WHGhXzCyl2EMGheQajxSaHpX0TrAFwAVXNZ1SRMhFu0f4IgXUQUgj5iJW8NXYHR8IvF9EaMKdv08fJ4jaspP5Qa0V2V2aZQ&sds=2&rev=84699&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Sat, 25 Feb 2023 01:31:10 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 2FFB 2 KB
1 KB 19ms
18ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 2FFB 2 KB
1 KB 20ms
19ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 montserrat-400-latin.woff2
static.criteo.net/design/googlefont/montserrat/ Frame 2FFB 12 KB
13 KB 19ms
19ms Font
application/octet-stream 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/montserrat/montserrat-400-latin.woff2

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/design/googlefont/montserrat/montserrat-400.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

5f9376c77618bf0ef43bcabf8228c9e2befde3731087b944e140a88c34066873

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://static.criteo.net/design/googlefont/montserrat/montserrat-400.css
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:06:54 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391ef7e-31a4"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 montserrat-700-latin.woff2
static.criteo.net/design/googlefont/montserrat/ Frame 2FFB 13 KB
13 KB 25ms
25ms Font
application/octet-stream 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/montserrat/montserrat-700-latin.woff2

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/design/googlefont/montserrat/montserrat-700.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

28f403366c2c520bfff7d5a0883f1d53e1e87ba1c8202f3f29e6395a0b66806d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://static.criteo.net/design/googlefont/montserrat/montserrat-700.css
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:06:55 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391ef7f-3230"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
DATA 200
OK truncated
/ Frame D819 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c0dae86594e57885884c245830efcb113fed12d95e46e852bbbc729ac51655e5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 index-1645699504.html Show response
a.mailmunch.co/forms-cache/916417/1018226/ 110 KB
39 KB 14ms
13ms XHR
text/html 2600:9000:206f:ba00:4:c961:9640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://a.mailmunch.co/forms-cache/916417/1018226/index-1645699504.html
Requested by: Host: a.mailmunch.co
URL: https://a.mailmunch.co/app/v1/site.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:ba00:4:c961:9640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 19c1d40989d7ad633008264053bdf30b7626562d3f44d153420eb71cee2f8c7d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 19 Feb 2023 18:49:25 GMT
content-encoding: gzip
via: 1.1 910fc18161f0602555cc5b6397ca26f2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 456107
x-cache: Hit from cloudfront
last-modified: Tue, 06 Dec 2022 08:00:46 GMT
server: AmazonS3
etag: W/"246cf15c831773fa50cbad22a603f7a5"
access-control-max-age: 3000
access-control-allow-methods: HEAD, GET, POST, PUT, DELETE
content-type: text/html; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: ETag
cache-control: max-age=31556952
vary: Accept-Encoding
x-amz-cf-id: 1EVi6MqVOFsXm2GcN3k6Um4lnw5qwBxWfoIOlIfctNrXTmxDGV6uPw==

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 7AE7 2 KB
1 KB 15ms
15ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y_lk3gAOAxkKd6kPAA684xOjH2SLdYdf1X7piA&u=%7Ctq6IVDBjPreWhnij%2FEGeDRfBTp%2FsadJW%2F1k%2BwjZBcu0%3D%7C&c1=TEbw32HdmhlTb08vzaRE0-J3aJQULXRb6S19EAZ80X2gBTzv4Dq5xMxb2AiDpyinZYbjjDWoUakj_vOW-2yxcdN9EEMU4bfVBpqrY4J3iqL55gB3IiZO2uKqow7l2Q-K_KDUToBsIKJaaDQ625biEE_h443_yRNSQQL19xxUJ2DPkPuVuJcE5RPjp4YKhjWBCfeKzPiWfNRgSf_eY_0ESt1c5SBS2CWrz-9lt28htgomooHH34OZxoiO5vsH3aGES6GJIMSInBszY28519wRgzyvP_7Q8LUCEraafIhiErumQzvCw2aJjzgkG8keUGtRnoHwavWYjpgVONAJffPHw4mdD0umxftTm4q_RBJHmyF2L8UJN8hduZjY6ZdIURAAM9aGK0PfqFjfwW1KyspeHLyT1OUitEjgXbMxjRD3Wp2nopb3wkQabOG-eYSg5dey-bcMV0SM3d9yHDBf9sydjSc2MLjnSth2Spjp4cNSQPQtVji-UqJYDl1mdEKtOIZ6wuMfRz0gPPoQYBfMHeMfhb1FK8N06CD03o1Ia6MVIwG1NBA0zKhJOLYf_H8qz_T07NQBqA0f1OXeaTvq47e_4OHymbTUNAPaWLfTnXagcy18cvlcG6p8LpqGg4_EF4tZ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCf-JG3mT5Y5mGOI_S3gPj-bq4CMme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItOTUzODcyNzkzODAyMjIzM8gBCakCy-A5wTq0sT6oAwGqBPcBT9BGuKPtz6EEkZL7vIrHUXYUOLpEUar52E-iKqsoaXXmr283_SJiOHGeZIOnoxGCOpRB02xBChfYfx_9BRDjdPlK53H0CGYoNQZgN8sWvYJJap_4TKAAlWfk9rWHV6ROQem-7uI1V8IFw2l4u4TNWYANFRXnqGrMWePUbj7ntMYoDy5_R0xC7Gbwbgh0w43_odv7SCfdMHGXq8RPIoujCyvoPROCiFY4T5XRNKrg1wd9Pk_nMvaS1IAKxbdsR9TBiz4XmHXdnYYGFoyzvlb4ZM0sIjQ1gR89X8n9veSjUsrSTF-1VgdeymloiVrYxe-55oUL33gTeIAGq5-pzdqi4vUnoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2S8j9MuTOOMiCFoC2gpm9mg9lcWQ%26client%3Dca-pub-9538727938022233%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 7AE7 2 KB
1 KB 16ms
16ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 7AE7 308 B
636 B 19ms
18ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 7AE7 293 B
621 B 18ms
17ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 lg.php
cat.fr.eu.criteo.com/delivery/ Frame 7AE7 43 B
347 B 20ms
20ms Image
image/gif 178.250.0.160
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.fr.eu.criteo.com/delivery/lg.php?cppv=3&cpp=m3a3_-RG4iu8-hE7K_A3x7yem1deZ20oWovYmOo8aXmvE1Iae4u8s0i57km4DUvara-q5xVhUZDy30GLJwjelQgRSwvHjC8druM5hXwiPkAE49WgVgulD4M-0cCN2IZv7EqGO8ebiowqmID_p5X3eAmXF2mR37jFspRT25_gL2NKhUj1oxQEfnV-VnPUk2Sp3o4pIKmKP39AmA6oQGThD-yGrpPtn1S0XOjm62PbI7fr47ES1wvh2F3whSkADe3SExKCKlKRDCQs-4xPstdEr7sovG8bH5yqrxO_DyNQSJktHK8OBa91m59zfFrE4ylSOnlABo5sToyyD7ITR3btZxy_PgcRjVxD_JqNfRDYkWBurLcbuxFiJmHv6nwCxnTWIMcOo2k9H0-orZ5J4mykNo3zrkeM0KhwujEB1K54lFuduLnA

