www.farfeshplus.online Open in urlscan Pro
185.18.205.182 Public Scan

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 01 Jun 2023 15:48:36 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 185.213.155.146; 185.213.155.146; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: af26c02a-cb38-40e4-9d13-90c413bac71d
Server: nginx/1.23.2
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzE5NDI1MjUzNTc0MjM1MzM0Ng%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 1 KB
2 KB 8ms
8ms XHR
application/json 52.222.208.154
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fwww.farfeshplus.online&pubid=66ef05f7-ad53-48f6-873a-ac7543370392
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.208.154 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-208-154.fra56.r.cloudfront.net
Software: Server /
Resource Hash: 1bcf654e12405ab5e0683d20293052957fc8118ce5d89e1b393e8d41c018ff75

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:21:40 GMT
via: 1.1 3092bdd288d2a449c56d11f2cf4a9b88.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P3
age: 8813
x-cache: Hit from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.farfeshplus.online
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
content-length: 1527
x-amz-cf-id: kHRyIq0IxcJoYS8XhcgEkz9l-VFJn2vfx5q2GPNG5hDJXJl6MUgH4g==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
471 B 141ms
41ms XHR
text/javascript 52.222.253.136
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&pid=eqnn6HAAezLRU&cb=0&ws=1600x1200&v=23.517.1921&t=2000&slots=%5B%7B%22sd%22%3A%22farfeshplus.online_auto_728x90_sticky_display_bottom%22%2C%22s%22%3A%5B%22728x90%22%5D%7D%5D&pubid=66ef05f7-ad53-48f6-873a-ac7543370392&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.253.136 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:35 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 987865b81ba895db5b3f56f8ae175c84.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA60-P3
x-amz-rid: 0K0TDKEH5ASTVZVBPCWC
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.farfeshplus.online
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: Ei_Sq89Me9JTXrAuhLob-GcQvl1UkURINhMixDMMVZMKfkX1PSJCig==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
467 B 141ms
42ms XHR
text/javascript 52.222.253.136
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&pid=eqnn6HAAezLRU&cb=1&ws=1600x1200&v=23.517.1921&t=2000&slots=%5B%7B%22sd%22%3A%22farfeshplus.online_728x90_sticky_display_bottom_stiky-bottom%22%2C%22s%22%3A%5B%22728x90%22%5D%7D%5D&pubid=66ef05f7-ad53-48f6-873a-ac7543370392&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.253.136 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:35 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 987865b81ba895db5b3f56f8ae175c84.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA60-P3
x-amz-rid: S5YQ036PE0AE04HPAH06
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.farfeshplus.online
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: mgy9lKc4avsU118f5a1oOMEkjwMdMEyxSEY38t1fVw2_0tMl08_JTw==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
468 B 149ms
53ms XHR
text/javascript 52.222.253.136
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&pid=eqnn6HAAezLRU&cb=2&ws=1600x1200&v=23.517.1921&t=2000&slots=%5B%7B%22sd%22%3A%22farfeshplus.online_728x90_sticky_display_bottom_new-sticky-right%22%2C%22s%22%3A%5B%22160x600%22%5D%7D%5D&pubid=66ef05f7-ad53-48f6-873a-ac7543370392&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.253.136 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

5d7c7d25a0da74c0dd466120c3c09bd94cb982fc66ebc4a78675339f37323bf5

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:35 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 987865b81ba895db5b3f56f8ae175c84.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA60-P3
x-amz-rid: K7QN4E7BQK5Z2KRJC012
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.farfeshplus.online
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: gOt4AOy0GCGgr6WIhDvOIPludeYBcdHuyddrxCl-nbeV47sJ7d61Jw==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
469 B 135ms
41ms XHR
text/javascript 52.222.253.136
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&pid=eqnn6HAAezLRU&cb=3&ws=1600x1200&v=23.517.1921&t=2000&slots=%5B%7B%22sd%22%3A%22farfeshplus.online_fluid_lb_farfesh728x90%22%2C%22s%22%3A%5B%22728x90%22%5D%7D%5D&pubid=66ef05f7-ad53-48f6-873a-ac7543370392&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.253.136 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

edge-star-mini-shv-01-fra5.facebook.com

Software

Server /

Resource Hash

1c4777fe3a673a05492e27d08032cc91c23ac5389897c9235b09b8b0f5a74db3

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:35 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 987865b81ba895db5b3f56f8ae175c84.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA60-P3
x-amz-rid: 9RKNGQ8B4388VX5TMRNJ
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.farfeshplus.online
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: w09b30NFResqiJAhG3psGVHqTojCBvYN0WP6Qf3reXgCRpXD07C_4A==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 28ms
8ms XHR
application/javascript 52.222.208.154
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.208.154 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-208-154.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

x-amz-version-id: Zm_tZQQ808JKRizBfXGgSN2OWn8Z6JUU
content-encoding: gzip
via: 1.1 63f629236e2f93bf1af732a50e42e586.cloudfront.net (CloudFront)
date: Thu, 01 Jun 2023 01:39:34 GMT
x-amz-cf-pop: FRA56-P3
age: 50941
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Fri, 26 May 2023 01:35:48 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: 415p5zwHVbGDciUIKAOkLEBd-RhJ8Dh3OqPBGsBTs54-pKGaWCoPKg==

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D9E9 171 KB
53 KB 78ms
77ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b108d10517b218ebb22d63ad00b85baf89a7b4f1884c3fd01eb03f0790b1cd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54276
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1685532878231373"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 01 Jun 2023 15:48:35 GMT

GET
H2 200 status
www.facebook.com/x/oauth/ 0
0 751ms
38ms Fetch
text/plain 157.240.251.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/x/oauth/status?client_id=382287608570983&input_token&origin=1&redirect_uri=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&sdk=joey&wants_cookie_data=false

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=cbbae6a4461ffcc865adb85f2c734187

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
date: Thu, 01 Jun 2023 15:48:35 GMT
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: s1+B2oeU++MKRF5p+zXD07RISGXOyuVmYuLEehDjoe8sG51jMKztZVOaPAFUS5Xf6wezLYt4JxytfFBywPyl+g==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
fb-s: unknown
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.farfeshplus.online
origin-agent-cluster: ?0
access-control-expose-headers: fb-s
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C902 0
20 B 72ms
69ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=1569644147340&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C902 0
20 B 72ms
69ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=1569644147340&version=m202301230201&ct=76&x=1&cor=3952829422269839400