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.160 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 25 Feb 2023 01:31:10 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 4092168
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame E0E5 2 KB
1 KB 18ms
18ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y_lk3gAOAxoKd6kPAA68430lmTVd6rZ2gGQRrA&u=%7Ctq6IVDBjPrf%2FkLz5InNBEVqzNeYzbv8Qu%2FSjDGAEC10%3D%7C&c1=TEbw32HdmhlTb08vzaRE05Nor-kWNW37ds0oDHxEuxeKn7Xrp6ainli_Cmw5dJSudhYAqTqyTVKScDTkoyLUyYksoS_JOn_-Ny1WjPU3ths0gwk1HltjmAoyq7gnBe6AOw3c5nJkHMMJHCoahGLfxB6AgXVgJI-bhBIXDr4XjxHP1NSfrv5JN5bNo_k_iD6TX4kwt5y8E_uwGrehlr5b6Wai062UQKow7FQ_hZNtU6i7EhT7L0Xe0AU1BpyJkJv-Z6mIiG4BjUloq_Kj_mvEvhMiO705iA4L2YocMh38ZonaQOjcrLXiNfZkYpaGpTuBTMc7tOOjSdnIYi0Q5SziAr39ZACY2CY3ioBkTUqTID8fNk2cSeQ88H0knJ4qjRRunFRm9UmTb3BXfcICq2aNN3Ni3pOqLzqw0nzRhsT1P515ntQfrU_BUcchz1kuo3PUPQCEzkMCkLNSzfxr0Ma_c1HSnT2cuKNm46qkoPBGQO63gvORwqEK85pf7mlWuQsEG-5wsNqngY0RYBgUyN_mjrwnrM3N3AngShujKWtbv7m8crOHSYarPCQ_CH8T_uy_yRtD99vZfIHh81QSUGGBgwv8Z2gDunHmMJBEcMD9itpZZLQZBiTd7PUCOdK0I_V2&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCHfi33mT5Y5qGOI_S3gPj-bq4CMme0rFc9eqhhogBwI23ARABIABgleKQgqAHggEXY2EtcHViLTk1Mzg3Mjc5MzgwMjIyMzPIAQmpAsvgOcE6tLE-qAMBqgT4AU_Qs9iviv5QRqJWrbwtQG8CyU603rhv7t6HI1YDpprUNann54UzKym0-2Pk1SqaxTw2W5MPjgye1pFwzSy9w75gnDvbg2RG4EelhJDwXxbnMu0QEjI9RPTMRzKostXakwMW9pjs19ta3J2u2JYml3zdA-VSQGX19UprBg0_IdZpUGsnzmhGkW3u0fCiJyXo9-zPIchJj0-zgyM75PtaJwF7P2YiIP1El4s6Kza1UHw9vVOhw57OtUXYDAxnJMnV6ppS-Pl39i61Dm1L8pVKze6cfmMkd-9rK2A6rUCFu_sDgGHL1uri1styKmKgw-Gg2gFEp33VM8JYgAarn6nN2qLi9SegBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_1oClthW14P-nzylg4mXann3K-zhA%26client%3Dca-pub-9538727938022233%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame E0E5 2 KB
1 KB 16ms
15ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame E0E5 308 B
636 B 17ms
15ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame E0E5 293 B
621 B 18ms
15ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 lg.php
cat.fr.eu.criteo.com/delivery/ Frame E0E5 43 B
347 B 21ms
19ms Image
image/gif 178.250.0.160
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.fr.eu.criteo.com/delivery/lg.php?cppv=3&cpp=Puf6mz3wNTBkwzG0viObvgbPIFzsNQ3AF2Lr-xMDVJRdpBHqJXPKX1OE1ykYzLE29fWMedUNaJ6pyGNsn2PZOiYNlqIG4Ntv5IYVyoW1WNPtLdQ4XRI4VDlFFmnQ4q5atrelHmQGdyMjtnTADtCQwv2RvPjaSKF3foIL10Ag1a2extnrgAAOW5jgLRzaPQV4c7vP-bhfSwG46G3pejL_eXjALxfmjo7kz5MgLA_7zLrvQhcLRKfJWbJ8oUmIoSVgvSEIbaFvslgugKNvZI6fiw_WckuCx1zIkkmlpv3E39VSnkXjYkEt8H_YAYMPIM1XHCksI2s-K2jOq53k4spzZy-2NzsK3gGqCHRANc0pm4mhbXWesRdFMexWyWj3sj7nSr58ibXhsY1RYYFdi4PI8XcT9NHSIO_BC2LKw5q46sBo_b_S

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.160 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 3355341
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 index.css
a.mailmunch.co/v2/themes/mailmunch/postman/popover/ Frame 3343 106 KB
73 KB 9ms
9ms Stylesheet
text/css 2600:9000:206f:ba00:4:c961:9640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://a.mailmunch.co/v2/themes/mailmunch/postman/popover/index.css
Requested by: Host: a.mailmunch.co
URL: https://a.mailmunch.co/app/v1/site.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:ba00:4:c961:9640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b10da3db8bd92838051a2f554d6d8dab5603d0367606f74610f901b0f18da4ee

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 23 Feb 2023 21:38:49 GMT
content-encoding: gzip
via: 1.1 1c5b98f7bd5001d6fe1040daa237afc6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 100343
x-cache: Hit from cloudfront
last-modified: Wed, 08 Jan 2020 12:09:20 GMT
server: AmazonS3
etag: W/"d481a0d1e0fc73b9a1a61665e1e49a27"
access-control-max-age: 3000
access-control-allow-methods: HEAD, GET, POST, PUT, DELETE
content-type: text/css
access-control-allow-origin: *
access-control-expose-headers: ETag
cache-control: max-age=172800
vary: Accept-Encoding
x-amz-cf-id: PQoNIxujjHlsUmts0G0czqkGcXmEelmKA6Dq6_TD43HDI4xIsOSXKA==

GET
H2 200 css
fonts.googleapis.com/ Frame 3343 6 KB
1 KB 180ms
61ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=PT+Serif|Open+Sans:400,700

Requested by

Host: a.mailmunch.co
URL: https://a.mailmunch.co/v2/themes/mailmunch/postman/popover/index.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d0d84af38d0a3a8db8a60ef11cf1752ebade98a04e8ad93cec0bd6896b25dc26

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a.mailmunch.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 25 Feb 2023 01:31:11 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 25 Feb 2023 01:31:11 GMT

GET
H2 200 montserrat-400.css
static.criteo.net/design/googlefont/montserrat/ Frame 7AE7 2 KB
803 B 26ms
25ms Stylesheet
text/css 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/montserrat/montserrat-400.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a81d25118c6f7d835e9ca132b995b8aca46e3575ee4ab2136ab96ac8d5e4688b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:06:54 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391ef7e-675"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 montserrat-700.css
static.criteo.net/design/googlefont/montserrat/ Frame 7AE7 2 KB
803 B 25ms
23ms Stylesheet
text/css 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/montserrat/montserrat-700.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