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame C902 91 KB
36 KB 88ms
86ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CWL87SnAWBTlPsZchEPccufnBE07ziJv1NKjaAxR7t8AMxfthEtaFOSWuPpjQi986pLAw-8FlEJ9JphgSqRSa4tVpsDq2xA1rKpVQCMNexM9yOAGmAzBviGVxeZuaI4vnfxeFtQR9JsbVkDdjwftpvPlk7Or99Vz2MjoJ95tfJfRk9YrQ&dbm_d=AKAmf-AuJ7-ZjSI8YzQPwA2ZPgV7GKoqHVEJi0L29aoFEVWWUVuAXlOlV_32LM2Xofd7UmyaHX8RcyxkhVK5MOr6Q1iDIADc8iiOWYfAbUrrDyTyIZJEy92Tbx2cVQ7FWd_nfwYRcs1prz_qcsygVCmjEkGjarGDBfn90phKqp3eiJcl25oUAJLbR_awj74fKtGhBxrzcf2AvUA8juiSdA3nYd5AvUBgtq6YsJdEd20HYz5SRKVkBjXaI4M6vMQjsfFbFxkJtKjKa6chOx_0aZUC0y8IDtQ6xxaxmVub7J7EPcRmk2GlkIM58liRktN2dUkY3WYDrKaIkUOEDHjvV-iqhGDNnY8yFw0nC4naoMtNv_cBsmDR2HtFraUmW1crAHxJd0To-1FEtMvU-a6YYg7ZiFJOKtok_y5aW2X7mVXrBy1e9N9zN_GHZ-5sKhin4l1AftxSphmXlPrzzS9MRH6UP6K9VxHbViMi6TUqRRUnkDi4AlCmHI50NEAtJjAOWppmEAToeNIKrK5bnryr_FYYXhr8jqB8IfvSygbva1C7oBjv5jL_YZilOAFUFD7caCdTC1sIwpbhcjxr4-6pF62mEl8_FIm_w3JXth6aK_fIJXcFNBWNL9z6Hq-acUlUrTmMl3YexUHskuebM6no9QL8uGF-cuyitjbJr40B-CA0qJNuXzfE9OkW8YN4RnZA8LeRL5EEoy9ZbehrYCaHayVRMp43YC1sWAYAb-qR7v1dk5BZhqPIACNNm7buj0xdPO4lmQpyMo9ZNIw0NGVmhWpFtYbNbaxB1TqHqbI4rprmXAkgBfVm0D7izKNIB6tSxl76M6sXG7oyeuug8Grh7v9XSo69fpUiHCiG5IwgC2gz8StC4YajdlObFimYWx6S1SDEQCh2I9TgW2lmDbsJ71Q6A7Oowtj8T_-VBAMSg8NSClTxJI7Il-74l1tjwjV1YMavaGxwHm2dYe-0EZnXzpXqjNBjZ4t4LSMuRQl-FlDa4PEfaEBxAFyHO0QLSedb8jrsn6kxRx_wNYa1VJFcjQ2MofA7vOppYizgxbco3QVJql7eyjSbjv2sSuO2PK_yxSy7c6IBN_-LFvJioOpi44g_-j_Cu6pIv0thPsp0_JWKFHCSqSmokuALumJzvK5o22Vl4UnWbp77vGxJY6v_kor8p2AfaZyqklWupfZvPxlMXpmZ0vD160fS08T9dOXVDCb1a6jg1y5WKyamUAyH-VazotOk3H4ZELig86KlnncdOHf_72stGAbU1b0-LSuKrUbEKHEv2aY0P2CSfeI3Uj1BE2YSg2DrU5sC1Qr2kuDMKkP_4XWlM4fuSoH3O4XXQv_0P9JlP980pD1K8fEHwwj5CHIQbLtGiw4APVb3eANpA_prQaidXL_WDNvhHcqnP2dudh2RD-QKFJ1dOijotYACwL-y4HwUTcMh1tv6IRwQTFA--0FLM4355CmQiZFO3j1iEPp_YPHhb1kjuF_wo6xYjGn_XKZp7JnMwv0pJRK9inYEYuhxkj9-g1p75KgCSt-F652gk9Id-rn0BbYOqHkrIxjeYrqRQeW3bGWbfakkMk67Hwka977whwo34imJgT2m00DnUVedbDOjSUmNyEOi2XESX0JbaSX7rrGDUqKikdKJXHI6YLtPIP6FBCqkDZdd-a-Ao3_HKqdQKIOj8n5ycClfsOwFjBYNDhE60VRp6WqCthdvZd2PSfDQpbqUoxg6XSYBC-jmgHFdM2yF_aJNbAGKf4Jxa9g8oa7B0lOvlEtZmoLe736_C7hTsxnXTq8Wr-ttAbmS-0lyFbqSLagAq3vlgg2mHvjhNLBY8ywLAA9g9TEnjL7DrxYwyYimEMdeRaN7bS_c5NAOtIRlm8t3nRn0PrGourJnmU1yGzQAgUDLRGV5g7-yinsFx-yDrJfTfWpZhwq9ufahHeCy6odmD82ePY0CQckkhQbLxnbFQ8C3C05UuFh2PFEndBYnPO1Wo3GkfmuzWkuijwv40JWBoRl2FIIAX4_aA1S46kMoelYbbiL0m2irfs0plX2TGGOxudzXhQGOy4sX8c7whes8XNMCtrDt_2FpwWNkoqYwRoFlfwkM407vA7WsWU4rpoUzcA_jHDvJ272EWGRGU3YTcfTqO4skt3Vtx0z8vRX-3lWa_gfsNqk3P4W-IyMMi4X85YjRd4MG-BzcCPkQKDRZHvPi8EHKxAadFcs8F55IE65buaBB5sZqD3DSxRLBCrJvmVFv7wsRFwGOamCz5sFnp4M-EFnWx1Ij-pUpUb0g0EVSeLAjC5wtmd3-bW-jyQCeH4IVdTAEwySDbujlCCuqVmCktYemuEQKsFqx1GZmrjne2-jcblY_yU92hZ-DvVij17s775uYSmcY_fl0gcmhKOWwaPE2NSfouNJgYpAsgNe5psdHph9OL3NTSWMn-W6MucRLR4emWdJlUeYHYYyJ6O6djYx25SzXeshosDv-wl316OXvpvdYsSa6gJdjfZNdnFB33q0zrwzXW0HXUD2VIbjxJ1YXwl9f91PERlgTS9hoUkdGy7HLyno6rCUgsk89QdSCtX5BtMBT-ZfySPqW0z5JJKbI0iSpBHSvMoZHCTmQatM7xY97RWflv8yv8YkEMWNbd8IftDOEDnS-ikjAsN9AuoOW6oCfysqj3xjIeypNBzQtVPwXi67kpR_jFhSQT2wi2oye75s8ZmpPTuLhQBCVsWnup5ukgm2Bl3_Jqbnl7B4Z4oU3T1kn7JSn_IJSbFkwxFFX2YsXZ2XgYUEGXPFMPwnfiq5c6jwHd4YN7qsCgZz0HbRw-qf5l4R0zp56SzTMpXeaMkS1n3Go-mhOw9ZqtETrwjgzT1sqGbaLYzAfP1jqRSekSpUFkKy4LQWXMhebOfE0ZXg4PZN-U6bbRmqVHvOAtZW4gHDJYyh8jui7wN3V3h4sMbZ0MfkVj47a7wZCnDP3PICut9uSAFhSSEYN7JBmuFHTnw2tpjFqHroog6LZNJp0kX4ivn9MZl8kkp5F_wjQEtYo2NBo4J4S9K1WVQYMJ94RQU9aj5TqKNXZMlRkwbox0rb3N1U5xEd5Cs2tX4TfFW3oHkZmFIrP9L86DUvjX-Bv-ZbaQeY66FDMEWAeLrwHfpK10MwUZC7bqzTZn3bio_PV0wQylJSqjT_mwJ2eflDFAyLXOvt5sFWtZih8nlrLFdyAY9fyEeO5kZwPi1rcDv-fnSMsviIUKYV__MdKY282l--_sppYwSM0p64XqwGISBMKThmRTE_5NeRXr6WTck7g0FKdQ69BqOfxjLARkbDoC_R-_Ta4Jc56Su0JPQBTEDagOWVI3eN3Tbgo_M91vT20NhSKYYqgXutlNa-Ff-lwhSCDrGRvXBwP0DplXH1Qogjt1IB1WaFBCm1P0Dsl_WadhnFRIIbLxNJ8DsdGUxOFZ6ERWt397DkIbARSCx_U_fh4OcOHmEcnWS0Hcc-AIWNMZUfouDy2G66vpXo2g9OVY_2LvVA05YuPL9s-7oLTpGJr7-VGkXlvLwFfnfmF1cFnNtdrxzlYVB_z4WYQVbiGAhUJZawKpSqBT6NXD99mpCOwZLL7ZYPP2eDXh9yt&cid=CAQSKQBygQiDvSzQqRlyqbtf8bfXzwVLlZMO7l8yc72CiKotZSmxXbb-43T4GAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=3952829422269839400&adk=3944675600&idt=131&cac=0&dtd=65

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4fc2a2e21c86da64f4b8952ffbc855cc89a7398356f09e37a64902ff23fa0656

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3759532572&pi=t.ma~as.5788561387&w=728&lmt=1685634513&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513760&bpp=12&bdt=1323&idt=12&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1461&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=9&uci=a!9&btvi=1&fsb=1&xpc=SidpaiTUUu&p=https%3A//www.farfeshplus.online&dtd=18
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37193
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame D9E9 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d739babc9f4f8d76b20d284d664f1177fa7f7760099c635a86ea0f3049062b76

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 43A3
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

66ms
65ms

Document
text/html

2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 01 Jun 2023 15:48:35 GMT
expires: Thu, 01 Jun 2023 15:48:35 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 01 Jun 2023 15:48:35 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 93D5 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bffb4cb669dabb2242292ad9a43b8b72f47d799ea93554e894e77c3a6daaaf76

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BBB7
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESELT1ZhVjTEOHcLtFfdSRK2c&google_cver=1&google_push=ATf1kGMjstcYIoqmWUr3YNCEGJLe-9V6oLEFXEUIKT8nnY3ZhD4-zbdQ-aTL5R0lUbfHFomngts6y8sm9k4ScNwY...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ATf1kGMjstcYIoqmWUr3YNCEGJLe-9V6oLEFXEUIKT8nnY3ZhD4-zbdQ-aTL5R0lUbfHFomngts6y8sm9k4ScNwYrztm6ox0DsPTGoQ

170 B
188 B

53ms
52ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ATf1kGMjstcYIoqmWUr3YNCEGJLe-9V6oLEFXEUIKT8nnY3ZhD4-zbdQ-aTL5R0lUbfHFomngts6y8sm9k4ScNwYrztm6ox0DsPTGoQ

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 01 Jun 2023 15:48:36 GMT
Server: MT3 851 9bd98ae master zrh-pixel-x28 config_version:"unknown"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ATf1kGMjstcYIoqmWUr3YNCEGJLe-9V6oLEFXEUIKT8nnY3ZhD4-zbdQ-aTL5R0lUbfHFomngts6y8sm9k4ScNwYrztm6ox0DsPTGoQ
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Thu, 01 Jun 2023 15:48:35 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BBB7
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEDRH_VRabpQ6hUgrLOqqUxk&google_push=ATf1kGPflKLZctmeFGBdptk3ypOUDbL8nQo1siNg1K-1ja4-PRDnb7IGGC...

170 B
188 B

48ms
48ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEDRH_VRabpQ6hUgrLOqqUxk&google_push=ATf1kGPflKLZctmeFGBdptk3ypOUDbL8nQo1siNg1K-1ja4-PRDnb7IGGCVkmIR8fn1Wu76yOQrnX1_rQdXPsXRn5jjpYAZoEebJF5E

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-fra-eddf8230027-FRA
pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1685634516.706629,VS0,VE90
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEDRH_VRabpQ6hUgrLOqqUxk&google_push=ATf1kGPflKLZctmeFGBdptk3ypOUDbL8nQo1siNg1K-1ja4-PRDnb7IGGCVkmIR8fn1Wu76yOQrnX1_rQdXPsXRn5jjpYAZoEebJF5E
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BBB7
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEP1FjCN64vyDX62l0nKt1Kg&google_cver=1&google_push=ATf1kGPdW-3QnYWyFC-07MfrfYc41ZL2nLsM6u1jBrlmt8NZ1Hf8Ta0y9AUP9JmYn3olCrKZzN5fgm0O5kx1Qbun310xO1a...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGPdW-3QnYWyFC-07MfrfYc41ZL2nLsM6u1jBrlmt8NZ1Hf8Ta0y9AUP9JmYn3olCrKZzN5fgm0O5kx1Qbun310xO1aPfYLCtcw&google_hm=eS1Gc1YzSmdoRTJwSC5...

170 B
188 B

53ms
52ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGPdW-3QnYWyFC-07MfrfYc41ZL2nLsM6u1jBrlmt8NZ1Hf8Ta0y9AUP9JmYn3olCrKZzN5fgm0O5kx1Qbun310xO1aPfYLCtcw&google_hm=eS1Gc1YzSmdoRTJwSC5pOTF1X1VwOUNwejBDdXJzY1ZTcH5B

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 01 Jun 2023 15:48:35 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGPdW-3QnYWyFC-07MfrfYc41ZL2nLsM6u1jBrlmt8NZ1Hf8Ta0y9AUP9JmYn3olCrKZzN5fgm0O5kx1Qbun310xO1aPfYLCtcw&google_hm=eS1Gc1YzSmdoRTJwSC5pOTF1X1VwOUNwejBDdXJzY1ZTcH5B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BBB7
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEE-MrRuOUBLBQQ7wR6Hje8s&google_cver=1&google_push=ATf1kGPkYVmXioqie0-V7YXmwqWbq-DT7EF9RCKVuBPinSL-zLgytlrd7BBPYpM37QDQGiw66Ck98Gcy...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEE-MrRuOUBLBQQ7wR6Hje8s&google_cver=1&google_push=ATf1kGPkYVmXioqie0-V7YXmwqWbq-DT7EF9RCKVuBPinSL-zLgytlrd7BBPYpM37QDQGiw66Ck...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDkxNTYyMTg2MzY0NTQ5NzQ3Ng&google_push=ATf1kGPkYVmXioqie0-V7YXmwqWbq-DT7EF9RCKVuBPinSL-zLgytlrd7BBPYpM37QDQGiw66Ck98G...

170 B
188 B

57ms
55ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDkxNTYyMTg2MzY0NTQ5NzQ3Ng&google_push=ATf1kGPkYVmXioqie0-V7YXmwqWbq-DT7EF9RCKVuBPinSL-zLgytlrd7BBPYpM37QDQGiw66Ck98Gcy40DG5BZyipLOyhmUj70jTXg

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDkxNTYyMTg2MzY0NTQ5NzQ3Ng&google_push=ATf1kGPkYVmXioqie0-V7YXmwqWbq-DT7EF9RCKVuBPinSL-zLgytlrd7BBPYpM37QDQGiw66Ck98Gcy40DG5BZyipLOyhmUj70jTXg
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2

200

cookiematch.aspx
dis.criteo.com/dis/rtb/google/ Frame BBB7
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DPUSH_DATA&...
https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=k-LXQVCGJ2-AbpzohmaDk7ORgd00gyRSU3Pfvw4g&google_push=PUSH_DATA
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_error=5

43 B
368 B

24ms
19ms

Image
image/gif

178.250.7.11
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_error=5

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Server

178.250.7.11 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 88545
timing-allow-origin: *
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 274
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame BBB7 42 B
214 B 521ms
19ms Image
image/gif 34.160.236.64
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEDSoxeslBHCuCWoenGMM2Ec&google_push=ATf1kGP9_xjwiGwKzIUVqR3BonYdy-DnIUAOill3pc0uvrtuYbn2sW9UOtcSMBJSie7mEzVtqud-0oUrl3ykoDPhTmI1dEmgvRd42JM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=544333611&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1685634513&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513931&bpp=12&bdt=1494&idt=12&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=2395&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=10&uci=a!a&btvi=2&fsb=1&xpc=McfNa49C9I&p=https%3A//www.farfeshplus.online&dtd=27
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.160.236.64 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 64.236.160.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:35 GMT
via: 1.1 google
last-modified: Tue, 28 Jun 2022 14:08:50 GMT
server: nginx
etag: "62bb0b72-2a"
content-type: image/gif
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H2 200 trk
ag.innovid.com/ Frame BBB7 43 B
298 B 643ms
21ms Image
image/gif 18.169.47.225
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEJjUOTpUlFUQRQK94eTW0kU&google_cver=1&google_push=ATf1kGPVc60xwTKJ72GuhvCOVjtUDbhfAAUjRhjyxb5QzqDyuUZZ2jgvFhY-i7QdhQF7V8-rFbfT2TZ_1Ad4iJuHSTyW-dE1UM7yFRI
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=544333611&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1685634513&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513931&bpp=12&bdt=1494&idt=12&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=2395&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=10&uci=a!a&btvi=2&fsb=1&xpc=McfNa49C9I&p=https%3A//www.farfeshplus.online&dtd=27
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.169.47.225 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-169-47-225.eu-west-2.compute.amazonaws.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
cache-control: no-cache
content-length: 43
request-time: 1
expires: -1

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame BBB7 0
51 B 49ms
47ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JvnAX6Y_4kiPOdbPGGIXpuwCQ-0onkIQa-6peWyViu-3Ts8yh2PpgivicgoCbvnnP5IkR9

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:35 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 30A9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELKKIFy3wZE8xTMwCNTZdUg&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELKKIFy3wZE8xTMwCNTZdUg&google_cver=1&C=1

43 B
632 B

14ms
8ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELKKIFy3wZE8xTMwCNTZdUg&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYoeziwAEwAQ&v=APEucNWrZ58UacX31JrSGs0EuALF1eWGQcZOg6pyP0wl3_PeRrJMb3YYqDrNKws4LcqcjBoFGK_quV_udDZGuYhwkH6QBHnlw2I7VnIDX8m77xBMGZosUGgNpdYIBjI0JFhHxlyTR-L7dAzr1lrDENCFSCw_-MbbhomO9QslU8dEbPPF82kIgCs
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 01 Jun 2023 15:48:35 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Thu, 01 Jun 2023 15:48:35 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=45&external_user_id=CAESELKKIFy3wZE8xTMwCNTZdUg&google_cver=1&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 30A9
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZHi90-4WD259WMA0ZXKs2QAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELKKIFy3wZE8xTMwCNTZdUg&google_cver=1

43 B
632 B

21ms
19ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELKKIFy3wZE8xTMwCNTZdUg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYoeziwAEwAQ&v=APEucNWrZ58UacX31JrSGs0EuALF1eWGQcZOg6pyP0wl3_PeRrJMb3YYqDrNKws4LcqcjBoFGK_quV_udDZGuYhwkH6QBHnlw2I7VnIDX8m77xBMGZosUGgNpdYIBjI0JFhHxlyTR-L7dAzr1lrDENCFSCw_-MbbhomO9QslU8dEbPPF82kIgCs
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 01 Jun 2023 15:48:36 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELKKIFy3wZE8xTMwCNTZdUg&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame 30A9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESECpzjxSNnQcTYtuAsBZ9BII&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESECpzjxSNnQcTYtuAsBZ9BII%26google_cver%3D1

43 B
1 KB

316ms
13ms

Image
image/gif

37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESECpzjxSNnQcTYtuAsBZ9BII%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYoeziwAEwAQ&v=APEucNWrZ58UacX31JrSGs0EuALF1eWGQcZOg6pyP0wl3_PeRrJMb3YYqDrNKws4LcqcjBoFGK_quV_udDZGuYhwkH6QBHnlw2I7VnIDX8m77xBMGZosUGgNpdYIBjI0JFhHxlyTR-L7dAzr1lrDENCFSCw_-MbbhomO9QslU8dEbPPF82kIgCs

Protocol

HTTP/1.1

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.2 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 01 Jun 2023 15:48:36 GMT
AN-X-Request-Uuid: 62f06a55-04e8-4aec-b2c3-2489c07c072e
Server: nginx/1.23.2
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 185.213.155.146; 185.213.155.146; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 01 Jun 2023 15:48:35 GMT
AN-X-Request-Uuid: 0253b614-514e-48e8-983d-9636b6d2ff74
Server: nginx/1.23.2
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESECpzjxSNnQcTYtuAsBZ9BII%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 185.213.155.146; 185.213.155.146; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 30A9
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTU1ODAzMDIwMjM1NTMxMjUxMA%3D%3D

170 B
188 B

48ms
47ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTU1ODAzMDIwMjM1NTMxMjUxMA%3D%3D

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 01 Jun 2023 15:48:36 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 185.213.155.146; 185.213.155.146; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 93b753e5-1f28-4008-a2ed-f7e46ec6f736
Server: nginx/1.23.2
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTU1ODAzMDIwMjM1NTMxMjUxMA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame D56B 42 B
63 B 76ms
76ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-B_S0CIaAuQPP_sNBFIBIvyPD9JA9OuPt223r9rt-jLAr1TgV90o__wc65OiKzEZT4AEj7nEyuZ5sNeeK1tFvWYQDZanjh0N0ls6Qv19TJjkSLycbg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=250&slotname=2097210043&adk=239546933&adf=744370384&pi=t.ma~as.2097210043&w=300&lmt=1685634514&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634514177&bpp=3&bdt=1740&idt=3&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D76ab65cad0aa0eff%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_Ma0_IwpMBOi7nj9-q6otQoNKDc7Aw&gpic=UID%3D00000c3a8e3515fd%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_MZpfKIRVVeVVB8cjAISCX5v7pmlrA&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=569&ady=3955&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=50&uci=a!1e&btvi=4&fsb=1&xpc=PCTYuyO1NN&p=https%3A//www.farfeshplus.online&dtd=7

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D56B 0
20 B 75ms
74ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=2198531392341991158&x=1&ct=76

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame D56B 78 KB
27 KB 157ms
156ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:35 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 01 Jun 2023 15:48:35 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/ Frame D56B 3 KB
1 KB 45ms
44ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:09:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5936
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 14:09:39 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/ Frame D56B 19 KB
8 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3735e94afb2539b14515fdd10d7cc066cffa99d4b52762959e342295e08a770e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:02:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6366
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7991
x-xss-protection: 0
server: cafe
etag: 2412543371950383451
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 14:02:29 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D56B 171 KB
53 KB 56ms
55ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b108d10517b218ebb22d63ad00b85baf89a7b4f1884c3fd01eb03f0790b1cd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54276
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1685532878231373"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 01 Jun 2023 15:48:35 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 8C4B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEBis3XfB21dgDLdWZNU4af4&google_cver=1

43 B
274 B

338ms
23ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEBis3XfB21dgDLdWZNU4af4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDkyTkY-O_NxQEwAQ&v=APEucNVxDVGkKGCffNjSvjIf7UnZHLz4kcd_Lx5_18YfP7fWZSc2lSpzrBrHwgbfam5zY906-M5zvoD8rix77dBHA6FNNWClyocp7KG83Fd2IBhQH9oGiWP2JZg47kdZlQ57SFls23VULO9Ah2rYMa6nLOr_HaUboFUpvT3VnhtXNP8WnHmJihw
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEBis3XfB21dgDLdWZNU4af4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 8C4B 43 B
146 B 497ms
24ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDkyTkY-O_NxQEwAQ&v=APEucNVxDVGkKGCffNjSvjIf7UnZHLz4kcd_Lx5_18YfP7fWZSc2lSpzrBrHwgbfam5zY906-M5zvoD8rix77dBHA6FNNWClyocp7KG83Fd2IBhQH9oGiWP2JZg47kdZlQ57SFls23VULO9Ah2rYMa6nLOr_HaUboFUpvT3VnhtXNP8WnHmJihw
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 8C4B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEIc8dOOjljOyONO7M2iZVsg&google_cver=1