77a44f65bb6894c92e3c7ccab98de0fc357172221cc1dd45949ab938c0c7756a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:06:55 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391ef7f-675"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 7AE7 12 KB
6 KB 45ms
8ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 7AE7 0
127 B 29ms
6ms Ping
text/plain 2a02:2638:3::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=mgF8q-aONaVjGZKtivkBARZYdtgidauxAPPXrvT0jM2po49vp_9mWaMlarIOpO8NPUxH7MQWaCCS_lEmoyIp2eklJ2Bb9m8IwFFqB-cDNZqKjsrjOXMigC0d4qKYwjpS1J2q6t4RBxcAUmAOWGxkW7Op1ksUaqEhizZcZ5Q2ZoKXSNVcGJZKp88vf8XGhHmmInup9AbC_A7UgHcMHCf4COuZ-jdx32iBv6xq1q5gGgthPjqzObkuzfpe-__mChxR0jZsjA&sds=2&rev=84699&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 7AE7 2 KB
1 KB 50ms
27ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 7AE7 2 KB
1 KB 52ms
29ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 montserrat-400.css
static.criteo.net/design/googlefont/montserrat/ Frame E0E5 2 KB
803 B 44ms
30ms Stylesheet
text/css 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/montserrat/montserrat-400.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a81d25118c6f7d835e9ca132b995b8aca46e3575ee4ab2136ab96ac8d5e4688b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:06:54 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391ef7e-675"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 montserrat-700.css
static.criteo.net/design/googlefont/montserrat/ Frame E0E5 2 KB
803 B 42ms
29ms Stylesheet
text/css 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/montserrat/montserrat-700.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

77a44f65bb6894c92e3c7ccab98de0fc357172221cc1dd45949ab938c0c7756a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:06:55 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391ef7f-675"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame E0E5 12 KB
6 KB 34ms
25ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E0E5 6 KB
7 KB 25ms
20ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F17%2F17065126KC_14_F.JPG&v=3&w=400&s=76ToJfZL9DQmJ8PTR3ji80HG&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

807c14c68eaa25cb70ad95aa6b1d8fed9314aaad76e179950e9b2975d1aba10b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 6590
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E0E5 3 KB
3 KB 21ms
17ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F17%2F17321428NM_14_F.JPG&v=3&w=400&s=pHsZY2jqASgWAvs0Zs4kaYvP&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

dc4fb614d588c4b753a2fb59956c6d17071150d46a7c544901160b6b1d97b7ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3066
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E0E5 13 KB
13 KB 25ms
22ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F12%2F12988665JM_14_F.JPG&v=3&w=400&s=AZiFNlGbbdI3HsX0ZVI_J6Ei&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

9a1e7ebe8c7ff87a27891ed2251c2d5c6a5cd4ea40eae24298414f9a0cb73b1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 13356
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E0E5 4 KB
4 KB 19ms
16ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F34%2F34995539HA_14_F.JPG&v=3&w=400&s=i9CQsiYD_xzEHFEimNBh0-4I&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

362f7aab0ebdefbc02de2717644a6d7db6c03ba665be2902a0d3263f86030feb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3702
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E0E5 12 KB
12 KB 21ms
18ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F16%2F16197967IA_14_F.JPG&v=3&w=400&s=iGuyVtuj6VgrTgNfRNYCtWPr&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

43b620f6bc2a630299af929add4f9986dc92b49a0fcc8e107b4d49d252c4d5bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:10 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 12512
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E0E5 11 KB
11 KB 27ms
20ms Image
image/png 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=244&m=0&partner=915&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F771%2F160923%2F58605b2e514c432f98cd3a75f9acc6b6_logo_n_horizontal.png&v=3&w=196&s=E_PeiBCrklk9Kp8Pk-yu-xqo

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

a690dfaf60d7dac70959d80eb53b4b2234adb0479977f6802b1085d972611e66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=28513349
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 11279
expires: Sun, 21 Jan 2024 01:53:41 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E0E5 4 KB
4 KB 29ms
22ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F14%2F14187188VU_14_F.JPG&v=3&w=400&s=NAqbmMHNf6hh6Kpg8CX5ZK6-&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

58c24aaa61397a04e25ec11ca0db047981df16612d5845b34cc01f2913cbd7c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 4196
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E0E5 9 KB
9 KB 31ms
25ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F58%2F58063931SD_14_F.JPG&v=3&w=400&s=m68S5ZYGnvJ-ifq2DQGWzGf0&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

c98a3293ec7129af33d170756e663cc788a8b01b48602fdfddfe5da6ad95abba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:10 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 9314
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E0E5 5 KB
5 KB 40ms
34ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F17%2F17116494UA_14_F.JPG&v=3&w=400&s=HVJxuk1r0QSUSYbJakE2Rjad&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

169251db7492bd3d0a878bdd43d8d3f39b82274bde47028e91fdeec5815327b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 5320
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E0E5 8 KB
8 KB 29ms
23ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F11%2F11855268HB_14_F.JPG&v=3&w=400&s=U6Q8kOkHkX5_PrbS7AVIs-Uh&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

6283eca6fa55c191553dbe85dd1812a5efddac295f83fd10df4442a44152f37f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 7788
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E0E5 14 KB
14 KB 53ms
48ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F63%2F63007648EA_14_F.JPG&v=3&w=400&s=5Pvt38ngrLW9NuH_dV4oXwZW&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e905333e2a320de050858eed9f94811a80ba10e875cd6384885381fde431d8d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 14442
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E0E5 22 KB
22 KB 54ms
49ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F63%2F63007221NQ_14_F.JPG&v=3&w=400&s=xJpWkQ82zEnQ3F5F_12dp65a&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

163b7ad810f1a2709ed0deebd93334e22bc0b691a7ab2288d549c74eb211aab7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 22694
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E0E5 2 KB
2 KB 70ms
65ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F58%2F58065778PV_14_F.JPG&v=3&w=400&s=h9uMSXTpGmphL575glMBaGzo&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

7efc3164522303c1b6e2639245adf365ca1887d536ef9592bc7f02fc61af7b03

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 1618
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E0E5 3 KB
3 KB 52ms
47ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F17%2F17279917II_14_F.JPG&v=3&w=400&s=XGNLRXQN8dx8VX--ZDY8AmcQ&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

0f5f0b87b45dcc6048433eb3a1f6aba7a54164ef1c7744752358164f96d175b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3080
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E0E5 4 KB
4 KB 50ms
46ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F12%2F12876231NH_14_F.JPG&v=3&w=400&s=JwoHvIqGlbRDUUwKUkp-Q7Hc&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

21ca4ab56be9cdc3b77aab85c0dac936e29f0549e12ddbf14e0c44f795bac9d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3930
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame E0E5 6 KB
7 KB 49ms
45ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F63%2F63001817TH_14_F.JPG&v=3&w=400&s=_wLCE4IMMXYLb-S8s3bk-lW1&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

f045030fcef9a9220be7e1d63d2f1bdcae02d0178f0250557d342cd5f58dfd62

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 6640
expires: Tue, 20 Feb 2024 01:31:11 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame E0E5 0
127 B 18ms
0ms Ping
text/plain 2a02:2638:3::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=xgOWqOaONaVjGZKthh1KBnCrE-WaP6F7JHWtrFny6x2XRAL94dKi0GQk1xnmLnBohkUYGY1Z0HE4TD0NhYAb5OCSwW9NC740IQgJxlfItPPMaZLanslHdNdMwP_JxQaPMEZ3E_eJCFbPzEYQ40UEbMlKRwbK4ZT_kI3Ffr9KRuGhM_b5rlsK4JI4aX50rwsiCn72GJD7rLQCZP8zF1Z7CuXVqj6zms7-kEcY1X_Qs9FtBSMlSb3m4E__otgGdTP3VQw87g&sds=2&rev=84699&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame E0E5 2 KB
1 KB 51ms
17ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame E0E5 2 KB
1 KB 51ms
18ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 montserrat-400-latin.woff2
static.criteo.net/design/googlefont/montserrat/ Frame E0E5 12 KB
13 KB 33ms
21ms Font
application/octet-stream 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/montserrat/montserrat-400-latin.woff2

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/design/googlefont/montserrat/montserrat-400.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

5f9376c77618bf0ef43bcabf8228c9e2befde3731087b944e140a88c34066873

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://static.criteo.net/design/googlefont/montserrat/montserrat-400.css
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:06:54 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391ef7e-31a4"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
H2 200 montserrat-700-latin.woff2
static.criteo.net/design/googlefont/montserrat/ Frame E0E5 13 KB
13 KB 28ms
16ms Font
application/octet-stream 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/montserrat/montserrat-700-latin.woff2

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/design/googlefont/montserrat/montserrat-700.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

28f403366c2c520bfff7d5a0883f1d53e1e87ba1c8202f3f29e6395a0b66806d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://static.criteo.net/design/googlefont/montserrat/montserrat-700.css
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:06:55 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391ef7f-3230"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:11 GMT

GET
DATA 200
OK truncated
/ Frame 3343 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cc139bb571ba15adcd2e6f37859679ce715e5de67720f0724595e5b8a6dfe9b5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 3343 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 640b6b434c3af20cd693d80b98bc05f8ffea87d29860184c41f6b3489c7cb658

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 3343 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cbcb6e5cfa3dcc69a1da402246274b367d57d7f1407ae92db22096948bbc9ce1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v34/ Frame 3343 44 KB
44 KB 132ms
45ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Serif|Open+Sans:400,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.richrainbows.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 23 Feb 2023 05:05:33 GMT
x-content-type-options: nosniff
age: 159939
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44856
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:20:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 23 Feb 2024 05:05:33 GMT

GET
H2 200 EJRVQgYoZZY2vCFuvAFWzr8.woff2
fonts.gstatic.com/s/ptserif/v17/ Frame 3343 32 KB
32 KB 182ms
96ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ptserif/v17/EJRVQgYoZZY2vCFuvAFWzr8.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Serif|Open+Sans:400,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d355afb9705c3f8651f6a1f813b4670b758d59a17783830f534e7a8839c5b666

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.richrainbows.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 23 Feb 2023 08:48:43 GMT
x-content-type-options: nosniff
age: 146549
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32900
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 15:44:11 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 23 Feb 2024 08:48:43 GMT

GET
DATA 200
OK truncated
/ Frame 300B 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4a7d580a6d6829920bca02aafe3ad58b6067de6a71cb6875bcc2b567bc1efe88

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 montserrat-400-latin.woff2
static.criteo.net/design/googlefont/montserrat/ Frame 7AE7 12 KB
13 KB 18ms
18ms Font
application/octet-stream 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/montserrat/montserrat-400-latin.woff2

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/design/googlefont/montserrat/montserrat-400.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

5f9376c77618bf0ef43bcabf8228c9e2befde3731087b944e140a88c34066873

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://static.criteo.net/design/googlefont/montserrat/montserrat-400.css
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:12 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:06:54 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391ef7e-31a4"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:12 GMT

GET
H2 200 montserrat-700-latin.woff2
static.criteo.net/design/googlefont/montserrat/ Frame 7AE7 13 KB
13 KB 15ms
15ms Font
application/octet-stream 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/montserrat/montserrat-700-latin.woff2

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/design/googlefont/montserrat/montserrat-700.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

28f403366c2c520bfff7d5a0883f1d53e1e87ba1c8202f3f29e6395a0b66806d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://static.criteo.net/design/googlefont/montserrat/montserrat-700.css
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:12 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:06:55 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391ef7f-3230"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 20 Feb 2024 01:31:12 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 7AE7 10 KB
11 KB 26ms
23ms Image
image/png 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=100&m=0&partner=915&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F771%2F160923%2F1c82ce7c2f3646fda040f07d7413b835_logo_n_horizontal.png&v=3&w=356&s=Rh8PlAwDNSm7fHhTHAD82B-k

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

38f18ef9933994ac96ca375d7ca227d371e25778bb1d54cd5f7134d4e7d66ffd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=28513964
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 10588
expires: Sun, 21 Jan 2024 02:03:56 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 7AE7 6 KB
7 KB 32ms
29ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F17%2F17065126KC_14_F.JPG&v=3&w=800&s=Ryt3Wja6Dd0NWcvFlK3Nv8xu&b=400

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

807c14c68eaa25cb70ad95aa6b1d8fed9314aaad76e179950e9b2975d1aba10b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 6590
expires: Tue, 20 Feb 2024 01:31:12 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 7AE7 5 KB
5 KB 34ms
31ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F17%2F17116494UA_14_F.JPG&v=3&w=800&s=WFONaBz2Jd5rByNBag1Viar2&b=400

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

169251db7492bd3d0a878bdd43d8d3f39b82274bde47028e91fdeec5815327b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 5320
expires: Tue, 20 Feb 2024 01:31:12 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 7AE7 13 KB
13 KB 37ms
35ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F12%2F12988665JM_14_F.JPG&v=3&w=800&s=QDMIJBtaPnO_swRRcAcLtJuN&b=400

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

9a1e7ebe8c7ff87a27891ed2251c2d5c6a5cd4ea40eae24298414f9a0cb73b1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:12 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 13356
expires: Tue, 20 Feb 2024 01:31:12 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 7AE7 8 KB
8 KB 41ms
39ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F11%2F11855268HB_14_F.JPG&v=3&w=800&s=gKPQkrVKjN6FNmGAgEKpR2FP&b=400

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

6283eca6fa55c191553dbe85dd1812a5efddac295f83fd10df4442a44152f37f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 7788
expires: Tue, 20 Feb 2024 01:31:12 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 7AE7 9 KB
9 KB 34ms
32ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F58%2F58063931SD_14_F.JPG&v=3&w=800&s=iPQ8Q4LOdycyKImgftGr0So9&b=400

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

c98a3293ec7129af33d170756e663cc788a8b01b48602fdfddfe5da6ad95abba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 9314
expires: Tue, 20 Feb 2024 01:31:12 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 7AE7 6 KB
7 KB 32ms
30ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F63%2F63001817TH_14_F.JPG&v=3&w=800&s=9bMYvWgIncrDU7PrOI-8ZLyT&b=400

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

f045030fcef9a9220be7e1d63d2f1bdcae02d0178f0250557d342cd5f58dfd62

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 6640
expires: Tue, 20 Feb 2024 01:31:12 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 7AE7 12 KB
12 KB 39ms
37ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F16%2F16197967IA_14_F.JPG&v=3&w=800&s=2QB-8ZqdYjYwRrR0wCyGngc5&b=400

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

43b620f6bc2a630299af929add4f9986dc92b49a0fcc8e107b4d49d252c4d5bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 12512
expires: Tue, 20 Feb 2024 01:31:12 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 7AE7 3 KB
3 KB 37ms
36ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F17%2F17321428NM_14_F.JPG&v=3&w=800&s=zbbxBpjWEFibgEWwKtvPJ3Tq&b=400

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

dc4fb614d588c4b753a2fb59956c6d17071150d46a7c544901160b6b1d97b7ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3066
expires: Tue, 20 Feb 2024 01:31:12 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 7AE7 3 KB
3 KB 34ms
33ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F17%2F17279917II_14_F.JPG&v=3&w=800&s=sAeY_rrlhnY4XkuIiXPdzo_i&b=400