23 B
165 B

227ms
44ms

Image
image/gif

104.111.217.42
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEIc8dOOjljOyONO7M2iZVsg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDkyTkY-O_NxQEwAQ&v=APEucNVxDVGkKGCffNjSvjIf7UnZHLz4kcd_Lx5_18YfP7fWZSc2lSpzrBrHwgbfam5zY906-M5zvoD8rix77dBHA6FNNWClyocp7KG83Fd2IBhQH9oGiWP2JZg47kdZlQ57SFls23VULO9Ah2rYMa6nLOr_HaUboFUpvT3VnhtXNP8WnHmJihw
Protocol: H2
Server: 104.111.217.42 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-217-42.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

expires: Thu, 01 Jun 2023 15:48:35 GMT
pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEIc8dOOjljOyONO7M2iZVsg&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 8C4B 23 B
165 B 396ms
44ms Image
image/gif 104.111.217.42
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDkyTkY-O_NxQEwAQ&v=APEucNVxDVGkKGCffNjSvjIf7UnZHLz4kcd_Lx5_18YfP7fWZSc2lSpzrBrHwgbfam5zY906-M5zvoD8rix77dBHA6FNNWClyocp7KG83Fd2IBhQH9oGiWP2JZg47kdZlQ57SFls23VULO9Ah2rYMa6nLOr_HaUboFUpvT3VnhtXNP8WnHmJihw
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.217.42 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-217-42.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

expires: Thu, 01 Jun 2023 15:48:35 GMT
pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

GET
H2 200 css
fonts.googleapis.com/ Frame FDCC 4 KB
730 B 48ms
45ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=1738279810&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1685634513&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513553&bpp=15&bdt=1116&idt=15&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600&nras=1&correlator=7472659638016&frm=20&pv=2&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=121&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=h6AcjFpLLX&p=https%3A//www.farfeshplus.online&dtd=26

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4681d619f677c1b314814309a6f00a5e0ec3f12968e807ee71def1cf42bd7808

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 01 Jun 2023 15:48:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 14:52:54 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 01 Jun 2023 15:48:35 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/ Frame FDCC 2 KB
892 B 39ms
37ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=1738279810&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1685634513&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513553&bpp=15&bdt=1116&idt=15&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600&nras=1&correlator=7472659638016&frm=20&pv=2&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=121&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=h6AcjFpLLX&p=https%3A//www.farfeshplus.online&dtd=26

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:02:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6360
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 14:02:35 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230530/r20110914/ Frame FDCC 22 KB
9 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230530/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=1738279810&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1685634513&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513553&bpp=15&bdt=1116&idt=15&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600&nras=1&correlator=7472659638016&frm=20&pv=2&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=121&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=h6AcjFpLLX&p=https%3A//www.farfeshplus.online&dtd=26

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

551debe8c4f0db7b25699af72a204caf099af55413f90eb34b5f546330d6187c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:02:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6363
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8798
x-xss-protection: 0
server: cafe
etag: 11317101923912129037
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 14:02:32 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/ Frame FDCC 3 KB
1 KB 50ms
49ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=1738279810&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1685634513&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513553&bpp=15&bdt=1116&idt=15&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600&nras=1&correlator=7472659638016&frm=20&pv=2&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=121&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=h6AcjFpLLX&p=https%3A//www.farfeshplus.online&dtd=26

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:09:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5936
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 14:09:39 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/ Frame FDCC 19 KB
8 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=1738279810&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1685634513&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513553&bpp=15&bdt=1116&idt=15&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600&nras=1&correlator=7472659638016&frm=20&pv=2&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=121&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=h6AcjFpLLX&p=https%3A//www.farfeshplus.online&dtd=26

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3735e94afb2539b14515fdd10d7cc066cffa99d4b52762959e342295e08a770e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:02:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6366
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7991
x-xss-protection: 0
server: cafe
etag: 2412543371950383451
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 14:02:29 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame FDCC 171 KB
53 KB 51ms
50ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=1738279810&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1685634513&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513553&bpp=15&bdt=1116&idt=15&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600&nras=1&correlator=7472659638016&frm=20&pv=2&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=121&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=h6AcjFpLLX&p=https%3A//www.farfeshplus.online&dtd=26

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b108d10517b218ebb22d63ad00b85baf89a7b4f1884c3fd01eb03f0790b1cd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54276
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1685532878231373"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 01 Jun 2023 15:48:35 GMT

GET
H2 200 a0f85236eb26cc0778ab5a91ae2d3422.js Show response
www.gstatic.com/mysidia/ Frame FDCC 32 KB
13 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/a0f85236eb26cc0778ab5a91ae2d3422.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=1738279810&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1685634513&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513553&bpp=15&bdt=1116&idt=15&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600&nras=1&correlator=7472659638016&frm=20&pv=2&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=121&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=h6AcjFpLLX&p=https%3A//www.farfeshplus.online&dtd=26

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

78ddeb39a928825cfb11fbd72a2c5a5fabf18add9b6208e4bee826e7bcfd9c2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 31 May 2023 03:56:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 129155
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13674
x-xss-protection: 0
last-modified: Wed, 31 May 2023 03:45:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 29 Aug 2023 03:56:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 4D10 640 B
262 B 121ms
82ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARjPyrHlATAB&v=APEucNXg_jEYLFeFQlpOknqlgXJBB_Qy8ogYg2sb6T-Cf0n3dhrJLoEYF04h5Ovc3Lo82wXc6pb-XYWzZ5xjbDF2YXEwlI9v2cZZASUHzLZu9ulRW6Flxok6CqTZbDbkGIttNq_t8utl7u44tJiXiOfbEuhphmE7dceNiMvdeSb_GU6C-tjAWUY

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1231661633440980&output=html&h=280&slotname=9134183485&adk=3378407940&adf=2021203405&pi=t.ma~as.9134183485&w=336&lmt=1685634514&format=336x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634514084&bpp=5&bdt=1647&idt=5&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=551&ady=3160&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=48&uci=a!1c&btvi=3&fsb=1&xpc=ih4ds9qhg1&p=https%3A//www.farfeshplus.online&dtd=9

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1231661633440980&output=html&h=280&slotname=9134183485&adk=3378407940&adf=2021203405&pi=t.ma~as.9134183485&w=336&lmt=1685634514&format=336x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634514084&bpp=5&bdt=1647&idt=5&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=551&ady=3160&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=48&uci=a!1c&btvi=3&fsb=1&xpc=ih4ds9qhg1&p=https%3A//www.farfeshplus.online&dtd=9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 01 Jun 2023 15:48:35 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 68C4 78 KB
27 KB 150ms
148ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:35 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 01 Jun 2023 15:48:35 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/ Frame 68C4 3 KB
1 KB 40ms
37ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:09:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5936
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 14:09:39 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/ Frame 68C4 19 KB
8 KB 42ms
40ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3735e94afb2539b14515fdd10d7cc066cffa99d4b52762959e342295e08a770e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:02:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6366
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7991
x-xss-protection: 0
server: cafe
etag: 2412543371950383451
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 14:02:29 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 68C4 0
0 49ms
47ms Image
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTw1TAyqh-ThaR1U73HmGRv_wN-E8ezGl-Okqtj62ShVXe342qZ_YuywEh98NXvi0fuy_Jjfcyz66arcOfQF6NF26dQ9Q
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1231661633440980&output=html&h=280&slotname=9134183485&adk=3378407940&adf=2021203405&pi=t.ma~as.9134183485&w=336&lmt=1685634514&format=336x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634514084&bpp=5&bdt=1647&idt=5&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=551&ady=3160&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=48&uci=a!1c&btvi=3&fsb=1&xpc=ih4ds9qhg1&p=https%3A//www.farfeshplus.online&dtd=9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 68C4 171 KB
53 KB 68ms
66ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b108d10517b218ebb22d63ad00b85baf89a7b4f1884c3fd01eb03f0790b1cd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54276
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1685532878231373"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 01 Jun 2023 15:48:35 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 68C4 42 B
63 B 75ms
73ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BSegfwYQ0kkmairOTk8YeM80zcyjPjr0x6kiwURDZQTzHNHj2WjFoR22OBc5-R3yXsDho7DBTay8e1mo6KXZBOIAQfH5ZZJ1aiLyDLHG0SSAiQaEg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 68C4 0
20 B 74ms
72ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=5982605649199137403&x=1&ct=76

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 default.css
as.ad4m.at/ad/style/0.1.40/one-ad/ Frame 15E3 103 KB
13 KB 24ms
23ms Stylesheet
text/css 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://as.ad4m.at/ad/style/0.1.40/one-ad/default.css
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/dr?ed=1ka4wtq451qwgm2tsq44kt1smd54xphn92s7pd06j2mxcjyp5qbeb2k5s77gy8v8fwgw5mqf0qztb11j0qr2amrfptf1rp48tg17z095dsfadg167m78xyp05eh6w4zd2zqa6q44v4sh88vgjanqt7j5bkxyad8wtgq9wxz48b8p4qs7nz1pgnkmrww4zvntp0qjanyh2gypttzekawmenxf0dkettd2twyc4f52bdnh74ya27t3f5fzvqvpf3vap4tswe7sjkdbsr3ah1qt2sxt90ap2n7qemtnxm21twnptme90xqsnfn8t6v2bsasq53mg4p41rcy9d31sdm2vynrh3jk6y6vgvt100fgfar7ayf8thbrntwewzn86111zcfrvv1rj5e0cr3g6cnt9qvgbfy0f9knhpbvesjp7h46h55b3kk0&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCCCyU0r14ZJfsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSAAk_Q8ZBoeXcmdFs3Ne4A0BVHUHpRZOO5PUF8yj21nYvXGukTSVcmJikWDTTdzUDA6tjuYC_T0lMUYcsxvmJNSTXR1k3ustgfuZjkC6gzl4cbT29hO_ApbYH3NUKYpksZBvgNwA8hvm7gcIHysBOKG1CyxwkMVn3_AznTZl1sh-cWEbMnK2kaeT7j1fwtgUh6a8nOjdoqKEMysTZzHC-GT285wF9nl5s-MsqMa7Mglc_e4SdtaF60jUbSkjg-IuO3YB2XMHX4PuHDh-LF2f2Z5BJf7wvqLIxpQxP71tlVo9vLLGMQC6xVaLfKssXaR3RZqKLEllauAfCiVAgbbOJ559rgBAGABoKGjrL8sNmW-gGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2GfKMz1UzIkeSOzxonQ5Fzpyt4Nw%26client%3Dca-pub-6266313190087173%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d77b5f2ca03eb8dab2acc515548b7b1ce7eeb4ca2189268552649e0391ee8c21