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

0f5f0b87b45dcc6048433eb3a1f6aba7a54164ef1c7744752358164f96d175b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3080
expires: Tue, 20 Feb 2024 01:31:12 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 300B 0
18 B 104ms
103ms Image
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C8EZ63mT5Y5mGOI_S3gPj-bq4CMme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItOTUzODcyNzkzODAyMjIzM8gBCakCy-A5wTq0sT6oAwGqBPQBT9BGuKPtz6EEkZL7vIrHUXYUOLpEUar52E-iKqsoaXXmr283_SJiOHGeZIOnoxGCOpRB02xBChfYfx_9BRDjdPlK53H0CGYoNQZgN8sWvYJJap_4TKAAlWfk9rWHV6ROQem-7uI1V8IFw2l4u4TNWYANFRXnqGrMWePUbj7ntMYoDy5_R0xC7Gbwbgh0w43_odv7SCfdMHGXq8RPIoujCyvoPROCiFY4T5XRNKrg1wd9Pk_nMvaS1IAKxbdsR9TBiz4XmHXdnYYGFoyzvla6Zuy-pbupkqChS2otgEJbW97Y-lWbToXqAlTOe-XG6fc8TAEYYIAGq5-pzdqi4vUnoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQIAKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi05NTM4NzI3OTM4MDIyMjMzGAA&sigh=G1T-Kto1N6A&uach_m=[UACH]&cid=CAQSGwDUE5ymu73KDB15uwblkxiDq3zKERZ805Jh6xgB&vis=1

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20230222/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 25 Feb 2023 01:31:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.nl3.eu.criteo.com/google/auction/ Frame 300B 0
125 B 30ms
30ms Image
text/plain 2a02:2638:3::9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rtb.nl3.eu.criteo.com/google/auction/notify?profile=14&payload=kMWCFMC-MLQB9AOdg2ICAgAAAHPXuPirx2JZEN5k-WNBRkK0pONuJAyOAAASAAAKDkFRVUJBUVlCQVFFUEFR&wp=Y_lk3gAOAxkKd6kPAA684xOjH2SLdYdf1X7piA

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
server-processing-duration-in-ticks: 176571
content-length: 0

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 7AE7 10 KB
11 KB 39ms
29ms Image
image/png 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

38f18ef9933994ac96ca375d7ca227d371e25778bb1d54cd5f7134d4e7d66ffd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=28513964
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 10588
expires: Sun, 21 Jan 2024 02:03:56 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 7AE7 6 KB
7 KB 40ms
31ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F17%2F17065126KC_14_F.JPG&v=3&w=800&s=Ryt3Wja6Dd0NWcvFlK3Nv8xu&b=400

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

807c14c68eaa25cb70ad95aa6b1d8fed9314aaad76e179950e9b2975d1aba10b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 6590
expires: Tue, 20 Feb 2024 01:31:12 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 7AE7 6 KB
7 KB 36ms
28ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F63%2F63001817TH_14_F.JPG&v=3&w=800&s=9bMYvWgIncrDU7PrOI-8ZLyT&b=400

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

f045030fcef9a9220be7e1d63d2f1bdcae02d0178f0250557d342cd5f58dfd62

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 6640
expires: Tue, 20 Feb 2024 01:31:12 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 7AE7 5 KB
5 KB 38ms
29ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F17%2F17116494UA_14_F.JPG&v=3&w=800&s=WFONaBz2Jd5rByNBag1Viar2&b=400

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

169251db7492bd3d0a878bdd43d8d3f39b82274bde47028e91fdeec5815327b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 5320
expires: Tue, 20 Feb 2024 01:31:12 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 7AE7 9 KB
9 KB 31ms
23ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F58%2F58063931SD_14_F.JPG&v=3&w=800&s=iPQ8Q4LOdycyKImgftGr0So9&b=400

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

c98a3293ec7129af33d170756e663cc788a8b01b48602fdfddfe5da6ad95abba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 9314
expires: Tue, 20 Feb 2024 01:31:12 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 7AE7 3 KB
3 KB 39ms
31ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F17%2F17279917II_14_F.JPG&v=3&w=800&s=sAeY_rrlhnY4XkuIiXPdzo_i&b=400

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

0f5f0b87b45dcc6048433eb3a1f6aba7a54164ef1c7744752358164f96d175b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3080
expires: Tue, 20 Feb 2024 01:31:12 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 7AE7 13 KB
13 KB 41ms
34ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F12%2F12988665JM_14_F.JPG&v=3&w=800&s=QDMIJBtaPnO_swRRcAcLtJuN&b=400

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

9a1e7ebe8c7ff87a27891ed2251c2d5c6a5cd4ea40eae24298414f9a0cb73b1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 13356
expires: Tue, 20 Feb 2024 01:31:12 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 7AE7 3 KB
3 KB 42ms
36ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F17%2F17321428NM_14_F.JPG&v=3&w=800&s=zbbxBpjWEFibgEWwKtvPJ3Tq&b=400

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

dc4fb614d588c4b753a2fb59956c6d17071150d46a7c544901160b6b1d97b7ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3066
expires: Tue, 20 Feb 2024 01:31:12 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 7AE7 12 KB
12 KB 40ms
35ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F16%2F16197967IA_14_F.JPG&v=3&w=800&s=2QB-8ZqdYjYwRrR0wCyGngc5&b=400

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

43b620f6bc2a630299af929add4f9986dc92b49a0fcc8e107b4d49d252c4d5bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 12512
expires: Tue, 20 Feb 2024 01:31:12 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 7AE7 8 KB
8 KB 41ms
37ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=915&q=80&r=0&u=https%3A%2F%2Fcdn.yoox.biz%2F11%2F11855268HB_14_F.JPG&v=3&w=800&s=gKPQkrVKjN6FNmGAgEKpR2FP&b=400

Requested by

Host: www.richrainbows.com
URL: https://www.richrainbows.com/aec/qbot.zip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

6283eca6fa55c191553dbe85dd1812a5efddac295f83fd10df4442a44152f37f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:12 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 7788
expires: Tue, 20 Feb 2024 01:31:12 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 15 KB
11 KB 51ms
49ms XHR
application/json 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230222&st=env

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

644b1c184716347e3c6696861c16c7d18e558c465f8e9460caf38424a15b5b4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:12 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11334
x-xss-protection: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 1BD8 42 B
64 B 70ms
69ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuKcIArlR783k81RlxxRiJINtgW5CzHc7vgdg4iTLAQh8Ap9MSul1lnDvnMHxMaVPk_jZC9qIyuaR5TjjDpuX-zBuDN&sig=Cg0ArKJSzEjasajREQUbEAE&id=lidar2&mcvt=1036&p=0,0,280,1200&mtos=1036,1036,1036,1036,1036&tos=1036,0,0,0,0&v=20230222&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=328962951&rs=2&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1677288670912&rpt=414&met=ie&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 25 Feb 2023 01:31:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 45ms
43ms Script
text/javascript 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 25 Feb 2023 01:31:12 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 802A 42 B
64 B 72ms
72ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsty5Evx9LgcsXjosu-nHpWOzELBb2NGCWtz3RdDTJb-LZrstaFMrVlS4ixvnMOyz11xX0IX4_2bbDtr5U-1GRyJyUI&sig=Cg0ArKJSzP31ZoQu3nc6EAE&id=lidar2&mcvt=1031&p=0,0,280,345&mtos=1031,1031,1031,1031,1031&tos=1031,0,0,0,0&v=20230222&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3400383200&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1677288670929&rpt=439&met=ie&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 25 Feb 2023 01:31:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 4B53 0
127 B 16ms
15ms Ping
text/plain 2a02:2638:3::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Sat, 25 Feb 2023 01:31:12 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame CD14 13 KB
5 KB 42ms
36ms Document
text/html 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.richrainbows.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 6179
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 24 Feb 2023 23:48:13 GMT
expires: Sat, 24 Feb 2024 23:48:13 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame A4C9 783 B
967 B 52ms
48ms Document
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