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.ad4m.at/ad/dr?ed=1ka4wtq451qwgm2tsq44kt1smd54xphn92s7pd06j2mxcjyp5qbeb2k5s77gy8v8fwgw5mqf0qztb11j0qr2amrfptf1rp48tg17z095dsfadg167m78xyp05eh6w4zd2zqa6q44v4sh88vgjanqt7j5bkxyad8wtgq9wxz48b8p4qs7nz1pgnkmrww4zvntp0qjanyh2gypttzekawmenxf0dkettd2twyc4f52bdnh74ya27t3f5fzvqvpf3vap4tswe7sjkdbsr3ah1qt2sxt90ap2n7qemtnxm21twnptme90xqsnfn8t6v2bsasq53mg4p41rcy9d31sdm2vynrh3jk6y6vgvt100fgfar7ayf8thbrntwewzn86111zcfrvv1rj5e0cr3g6cnt9qvgbfy0f9knhpbvesjp7h46h55b3kk0&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCCCyU0r14ZJfsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSAAk_Q8ZBoeXcmdFs3Ne4A0BVHUHpRZOO5PUF8yj21nYvXGukTSVcmJikWDTTdzUDA6tjuYC_T0lMUYcsxvmJNSTXR1k3ustgfuZjkC6gzl4cbT29hO_ApbYH3NUKYpksZBvgNwA8hvm7gcIHysBOKG1CyxwkMVn3_AznTZl1sh-cWEbMnK2kaeT7j1fwtgUh6a8nOjdoqKEMysTZzHC-GT285wF9nl5s-MsqMa7Mglc_e4SdtaF60jUbSkjg-IuO3YB2XMHX4PuHDh-LF2f2Z5BJf7wvqLIxpQxP71tlVo9vLLGMQC6xVaLfKssXaR3RZqKLEllauAfCiVAgbbOJ559rgBAGABoKGjrL8sNmW-gGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2GfKMz1UzIkeSOzxonQ5Fzpyt4Nw%26client%3Dca-pub-6266313190087173%26adurl%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:35 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-meta-goog-reserved-file-mtime: 1683559916
age: 864557
cf-polished: origSize=105839
x-guploader-uploadid: ADPycdv9IJsM9Nda_T-YCF8tGjLSR9_5GyrPWBCiXo7o_2KPFa29jeIDurPOQJdzBat54FnfGmUqvpjJPo5BCE2ydDX2ig
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Mon, 08 May 2023 15:32:28 GMT
server: cloudflare
etag: W/"44fa96b813e145cb8b915ae1fb6a3b7a"
vary: Accept-Encoding
x-goog-generation: 1683559948253618
content-type: text/css
x-goog-hash: crc32c=FELYSw==, md5=RPqWuBPhRcuLkVrh+2o7eg==
cache-control: public, max-age=3600
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=13906DjMIgxifC7tnKYrp%2BvmbcU5gxexIPMvLBUz%2BGNmXT8D9edEWOpzUuf4aYU%2FjHBJCLknVwQU%2F5NNUnq8esgq3uTvamsSf8%2BE65952EAQ8pUMafsVAmXwOvxJoAd7Me%2FKDvv7cek%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 105839
cf-ray: 7d089a088e3fbb65-FRA
expires: Thu, 01 Jun 2023 16:48:35 GMT

GET
H2 200 r62eglto.js Show response
ad4m.at/ Frame 15E3 25 KB
10 KB 40ms
18ms Script
application/javascript 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/r62eglto.js
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/dr?ed=1ka4wtq451qwgm2tsq44kt1smd54xphn92s7pd06j2mxcjyp5qbeb2k5s77gy8v8fwgw5mqf0qztb11j0qr2amrfptf1rp48tg17z095dsfadg167m78xyp05eh6w4zd2zqa6q44v4sh88vgjanqt7j5bkxyad8wtgq9wxz48b8p4qs7nz1pgnkmrww4zvntp0qjanyh2gypttzekawmenxf0dkettd2twyc4f52bdnh74ya27t3f5fzvqvpf3vap4tswe7sjkdbsr3ah1qt2sxt90ap2n7qemtnxm21twnptme90xqsnfn8t6v2bsasq53mg4p41rcy9d31sdm2vynrh3jk6y6vgvt100fgfar7ayf8thbrntwewzn86111zcfrvv1rj5e0cr3g6cnt9qvgbfy0f9knhpbvesjp7h46h55b3kk0&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCCCyU0r14ZJfsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSAAk_Q8ZBoeXcmdFs3Ne4A0BVHUHpRZOO5PUF8yj21nYvXGukTSVcmJikWDTTdzUDA6tjuYC_T0lMUYcsxvmJNSTXR1k3ustgfuZjkC6gzl4cbT29hO_ApbYH3NUKYpksZBvgNwA8hvm7gcIHysBOKG1CyxwkMVn3_AznTZl1sh-cWEbMnK2kaeT7j1fwtgUh6a8nOjdoqKEMysTZzHC-GT285wF9nl5s-MsqMa7Mglc_e4SdtaF60jUbSkjg-IuO3YB2XMHX4PuHDh-LF2f2Z5BJf7wvqLIxpQxP71tlVo9vLLGMQC6xVaLfKssXaR3RZqKLEllauAfCiVAgbbOJ559rgBAGABoKGjrL8sNmW-gGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2GfKMz1UzIkeSOzxonQ5Fzpyt4Nw%26client%3Dca-pub-6266313190087173%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2d5e67a38c9a11424cac19ce192c9fd124a6d74e64d3791a01561dbd3e39c0b4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:35 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 14 Mar 2023 13:45:21 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 592955
etag: W/"fcb2a26b07bd76d9a925cae661d6d94d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AYVRMqq6Z4ZwPs2iY79BstXeu%2Fbi%2BbTb%2FYgEPdzRYxnQ%2FefotH3zW%2BSvpx%2BSeT8AXe2awTnfQULuupMNwX4G3okPo430LDq9i%2B%2BImLVb%2BedcOrF1q%2Fq3FH%2BuiV5323zo3yGmL%2Fo%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=3600, must-revalidate, stale-while-revalidate=300
cf-ray: 7d089a08ae75bb65-FRA
alt-svc: h3=":443"; ma=86400
expires: Tue, 23 May 2023 13:46:09 GMT

GET
H2 200 default.css
as.ad4m.at/ad/style/0.1.40/one-ad/ Frame 5159 103 KB
12 KB 22ms
20ms Stylesheet
text/css 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://as.ad4m.at/ad/style/0.1.40/one-ad/default.css
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/dr?ed=1j4nxee5yn1y54qbtfgqartwnavzg4vaj04rbfh7dmb193kpmt74az5869kbe173jnxj81a41xjhe95zczqz4wdv11qtq2s0nv6w24z5c1mnbf81tvs4ret8ygnb6504x0efb20195c7a3g6w7a2308taxvwxq6xd7scq0gy92dewabf9zx04qp0wfp422wabr7nw77evefhp9g10vj1bbgyxdwm2egyy1kjzpwjztd0jzn1qfrt019339atqtkevvs8na6gtj9j08a7xyw14f4e1zs2aspd2tc38kfqef3x7bycggazz8ecfrj248vv9evmswdd3s4h9fefasjnagtqgxxf9p6s67f83qjjk6c1zpevpysxgch2xch51zkmg57bch2g0grdvy98tzzkwfvbp1ngqrkmpgcc1penx9db17vjvwy0tdrn3qmvv0gffsyxxhk40hhg&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCCzdZ0r14ZJbsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSFAk_QkVhoMQF4FpBrIh4d_96t1lo09_NWbzPp7lG2tQI1aWW3_PxR-4R65_zMorz3LWfRQrcsCPUaIA2XX7K-G1udF6GXISECHtnW1HzPwS2P3v60f0rjsTuCL5MNBCGVDoIwH8AdY_4-d04CAkB5k6_Q_f3vLUHqmJL0Rq5dAkMg4dXI6Ij18GFU6IJCjm75kqw7xbXLWMT2m8_oZMYEAF_3aup20TBrcjEvR0_ralHmbmW96sJFKyotV20HZEGrcHgQv3Mz03HSQKCmdOGr7X_yZSNIHfh6xvZF77TbMSba4fT0wxgn49TyLTAymCgQnooOiMopABV8b9IH-4ihdaWhTf-WyeAEAYAGtoyOx-LazYXwAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0GPRMhVzuVGjgwiOiV0pp-xeC9fg%26client%3Dca-pub-6266313190087173%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d77b5f2ca03eb8dab2acc515548b7b1ce7eeb4ca2189268552649e0391ee8c21