880e85a1819ab15707bb335ec0e9ea8f4962d8efcec6b73a0ec3579c7e52c487

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-d0wH2EeMFX1okxR8spt6eg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.richrainbows.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-d0wH2EeMFX1okxR8spt6eg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 25 Feb 2023 01:31:12 GMT
expires: Sat, 25 Feb 2023 01:31:12 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

POST
H2 200 all
csm.eu.criteo.net/ Frame 2FFB 0
127 B 17ms
14ms Ping
text/plain 2a02:2638:3::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Sat, 25 Feb 2023 01:31:12 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame A4C9 0
0 72ms
71ms Image
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230222&jk=856095500874408&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

GET
H3 200 6N6xbrRFdMEff8Jis_shwjAW5G8di4zE4BhK3Aw40Jc.js Show response
pagead2.googlesyndication.com/bg/ Frame CD14 36 KB
14 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/6N6xbrRFdMEff8Jis_shwjAW5G8di4zE4BhK3Aw40Jc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e8deb16eb44574c11f7fc262b3fb21c23016e46f1d8b8cc4e0184adc0c38d097

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Fri, 24 Feb 2023 23:43:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6491
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14401
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 15:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 24 Feb 2024 23:43:01 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame D819 42 B
64 B 71ms
70ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu05-rydFhdHnFzS8WX2YPXgq8PGWTAwkjMSxwdCJDGF50HCZUFjYGwqW5u5UX9D-JiW8yY_1rB15zC3YQPaM2mhUU5&sig=Cg0ArKJSzOA4FvcJiT9_EAE&id=lidar2&mcvt=1016&p=0,0,124,1005&mtos=150,741,1016,1072,1072&tos=150,591,275,56,0&v=20230222&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1677288671205&rpt=357&met=ie&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 25 Feb 2023 01:31:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame CD14 0
10 B 35ms
35ms Image
text/plain 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?zFCShQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 01:31:12 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H2 200 all
csm.eu.criteo.net/ Frame E0E5 0
127 B 16ms
15ms Ping
text/plain 2a02:2638:3::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Sat, 25 Feb 2023 01:31:12 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

POST
H2 200 all
csm.eu.criteo.net/ Frame 7AE7 0
127 B 14ms
14ms Ping
text/plain 2a02:2638:3::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Sat, 25 Feb 2023 01:31:12 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 300B 42 B
64 B 69ms
69ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssPDjuydTy4PJgIQTheCUh1u5iC_ewmtcKSBgDWYWst2UsdJka4btNJfDOONrDQ1IOfaHlshQnTJmpHPgd-FJ5uqBc&sig=Cg0ArKJSzAFdx0GInu0yEAE&id=lidar2&mcvt=1002&p=0,0,500,180&mtos=1002,1002,1002,1002,1002&tos=1002,0,0,0,0&v=20230222&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271804&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1677288671201&rpt=393&met=ie&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 25 Feb 2023 01:31:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 74ms
73ms Image
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230222&jk=856095500874408&bg=!SEulSx_NAAZYlHKzeJQ7ADkAdvg8WuR_JS7N4yo7Q--K0pxgV4gxFg77QVRHbyfIckRTH619xUIJoEf-2E5Klk5lkoQG2gcfpgQCAAAAalIAAAAEaAEHmQK4h9aGIYPKrvgD3arKeFBsjDe_vgLW75KB22Mr-7rUrXn-HCUT8fxHmXZDrTiH67qPgvXmDZG7en438pzNjRrZTNdc280OHUWKgSYqYhuuDqomRxCRk1zJYYPGMOMmaeu_6HxZcWwgDha_IlzBR6jw5FyZ79WJNmq6M51_D8eV2SMDQPf165GIPleSbQR1fglVIGARSun9q8x4pUa2yYIk0s99P8wbxvszuqumrbMnxh4bMfLXRjVx3BVT_a-Xyx1YIznIGVbCjMMtLwj6jyGX9mebwgNgcHU1i9UgzAVCJcWIB_07fNwUtBI_ocDGYN2LYovOi6nRfvMlYX0ToVEr5o7lTTJ0KdMZa819UhQ-29WgYCARJ79KLptPZNPYsxHG6U_3DlHx5cyXQPhjBuXVjPy6z_KDKAbZqqOSyoi91V9_YVoRvTYzmmGdVQy6Ak6TCpDpbq4mMcLHPUhzH9g1ic24Cm7IRSnfNT_i0OXBxiSeXJgV_DJ2gQj-7wHCSCmR31bMMR1l2mmAvzRqU4yY3-M2NQ-8LmsDKeB1Xq9l6zmkhZ866cT-uhYB4Y-4WIFcqqGM6M5t1w-N2ISQpEW3K5t2YazdwpV54KRvuSwsQcVadzzwDLIidjqkYfrJnHKZdzE61mMwB6jIrk-JSepxH4boFl8t1L1PN4J_QZzQc4CfdgHrg8pU-bkZTHNSXuf5tENTk6xiGzCYVFY8OZ_1AD-sDCG0XdwpD1t05moMcj__w4-VMFPr2RtIt1-KePN5rKQn9-9iXRKBPBTeNWTHnAJWgs_aspm6iDmi82sUM4gbvej_Wj8w9Rhn6oQ6UgcAwoY1a6tj-7FZ_6Bg6aD6oHiOyv1pNEoRz80QpNuFurfaSEXJxnfhZmr9Ltv_nwLbHFNWH9QkZ2-Kp32dfkrH1BPK_A5Y7z6p
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.richrainbows.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Verdicts & Comments Add Verdict or Comment

171 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

9 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.richrainbows.com/	1970-01-20 18:40:24	Name: ezCMPCCS Value: false
.richrainbows.com/	1970-01-20 09:56:15	Name: _gid Value: GA1.2.1927876617.1677288671
.richrainbows.com/	1970-01-20 19:30:48	Name: _ga_QKYKECMFBX Value: GS1.1.1677288670.1.0.1677288670.60.0.0
.richrainbows.com/	1970-01-20 09:54:48	Name: _gat_gtag_UA_125458244_2 Value: 1
.richrainbows.com/	1970-01-20 19:30:48	Name: _ga Value: GA1.2.397696976.1677288671
.richrainbows.com/	1970-01-20 09:54:48	Name: _gat_gtag_UA_198259637_1 Value: 1
.richrainbows.com/	1970-01-20 19:16:24	Name: __gads Value: ID=62b24936616dde16-22bf59cd82de00a6:T=1677288670:RT=1677288670:S=ALNI_MaXcT6LgbKUloRZCdCBUg2xsro-cA
.richrainbows.com/	1970-01-20 19:16:24	Name: __gpi Value: UID=000009bca656dda9:T=1677288670:RT=1677288670:S=ALNI_MZzeoFs-7xAV1CkmCXEyZoudI3x4Q
.doubleclick.net/	1970-01-20 19:16:24	Name: IDE Value: AHWqTUlgqRkoyrpZ0ENPgx217myI5Zc7x37mD9LrzOLBSlRUefsiUCzvpF-81EiD8MQ