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.ad4m.at/ad/dr?ed=1j4nxee5yn1y54qbtfgqartwnavzg4vaj04rbfh7dmb193kpmt74az5869kbe173jnxj81a41xjhe95zczqz4wdv11qtq2s0nv6w24z5c1mnbf81tvs4ret8ygnb6504x0efb20195c7a3g6w7a2308taxvwxq6xd7scq0gy92dewabf9zx04qp0wfp422wabr7nw77evefhp9g10vj1bbgyxdwm2egyy1kjzpwjztd0jzn1qfrt019339atqtkevvs8na6gtj9j08a7xyw14f4e1zs2aspd2tc38kfqef3x7bycggazz8ecfrj248vv9evmswdd3s4h9fefasjnagtqgxxf9p6s67f83qjjk6c1zpevpysxgch2xch51zkmg57bch2g0grdvy98tzzkwfvbp1ngqrkmpgcc1penx9db17vjvwy0tdrn3qmvv0gffsyxxhk40hhg&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCCzdZ0r14ZJbsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSFAk_QkVhoMQF4FpBrIh4d_96t1lo09_NWbzPp7lG2tQI1aWW3_PxR-4R65_zMorz3LWfRQrcsCPUaIA2XX7K-G1udF6GXISECHtnW1HzPwS2P3v60f0rjsTuCL5MNBCGVDoIwH8AdY_4-d04CAkB5k6_Q_f3vLUHqmJL0Rq5dAkMg4dXI6Ij18GFU6IJCjm75kqw7xbXLWMT2m8_oZMYEAF_3aup20TBrcjEvR0_ralHmbmW96sJFKyotV20HZEGrcHgQv3Mz03HSQKCmdOGr7X_yZSNIHfh6xvZF77TbMSba4fT0wxgn49TyLTAymCgQnooOiMopABV8b9IH-4ihdaWhTf-WyeAEAYAGtoyOx-LazYXwAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0GPRMhVzuVGjgwiOiV0pp-xeC9fg%26client%3Dca-pub-6266313190087173%26adurl%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:35 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-meta-goog-reserved-file-mtime: 1683559916
age: 864557
cf-polished: origSize=105839
x-guploader-uploadid: ADPycdv9IJsM9Nda_T-YCF8tGjLSR9_5GyrPWBCiXo7o_2KPFa29jeIDurPOQJdzBat54FnfGmUqvpjJPo5BCE2ydDX2ig
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Mon, 08 May 2023 15:32:28 GMT
server: cloudflare
etag: W/"44fa96b813e145cb8b915ae1fb6a3b7a"
vary: Accept-Encoding
x-goog-generation: 1683559948253618
content-type: text/css
x-goog-hash: crc32c=FELYSw==, md5=RPqWuBPhRcuLkVrh+2o7eg==
cache-control: public, max-age=3600
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ttwPcvoI5eOMZfE8DW6FNwSlujr4Y44AIoBLaZz5QCRLOKwgYB5J%2FZKbUi5WORSRQYQyHS08714Ztuck7mGXEWU7jU3VjJNcD%2BtqPI8O1cAZjyuFKSPUKG2E%2FturX1Tp8sUMgQGRuNs%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 105839
cf-ray: 7d089a08ae74bb65-FRA
expires: Thu, 01 Jun 2023 16:48:35 GMT

GET
H2 200 r62eglto.js Show response
ad4m.at/ Frame 5159 25 KB
10 KB 24ms
22ms Script
application/javascript 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/r62eglto.js
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/dr?ed=1j4nxee5yn1y54qbtfgqartwnavzg4vaj04rbfh7dmb193kpmt74az5869kbe173jnxj81a41xjhe95zczqz4wdv11qtq2s0nv6w24z5c1mnbf81tvs4ret8ygnb6504x0efb20195c7a3g6w7a2308taxvwxq6xd7scq0gy92dewabf9zx04qp0wfp422wabr7nw77evefhp9g10vj1bbgyxdwm2egyy1kjzpwjztd0jzn1qfrt019339atqtkevvs8na6gtj9j08a7xyw14f4e1zs2aspd2tc38kfqef3x7bycggazz8ecfrj248vv9evmswdd3s4h9fefasjnagtqgxxf9p6s67f83qjjk6c1zpevpysxgch2xch51zkmg57bch2g0grdvy98tzzkwfvbp1ngqrkmpgcc1penx9db17vjvwy0tdrn3qmvv0gffsyxxhk40hhg&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCCzdZ0r14ZJbsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSFAk_QkVhoMQF4FpBrIh4d_96t1lo09_NWbzPp7lG2tQI1aWW3_PxR-4R65_zMorz3LWfRQrcsCPUaIA2XX7K-G1udF6GXISECHtnW1HzPwS2P3v60f0rjsTuCL5MNBCGVDoIwH8AdY_4-d04CAkB5k6_Q_f3vLUHqmJL0Rq5dAkMg4dXI6Ij18GFU6IJCjm75kqw7xbXLWMT2m8_oZMYEAF_3aup20TBrcjEvR0_ralHmbmW96sJFKyotV20HZEGrcHgQv3Mz03HSQKCmdOGr7X_yZSNIHfh6xvZF77TbMSba4fT0wxgn49TyLTAymCgQnooOiMopABV8b9IH-4ihdaWhTf-WyeAEAYAGtoyOx-LazYXwAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0GPRMhVzuVGjgwiOiV0pp-xeC9fg%26client%3Dca-pub-6266313190087173%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2d5e67a38c9a11424cac19ce192c9fd124a6d74e64d3791a01561dbd3e39c0b4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:35 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 14 Mar 2023 13:45:21 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 592955
etag: W/"fcb2a26b07bd76d9a925cae661d6d94d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RFXmb1saVRoCO%2FeqLSeJMH6RM0aGAxaHjSRxUHVu0Oo1AkBCyefkTM1XAG7S2nqqW%2FqT06Wr%2FPletGpj6WubBIPxmEQd0ynii%2F4mjWLdNgpAdQjzwAFAsfZitQxMKSMkxA9wTxI%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=3600, must-revalidate, stale-while-revalidate=300
cf-ray: 7d089a08ae76bb65-FRA
alt-svc: h3=":443"; ma=86400
expires: Tue, 23 May 2023 13:46:09 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 6064
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELKKIFy3wZE8xTMwCNTZdUg&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELKKIFy3wZE8xTMwCNTZdUg&google_cver=1&C=1

43 B
632 B

14ms
12ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELKKIFy3wZE8xTMwCNTZdUg&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNzEWhCKmKjKAhj-vNjrATAB&v=APEucNWmx0ls-IgYbFIZk7458BdIfJELmvBgv-qL18n4o_klHsOq2upGbmivmkpTx2vtT3UFdIkJEBaMY0ktuvni7Gzd1Nc9Q5hWPFlR1pynccqT_0La3JZWwkrzQMpX_M8rkFbQ0e2YrInHCGhGbDwQHQ3Vj6XPadQf7hWmYEW7emIJSAkFZOhpnvGDCexEYpybkdXCDa2hcT8pjk9Cy2Z626BTiD8VtA
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 01 Jun 2023 15:48:35 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Thu, 01 Jun 2023 15:48:35 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=45&external_user_id=CAESELKKIFy3wZE8xTMwCNTZdUg&google_cver=1&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 6064
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZHi90-4WD259WMA0ZXKs2QAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELKKIFy3wZE8xTMwCNTZdUg&google_cver=1

43 B
632 B

20ms
18ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELKKIFy3wZE8xTMwCNTZdUg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNzEWhCKmKjKAhj-vNjrATAB&v=APEucNWmx0ls-IgYbFIZk7458BdIfJELmvBgv-qL18n4o_klHsOq2upGbmivmkpTx2vtT3UFdIkJEBaMY0ktuvni7Gzd1Nc9Q5hWPFlR1pynccqT_0La3JZWwkrzQMpX_M8rkFbQ0e2YrInHCGhGbDwQHQ3Vj6XPadQf7hWmYEW7emIJSAkFZOhpnvGDCexEYpybkdXCDa2hcT8pjk9Cy2Z626BTiD8VtA
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 01 Jun 2023 15:48:36 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELKKIFy3wZE8xTMwCNTZdUg&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame 6064
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESECpzjxSNnQcTYtuAsBZ9BII&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESECpzjxSNnQcTYtuAsBZ9BII%26google_cver%3D1

43 B
1 KB

356ms
35ms

Image
image/gif

37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESECpzjxSNnQcTYtuAsBZ9BII%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNzEWhCKmKjKAhj-vNjrATAB&v=APEucNWmx0ls-IgYbFIZk7458BdIfJELmvBgv-qL18n4o_klHsOq2upGbmivmkpTx2vtT3UFdIkJEBaMY0ktuvni7Gzd1Nc9Q5hWPFlR1pynccqT_0La3JZWwkrzQMpX_M8rkFbQ0e2YrInHCGhGbDwQHQ3Vj6XPadQf7hWmYEW7emIJSAkFZOhpnvGDCexEYpybkdXCDa2hcT8pjk9Cy2Z626BTiD8VtA

Protocol

HTTP/1.1

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.2 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 01 Jun 2023 15:48:36 GMT
AN-X-Request-Uuid: dc574cf2-588a-4686-b2f6-29f8e4cea463
Server: nginx/1.23.2
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 185.213.155.146; 185.213.155.146; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 01 Jun 2023 15:48:35 GMT
AN-X-Request-Uuid: 98cad97d-b9fa-48e8-be81-162c7256322b
Server: nginx/1.23.2
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESECpzjxSNnQcTYtuAsBZ9BII%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 185.213.155.146; 185.213.155.146; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6064
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTU1ODAzMDIwMjM1NTMxMjUxMA%3D%3D

170 B
188 B

54ms
51ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTU1ODAzMDIwMjM1NTMxMjUxMA%3D%3D

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 01 Jun 2023 15:48:36 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 185.213.155.146; 185.213.155.146; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 2ed44618-8b01-45b5-9edc-2835fc77ac54
Server: nginx/1.23.2
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTU1ODAzMDIwMjM1NTMxMjUxMA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 ea8IacM9Wef3EJPWRrHjgE4B6CnlZxHVBg3etBD7TA.woff2
fonts.gstatic.com/s/googlesansdisplay/v21/ Frame 93D5 21 KB
21 KB 427ms
37ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesansdisplay/v21/ea8IacM9Wef3EJPWRrHjgE4B6CnlZxHVBg3etBD7TA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92a7f8224a1ba2ccfa92d3e1fc55ee5aa7ae20a0fcd80d3331bd660878a090f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 27 May 2023 21:26:50 GMT
x-content-type-options: nosniff
age: 411705
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21428
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:32:46 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 26 May 2024 21:26:50 GMT