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.richrainbows.com/aec/qbot.zip Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://thinkseducation.com/7e6bd9794e25c7e6341b1085743d03cc/invoke.js Message: Failed to load resource: the server responded with a status of 403 (Forbidden)
other	warning	URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9538727938022233&output=html&h=280&slotname=9292693240&adk=328962951&adf=3025194257&pi=t.ma~as.9292693240&w=1200&fwrn=4&fwrnh=100&lmt=1677288670&rafmt=1&format=1200x280&url=https%3A%2F%2Fwww.richrainbows.com%2Faec%2Fqbot.zip&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1677288670476&bpp=3&bdt=539&idt=429&shv=r20230222&mjsv=m202302150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3110296830212&frm=20&pv=1&ga_vid=397696976.1677288671&ga_sid=1677288671&ga_hid=1401903725&ga_fc=1&ga_cid=1927876617.1677288671&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=0&ady=0&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44777876%2C44759837%2C31071756%2C31072480&oid=2&pvsid=856095500874408&tmod=908495160&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpEe%7Cp&abl=XS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=kXpTPLZDaI&p=https%3A//www.richrainbows.com&dtd=435 Message: Origin trial controlled feature not enabled: 'attribution-reporting'.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.mailmunch.co
ads.eu.criteo.com
adservice.google.com
adservice.google.de
ajax.googleapis.com
cat.fr.eu.criteo.com
cdn.onesignal.com
csm.eu.criteo.net
fonts.googleapis.com
fonts.gstatic.com
forms.mailmunch.co
googleads.g.doubleclick.net
onesignal.com
pagead2.googlesyndication.com
partner.googleadservices.com
pix.eu.criteo.net
region1.analytics.google.com
richrainbows.com
rtb.fr.eu.criteo.com
rtb.nl3.eu.criteo.com
static.criteo.net
stats.g.doubleclick.net
thinkseducation.com
tpc.googlesyndication.com
translate.google.com
translate.googleapis.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.richrainbows.com
178.250.0.160
18.202.254.38
18.205.36.100
192.243.61.225
2001:4860:4802:34::36
2600:9000:206f:ba00:4:c961:9640:93a1
2606:4700::6812:d73b
2a00:1450:4001:801::2002
2a00:1450:4001:803::2001
2a00:1450:4001:806::200a
2a00:1450:4001:80e::2003
2a00:1450:4001:813::200e
2a00:1450:4001:828::2002
2a00:1450:4001:829::2002
2a00:1450:4001:829::200e
2a00:1450:4001:82b::200a
2a00:1450:4001:82f::2004
2a00:1450:4001:830::2003
2a00:1450:4001:830::200a
2a00:1450:400c:c0c::9a
2a00:1450:400d:804::2008
2a00:1450:400d:80a::2002
2a00:1450:400d:80a::2003
2a00:1450:400d:80c::2002
2a02:2638:3::1a
2a02:2638:3::9
2a02:2638::2
2a02:2638::3
2a02:2638::b
2a02:2638::c
026cb623b7667cfaa93c24838517dd297c0f632e520b8b6654b8d5e3f6b223b9
094111b52c1a0561f5b2a21a31b25a9bb7c81aeed022e8df8e15582371c2021b
095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6
0ab2acefa0e8ef009542dd58eab41f4cecf5f53ab724fffb4c29003f56485825
0f5f0b87b45dcc6048433eb3a1f6aba7a54164ef1c7744752358164f96d175b3
10908b6e6cfaeb149b47a6dc31aaa65aca0cf22158c74096c384bbc47285914a
12ff42a6dd94226b7476a424b64ae6377a3424c0915f858d128447580f8cfff9
159043fcb16dd5c9a4b6a80581f7a91dc5987665ea5f7851da6c29fba0615a64
163b7ad810f1a2709ed0deebd93334e22bc0b691a7ab2288d549c74eb211aab7
169251db7492bd3d0a878bdd43d8d3f39b82274bde47028e91fdeec5815327b0
19c1d40989d7ad633008264053bdf30b7626562d3f44d153420eb71cee2f8c7d
1c30a46fd8cce117a8be0a8c71962d86756db1e46455a0e92a43f0c59b8e4e35
1c468f25c66a9aeaa637ca5244f64ec7f967734b2dc2aa92b667cf5316155e81
21ca4ab56be9cdc3b77aab85c0dac936e29f0549e12ddbf14e0c44f795bac9d9
278b79f7fc149eb8ce484a5eeb7db0d160a8a34ab1437ce68bfa149b12d202f6
28f403366c2c520bfff7d5a0883f1d53e1e87ba1c8202f3f29e6395a0b66806d
2a5cbfc989d3e75d8c5b321ecb75f20874d5fb343f8630fff6a4d2665e2c87ee
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
306a340d77c015bebd34348e2df7636595f40e1fc50273d1a4cba9321d5e82ce
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
31b70d0799fc133e6eb224843e4e1eb4faa8016b7e519fba31bfdc3affa7b015
32b1523c71aa131b100e09ca28353ee1ca699d6900ec4dce56d01215236473c1
34a6d3e62530a99fc99942085b6232db56e3b370c3983006ba11d4693a4400df
34fe228fb7c3c822de1901da489d062bf4ce0ce41fe7a12743266af69d833583
362f7aab0ebdefbc02de2717644a6d7db6c03ba665be2902a0d3263f86030feb
38f18ef9933994ac96ca375d7ca227d371e25778bb1d54cd5f7134d4e7d66ffd
3986673333826891a3b1d289891efd0689a800f8dbd7a897e016ed1f80e429ea
3bd0d049ce762ae23530f52366dab8262419a7be7e5a27ec56814128f9b74dbf
3c3af293c92bffe2f5f6f31753be6de274bf677ee5c4de05428cf394d63d4941
3fadf99638094a841349a5bc82be83289b9b7c795838626f5ab8462763bad224
437e6e23bb4219f1dd245da75b1729666e71fbf31985189fa35be75702b8cab9
438c16691430de4cd7b08b94b712827b4560637ca3991ea489eeae9e2ba84405
43b620f6bc2a630299af929add4f9986dc92b49a0fcc8e107b4d49d252c4d5bb
457ab542be1badc8c3c0992615605534f3a65dce73d2e609a6a433dc02dac346
45ec54f6edf49e36dc01d93b61e9b3209c78e6efa525f5c31cbd654013963ad9
4a7d580a6d6829920bca02aafe3ad58b6067de6a71cb6875bcc2b567bc1efe88
4c14187655c7504659fd46a0a4b7a43a7711948bbbcaf22f2ad9cbb1cef97a49
4c62c820213f1ab28757a744fd3d15b65fc1ac9e148c8db2c50eb8a20959f930
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
5009e0df8da87941f3955827640393d1a50264d37c9963f8baa5f39cec90826c
521457922129a04fbc4524021ac47021659a1e1931c5dfe1a0e13be5dcaaefba
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
563e58b530a3499ea174d7d90b6ca3de9d8445f46565e516e266c882c74f1f98
58c24aaa61397a04e25ec11ca0db047981df16612d5845b34cc01f2913cbd7c9
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5
5a861509b658aa24fc3aed2867ac3c061e7d818d90b9990959afc6d1b5d4ff99
5be824d9bcb5759cd56f553489f8271f962892a10f571aafafc416168d325b65
5d426bc5ba4a82301389644e89f4727089e15fcb5eaa109bd3d0f38eb9ad39ac
5e713a207017a40f54387d0e25bbb3cbbe1b3d10338cdd4a7342cc1486b19140
5f9376c77618bf0ef43bcabf8228c9e2befde3731087b944e140a88c34066873
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
6283eca6fa55c191553dbe85dd1812a5efddac295f83fd10df4442a44152f37f
6318394f737c66f0e2ccfcd88e3935c6667633a1b95fa29fba2b75431d55eef2
640b6b434c3af20cd693d80b98bc05f8ffea87d29860184c41f6b3489c7cb658
644b1c184716347e3c6696861c16c7d18e558c465f8e9460caf38424a15b5b4f
67ebf650147a9122e94ff1b25a78a82e903b92b877821c1479de69f00f59d429
6932bed79e5ac3de1f11992e5ba2181c64f6fae79984f71f958f705934253693
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6eb558464403c82bde31f373ddfcba8d5ead0ea875003e285b3ac0ae99159e1b
725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a
741990218bbe2810881d4f189f11d4d1e7f3c07aa16dbd8211037576ef3dc220
77a44f65bb6894c92e3c7ccab98de0fc357172221cc1dd45949ab938c0c7756a
77fdcadd2a7c156aeb1ce5c9d5d925015661ad85c44eda4b0d7cc5ed07171724
7b8774ee42aac08bc5a2e690896b80dc20953e86dc152dc5b344b589df74273e
7efc3164522303c1b6e2639245adf365ca1887d536ef9592bc7f02fc61af7b03
807c14c68eaa25cb70ad95aa6b1d8fed9314aaad76e179950e9b2975d1aba10b
81a7d8a047857c04f34dee91793ff2474128f76e8339511607f80a27179fc65b
82d63ecef7851ffd217020b3817b0206328488879b0c782f9b67d43bd1479a2a
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
880e85a1819ab15707bb335ec0e9ea8f4962d8efcec6b73a0ec3579c7e52c487
88456d116b77dface92f5947c252d572b805d57d8f6dbbb113111ae33da3395f
8ca545d8d7e0531dde6c66e3e6546db5a52f2812dc402665961da64056d98eea
8e95bc4eaefb870c080c072f2d84c53569261166e8ae45d01004ce4941877686
8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395
914ba9fc129376a958d08ed29de9313cbb843e0e6ed20a6fa681b6f7f6adee3a
92353b9acf750ffc441bee747493041ab0d3868835896f08adc40a23456ffd6b
92f0834adff37a796b424547b59afc6e1dd6aae0c3721a57fa1d93b1a50ae77c
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
9a1e7ebe8c7ff87a27891ed2251c2d5c6a5cd4ea40eae24298414f9a0cb73b1c
9d8d3bf6f41af46fb0867a68d3c40ed22af46635c354a80fd257d9e9dbf95f28
9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc
a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553
a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6
a49495023d3298265b38fc8315f3f0303c1705e638499a85fba34e7745059481
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a690dfaf60d7dac70959d80eb53b4b2234adb0479977f6802b1085d972611e66
a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37
a81d25118c6f7d835e9ca132b995b8aca46e3575ee4ab2136ab96ac8d5e4688b
a98c5d9f8e22bff778c8469a1e8f632d5a5b744b9db69b39eca34d73541273a4
a9b3a52a7911e1c2db90c1bdd506de0305c859694b6228301a34e364bbccc157
a9d3ae8ca199ab0a5a9fb9f8bbb331e73f845c235db36fff0047cabd00795ae6
abc9faa4970e07db7d506d6b2a98e4c86223be305c7541ced54ea2e15f99a76e
aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947
b10da3db8bd92838051a2f554d6d8dab5603d0367606f74610f901b0f18da4ee
b3565ea346e63fda91cc67ba8fc11e95b7482d5873a4f4c6a47c4185b772d9a1
b45627ac6d0181263d04b8b8d7aaaffa8a71b4798f669021ba1a5ca89dbc9344
b846ef170dfb8305947448dbeeec8b1054f73573346678f1a4f9f72f981a4c3d
be772df30b158452751d2fcd53efb89b37e4e9dc366a1f525f80ab04c8823f10
c0dae86594e57885884c245830efcb113fed12d95e46e852bbbc729ac51655e5
c1242fa94be3c8b4f77e19e0098a00ce4714e76b48fcf9fb6c6fb95e978bc5df
c1f6b66e052e0dba3f115f59a94d7304a27a73848db4b8995e2a2017ba79046b
c324ef26b20264369e4568dc9ef1c5cb1f325f6bc4e8b7c01f7fe93fa353276a
c98a3293ec7129af33d170756e663cc788a8b01b48602fdfddfe5da6ad95abba
c9ee04f647e513caaa126c517a7641937d68665031f609b293de7cbf9eb3d4c3
caab0986316add32c22877ef8958c4af71919089270e72794a1bf46370d1dcc0
cbcb6e5cfa3dcc69a1da402246274b367d57d7f1407ae92db22096948bbc9ce1
cc139bb571ba15adcd2e6f37859679ce715e5de67720f0724595e5b8a6dfe9b5
cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981
d0d84af38d0a3a8db8a60ef11cf1752ebade98a04e8ad93cec0bd6896b25dc26
d355afb9705c3f8651f6a1f813b4670b758d59a17783830f534e7a8839c5b666
d64c12a76a61096f3a14aa795d12c3fc0de8e5781ef2e1af3b66517e65d7f00e
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
dc4fb614d588c4b753a2fb59956c6d17071150d46a7c544901160b6b1d97b7ab
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e2d3127da85763e024971c6192f78becbdf85db231b3d088c9f8b3777d444ede
e2e60e9eae839d6b2e857c708f6d02ae6069141594b941a1590cd5c5435d42f4
e2fb63ea3b3d832a17e88ce1bdc0ec080117e17f1c9331697c822015e501cb13
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e51140cdcd044ad76335646936ec53196a169aace83a8b266bc1c182a944609b
e5b554bc52501a9f695af89711a6e90f3246bcddcfa4cae5d3f86880285cc31e
e621665022bb960e60fcbed829f30a54d28484a7e2d8e46f7e5025a06608b5bf
e8deb16eb44574c11f7fc262b3fb21c23016e46f1d8b8cc4e0184adc0c38d097
e905333e2a320de050858eed9f94811a80ba10e875cd6384885381fde431d8d1
ed5b5df9ceacfe76857ac51964972b0b417a215b2f50e837fd6b64bad7339c40
ee154362c6475b7af759965c24b13331aa28db7eb96cc1aa3a63217eb3c48930
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef1ba7901f9deb04256074788d75a22a8e5ecc1bf6117227f5b2bbfabf58ca37
f045030fcef9a9220be7e1d63d2f1bdcae02d0178f0250557d342cd5f58dfd62
f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1
ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869

www.richrainbows.com Open in urlscan Pro 18.202.254.38 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

226 Requests

100 %HTTPS

87 %IPv6

16 Domains

33 Subdomains

32 IPs

5 Countries

2620 kBTransfer

6870 kBSize

9 Cookies

6 Outgoing links

Page URL History

Redirected requests

226 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.richrainbows.com Open in urlscan Pro
18.202.254.38 Public Scan

Screenshot
Live screenshot

Full Image

226
Requests

100 %
HTTPS

87 %
IPv6

16
Domains

33
Subdomains

32
IPs

5
Countries

2620 kB
Transfer

6870 kB
Size

9
Cookies

226 HTTP transactions
10 data transactions