GET
H2 200 ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2
fonts.gstatic.com/s/googlesansdisplay/v21/ Frame 93D5 20 KB
20 KB 454ms
66ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesansdisplay/v21/ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

acc5497e76f832d950d14fcfa047dc3c864f7a0aae4c7a20521c0c655a53033b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 27 May 2023 16:40:42 GMT
x-content-type-options: nosniff
age: 428873
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20784
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:21:31 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 26 May 2024 16:40:42 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 04AB 0
20 B 81ms
80ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6169885290492&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 04AB 0
20 B 80ms
80ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6169885290492&version=m202301230201&ct=76&x=1&cor=16339457621137353000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 04AB 90 KB
36 KB 106ms
106ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ACZ9bG-aLTnZWf6qxMp7KZ3-eXqHDeNrb6zo3d86sI_osqyA2wyQxVcuuarsliXgJ3Z3fKgKrm8sLB6LWdsUUgZGX2w08Kwm6vpxYZ4MThLEFGlYrOJig476-8pOkZPHJoXLmZuQcoCwwTzh4gIhxcFkkXvoa-o4bu5oF2GZ-dDYREzz0&dbm_d=AKAmf-ALRk73CYMrC2xtdSNIetkTA3Zw6RVkYxU2OaVnpHqCB52M4dS6B81XxM6A2NEBLWZPY8HgLESSRQsBhuNNfVkXxvlCg7Wd1nteCnFzR3uQQjnIXJS07-Yb62G9hYstVI8T74RGfe2IAVovD_9fyf00dsJq2b0rmT3qAHctUCoVHjVQXD9XbtvGD88ymLKBDmacUPJexpuRO66p7Ug-8rT0CTjBi1jwxAzwRZLf3SvJzmQebcHgBF07xsUa4OXRrc7l_FV1oQCA9zCy0cJ2oo10g1nJIZQAdfiIsqhOVJ3O5sTGK4V_5fnrleCcPkY1JyD3g5PHxJsNkZ3PX1b1xuNL97mrVuzm5I1hHjQOCngPf9r7rbCpC9NPjD_qgmmzKYi0nYZUfZxuKQ15UoeOEsmkr6p7QaI51mv5EnE5Qtll35pCBAPv5V6Ei5u8mgqXXXMVKlb5JfADU92A7eHfZQIr0WJ8YBQ2zJTlJJ196yIxw9z-JMjm0Tqr9_8XrT2RK9WsLIq23vabGZlEbe2S6Wg6R5oytpmIdZP_qc7-8CPBviT8EAK7CuQ3HZayjVHzycgTB6jZ03uKQE6gUSR2m0bpVUXehE-1RYc3TfYhLmg5rC7kf9--ZBWCg3xUQChCRWN_ubqz7nednQgmLGW-cLP7iLRfdrZYQUHTUwVuzT5JIdtqq0fJnhw9fo7DYywgeVsBoIrLjC7hDMd4blxQ1rwW6h1wPXyAbGnEy9fLKu4oARg4Oa2bgFCTGsZ8PtO1WpuzsEzbmtGsbGWiWPCQ5WSoBehrwBPziS-Flh6ncJuI_n33XIgP6ebxIDW4WxPk9ce7L5eJxOHMYHlkBFfDnknypeIKzRiZ_hi6Ft8n15WOo1ibhx7giWPdZoC_HK51FIccD7AqvQ9vO4jvIs4MJb5LnLJ5Y_i7zGj-IJLS21jJr5Rg80VgX21vUph1j1lQ0sgPHqDKiYSPAqFfLCjvVWTsdoLUsDWqMOMQN8A2jsz0s9g9gMQ4Ec3wWHf9jEsAD9JiMdY146Sbfv24lR8a75kPPyM01GLoJczIxjv1xwG8dIbb87UCHs3_HBqsKfd2WX1bfTDbNlLq4NKOy8FBsWes-1i1BcrjTEWjOdAQtr7u6wtMk0ct6YO4G5fANoPvMT39qjAOeR6p_fXsJbyJwWVZhnl0ZBv76553n7NioBgJY3JdScRUzic9vQdcOcy0A9lSZhgF_t03XffZkg_D4sjoKXQtoK-Vt29r5Z1iAW3k6PJqJqu4yEcLm9SwcvKGqLZRoHhhKUyae5TjfdhSlHj5OsAoOQGDVuAMiM5lyDqwBkmeTQmTn4j-xWn3ZeCLfh2maAdxTxSSoFU3Cqlc93qll2_mmXlwUW83YPgZN1PpFeGvEBnL-SbSYRqn0tqdVmkMHvsDzT5v-HIEJhl5ne_8lh3IJrDCP5IRN9k4Qlmsr3P5PFl0GYhgEQSB_oYQtRnezILD5c-iyxJKI8PlYk2bHsaLk8ywv47D4DyQbB_hzSUKm6cepGt-oA1I4aAVWQM4GnmK6hCpqxi2eg_uzeqondUoRIWASGarN6mcry5VxKOxc1a8VjLIuojL66IgbqEGkq8aC_N_utEHLw60NuEvKKEmtlYDSeYpd0c8jGZpx8743ce8pGe7v7pA_2cvqdoBBgm4LBuoEWLUMYM1cUusX4l7T4p5TdyfOQT9dMAEE6BsIWhHZZOA_YTrnODt6k695lixCwRQlGG21xM4y6wioCOVWf4csSI1dCqe7GaH5kz9lJxJKXTTAlbe0wnqmYQO78kjG7B3a0oP1p-wyCTCvn9kNY8KYoIxSLHpXNc7vFLGnCPjcb8SEWquoCOcnz2x4MEKaeZ5URLNgV5xpxSI_A4yzf7XHKRccXZcFVbNocIscqsyoB9Vblo0z7LlKHAjTYSXtpBchNh_qUjZSxq9vb3WIuzUjv5f7KWjcH0B5AIRWIlTogjigm38Q5JwAxPdDT0VfBziRql_zIVPofSW-bicR89iyj_tjogLJh2diXYJYXuyKalxLTL3lGWj1heezj5VN8fswhES-hJemMFy2p6iyYZFCr6PbaqP4iHoWk33Oli6ipN3Ro_6c5t47RvqfZgDvUk1KQlH1iFJsZhjsovKxlPgJU5oCORnziW8SwCKE-JCVYEbPiyrJ8yAGTa0BXasCZEWgwaShgalivd7F6ULfzHoe365Nh_vKJLsKWx8nc3qSj2jzj-bDD5n2htGTH09ab5ySGS7xsNMowuPIXlCnjiSSxaxPn4mYUGVaUHhBUZ7anwcF2MvH9pybyLbaPEG9XqIGK0MCa0IThY8eumtaV1i9SCv2Cbk7lUeFTrCrdtpo0LizTyNjGQvy8gznqHnfZtC8dMIZKyPGeKtRIKwWqjiVF1taXwjQDbOBQtepkS_1VSdfUol3si4fH3Ia6SZWaXDSFZ2IBsUmXB5dPamT5fCpssgx3397keQ5xJkU3NsLDLLUIAgq5dsnm6koUkzWUW06iHMUpNtfTTkZQ8-QSIkEp1qN2itHJXPTxbsL0rbdVU0J9rrgPx1D9DRIo9rfT-4P3n_hlokaUQdyintJ6ZGk4Z0dIxKdOhV8xMqLMjp-j8XyTL-st9fQ2woyEmM8SsBd70k-Jkxr8l0pf4H6lXLpHmHGvqq43VvURGf-UPNPZ_Xc3hS1XLFEwnA10LimkPDwPI-7e11R4t6UiXJQG3FhCi6Ma2YFfNC40GQNWtCMBrK6i6Fmv5co7JC2OhvZxd9vqpDeC_hnIhyX_P8hxjAd0rkQmtsoS7t_VKEdMu5qRXZYkm-0tzRVrgcyVpjnIps3gRwe0CBk2Ra0SUUwzueAhxodM2V4vNw9CU4fLTjEphD0vFCo0xYf5PTWdW9gJbawG4dayCax1UcIlp2Tq9jvwiiUm0aWuPaPXfPSBoTHzvFtwB2MaCUSrtSzU8b30fTEVoeKpYtuxPFGNGyt47h06QsK7hCpJ_fdj8Qap-LG5l_ZpCzrrCaZHGEmL9YWZPQ52h0sE4iAtoVKImWa9wHbB4PtKEojSw4hsDgPIUpAN6Wk_hgfMkGAKTpiO5WnsAvh9sNSODWrGmsbCI1-KcsrO0pfau_nBWzvDdgfrdGRg-6RdnQ_3PpJAkyKQQhVqQICQc0Bvuk5OP4CmWhLd7RmNlx8ITUWFSAR5e0bp1jykApF6WqHxDj-1qg1LqV5pSyKv42YPzdiIZsIlTiW4ZvkflCqRHz_OVnzYfI3VXeVEGsTNT8dyjvzBuWIF2ts-lptHGuHozvxvbXlBU_DP5awQZSfmKBP10Idr9QZ7mBlv6CxvWH65sTJHDeaMRD9NTUpcZyTq_XjiZYPgj-FhwM3H_W8OBOMCsIEzKbhzfGSIOTmd3eBhhYb9WOnx4e4fi-l97cuuNm1nMnfStjxmUB_OyuHFm3TsSVrD_fXddPf8bUn-EQf2hafjKMPXhqLiGwMcrEpTzAqPnPQ4C4eNg1vKcXDxAYXGiIduYHoTONK27ZQk2K8FqPgIp11UT5ymojd8OOIRbWyncNhvyjY2PK0phmTRDsgxhlcPMbTPgwuMOGi6zPX4EtlNbfFlH6&cid=CAQSKQBygQiD1eBBEsspmuVyIE65WOOfgo7E-pnyRRDVtJYA7i6rT2RbQiwfGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=16339457621137353000&adk=2086295851&idt=246&cac=0&dtd=8

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c6f3012fc20ef7126ef5b4f7d3c57445fa4ab1295acf831addef27dad552f160

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1685634513&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513703&bpp=6&bdt=1266&idt=6&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=8&uci=a!8&fsb=1&xpc=d1Z757MIFV&p=https%3A//www.farfeshplus.online&dtd=11
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37114
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9E03 0
20 B 72ms
72ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=4898934514022&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9E03 0
20 B 72ms
72ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=4898934514022&version=m202301230201&ct=76&x=1&cor=6941547220702214000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 9E03 99 KB
38 KB 87ms
87ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Ba-g1JELTGwZIMs6G7K-3CE_ND6MWT0y4d5Npq0Ka3n1Ti8yfJlq3zW2aIzH78IZPURsceZVZWyLjnyybYLVwz7sDCdmovTWXtAQiESy7ctanqw8CYeClz77BubUR1tV-yinpG7xdwrlCqECI71zPn5vxE-_tplWxxYTPwqWxTh2_skDg&dbm_d=AKAmf-BlC3nDmTfTPT9V3iIvBuThez3j3Ia0YlMYGjpMKrQ11cEKmFsCsc9YmHU0RyjEK-tJMe01ofSPaNmnaVqEhfh43Yn2D-_kjPBs_2n3PfoxT9uQmXiAfgoTnJyoKJKVP3d4FTCdrRFfiZyK5kx6Sz-t719zBubwl6_l16GVJeEnt0EJFnRRqj2jGt2fIA1b504qjgHbWYKo7_74-fagB3o0WFnwlLFtaWPUefdeYv-lcEDs4ve-aLiOPq3GZLkbwCDYHC6TF3qgcbIo-hNe1sRXtzaKZ2zwXwTz-mV149Bgs-byJf192-FhUCH91Fyq6TJNEBDiK3Kkt2VuNy3N5LfVPVDp083ZZOhRMQRPdQgiLWE6HgdD0oFrc7Sn165Rz8UjAwrn41hhdfeKXXBFXxVu59u3a8mfdYo86kQ0BYyAdQkiuD5tx7K9Tutj47Uc80g-VgH9ieNx_xbmXnG7GgktunGO3nGgqPEFzCDW4fNufAM191KvVyoYVmN5-CDCz-1Tq6rXSaz3HAEn3_cqCpB6I-gVyaili5ba4FsrK1ilw8xXH_0FVsQ7Fsa8nukK9gQGxIdcev96W9AGijh93JuhvGv1u8Ef9-wRMJ3o_lJ5uOXYbIwZeHWq-17KByYSVHjz924ehEk3EHjoe7-cfgGt_E7sbgiT3K11twAOTxh3jXnUhGaGlzFs1uI3qUiImUk-qEW-2QPEJGkm_0mydUZdW2g-gx57ZoWvmsqk_7ZZZbhb_EJlzt2unVUO-dhJaWDMVoT4-gCk-cjAP29rp3Cr5cdT_xOzFBvramERbEXQsfdN2qya1w4k1QpOR0CjPoRVUy0gv88mMoY3vbWc4KjDkcUTUC0E9w4UXs9fkfyISevaxCU4jR7MF_kUvhBC0x51C0dlcZCrVas9lqv83Kc2CycAeRtTQnDCCjCMO2L9X4AtrXXCFg-wK_iQ4X9lcfNRB00FlHxXpivwUQ7C_Z0mFlyLYaL0lZn9_f4WFM-HrOW7yCfPWRG1MrWUTS-OUyv2flan5IfC5d9FhhKHpEb4Cd2T2AwXs2HDbCAJEUCs4kk2Ua5fuCIzB8y0o4QvqK_QZF5Xzl4d9cSzV2NB_8eiiBeJVXCbc-GQCLGI_vIlGW5b5SIVD0L7A4A88GJnZExQqzNnNXDbD5sOCyWk3ijNSzrqQV9ipUziOLd57DmpDY1MFK5eCApDIuUg1rUDOa4BvWFxgDeCKtRXYKB1GjsEAFmazY28a7WSu89b7fbL0ghgI0fEaE-GkLX4dQX2xHNbnXPNsfGAhgrDdYIc57Y-QzlHH68lgl5O1l-SYiRO4MK7iSVpT04dyIadbMOnpQVb6Jqa77gvwsee4NvwWR2nRDxchu9y4WFVY_hwhBVj7w0iiE86neQ0b7I8XALhSzICdY800uHJHLHsY8VPW9ggp8gAOs7fj-mD8eaDD3MOCUwPbZGse1b4bhTNE6ceMAq65Jk9FPmydtGCeuG-nCvvclfzfLd-O43ii1NhRC3U9g5cYxE0c7bCPWSM7mtIVKJDd1hYA2pXF0aRAJLTIhcaTx3-AZzN5ysIrrwMvsomBmTMT2UsByqOcjVfaaP_2cpNnXwNcY54s80pfMJXV91RgWo9bkDZetiuJa23KG04LU5w2P5v796ZBN4SmpmdMuZTEqSS7GEq64kURimD_sZP_dcrF88Qx2YT2Uy8KraugNW936tftsDNbKPnifQ_meb8b7xNbYsgDa0pq6VYu1Ny8BzPGSMLO0P3v4qXoh-xqpbIw1maov29n9HWZXS42VR74PAx89qlhB1qn1WtOuwkQR9w0MpYaLw5L_Fqw0IYQwMmUu4Ox2yI4LcbTjJfcsYQXi52v9LO-yNvx7f53fKXj3WlB_3WmrgFA-Mq5YXYRXn06eYJrkGZYYk7z43I8WTDZC5ib2PYQiMLL3k8W6wWW7dIFHQqTm8XZx5imCvWj3hdGfh6CKG0R7iqmOlubu6erZIZ40VBbtmZ6WDUSRu0gpOdLQ9imy5HUlTcnM6RnP9Sivji3ogPDvBQ6RIzHJjvYPIg6EUVLE_LQ0R2lZDqtmt9ZopPAUlsjUZHwp12azhcSiRxJgarLTHV_MfPoanj3Ud93NiNq3v7yFLsgAW45dprfEfw8WZMdtUnP8XyYHncM62dS-_bInept83BbmCR_govEiicBTxt81HYhlXDrZbT1lRMybitErKmwhcIzbDGjbRs8B_vLB1qRMoXbYe-ncGu_VLKwdLZ8pkDPFUPsCBmJddt8KxhlVsnBf7-WeMkrfijZ7q4nCRmy7IFUMMLcbi17dGWmLuBJr8u8rhCHdMC2KZRIOUpRO7QYjvaAiD6tmiel_Iym-m5tMK-v6Bkd2iiNvCJhid-j-rn3Cif_iB6s7uI4R-KeycNhBG-T0_yvO8u8HNqtNqjwW64FHQeGsOCOBlDYc6Y82lxLEdIlDWDfSmZZ7PhXuRTneC8DTZ56wUzzPTPfkh-aW6F-DlG9VJ32lKiLelu7e6Ai42VTTin72Osbh6lil0kHfGqrG3-Cc5xGlgCfURU35gDZASuWR7-A3Rjbxv8LGlOMPD9GWKy6At30TP-iw_sRCxsfTa-csfdeSMgNC-75-QHC2wRkfleRGHoCarL_rn1a2owbSqyv-UG_HwaaOcfn_VszWjCH6gs364xRDhblbpk9wz0RNPGc-KAlwjk75l2b3UrOzWQdYoFkE31VBeRzxrsLQgq4B8Xx8McfSNSxq4sLRlr31Ec84Q4RrqF2NMjlw1eRzcmVB1DkswI0bOUdmHAr90sfdwcHGfb7KH4HmdYBC1sShNp921_s5bY-n-ahEdEgpPvoBZEuoKEElZgjOdJCmYF4uNWxkkk8STbJ1gq9iKwlaDKhOegCepeTy_6diWG25eRAuSEgnkRNnPFpfgWEBNv7aUfE5r2ZJi5eYSwyTxGQLzOrbz28Z1r0hyxzy2PGYpDluJbEFIEz1cBDyxvIqTfU68NbVUn2n8UXEBiZc5Ow-348i-TCz7SqVu_ykrvJ-qVy_QrFjLj1IGJCjmI6mbDu7X2NDyl9TTrOUWxNX9zDggp3X1VCA2MvtN1UA40I1S7QRuBpa6z9af_ti3j_T-dw7uaqFrMzKiMbks8tmpREau8bmftIlxLN3a2IV_YlZzajV4UtidrZCQ-IxNGAUAal7aR3-Gz0y98zVNKPsz987a0awMCo2HBnh7Gi2y6wDLSwYe81pzPAEtOGTUb9n7RXc146ei5mBmakHedYn4ZzYUoQXz2lGbgDmJa7eU5XOMe_geNBJCEdU1KZNdiFYKD3eXIcJEZVSS0kAAW2LXD-qCwkVoyP05YxpwdC1gWqTscFF4b04bZAUf4feByJyHIKFeaJbxMKzJT9QHeKtygYIQWyL7GwgmCwLptLgBGuOBvjCbdowoFZJ-Ejr74UMh3jOSR8eYY_HJRcwhHNY6PaX70Y0rdGhsQtq99vvn6YsOeaJKU8igHkV-JTCjB-hmG9yfJIPGy_iGXwIZtPp8M3fccCt3gbDiDseTH7sLklzqpJ_eDr4gPU294xQco8vcHDN4&cid=CAQSOwBygQiDsgHVasdLGwhjKMCBe2nDabZ2MmH8IL0SW-g7FhDHsIrIDonpksmWKhZgL-hdeChmMROOI-ATGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=6941547220702214000&adk=4188270525&idt=212&cac=0&dtd=3

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

195a25e2ece97bd4119cb372c3717784feb5aa66e4aa103f0bc6d8345ef423c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=250&slotname=6076681977&adk=2278793534&adf=954853469&pi=t.ma~as.6076681977&w=300&lmt=1685634514&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634514187&bpp=2&bdt=1749&idt=2&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D76ab65cad0aa0eff%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_Ma0_IwpMBOi7nj9-q6otQoNKDc7Aw&gpic=UID%3D00000c3a8e3515fd%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_MZpfKIRVVeVVB8cjAISCX5v7pmlrA&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280%2C300x250&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=569&ady=4690&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=51&uci=a!1f&btvi=5&fsb=1&xpc=iUalWkZx01&p=https%3A//www.farfeshplus.online&dtd=5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39053
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8AD6 0
20 B 71ms
70ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=9600816059473&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8AD6 0
20 B 70ms
70ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=9600816059473&version=m202301230201&ct=76&x=1&cor=10833528017972093000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 8AD6 73 KB
34 KB 69ms
69ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BjISqUVEz3oYzjrbR0edcAmLnhHoPE9fZB_JSSq4W3T_aj8nHWS40swVDbnYc6oL_Eur33cXPDIw-tIGLaSc8ock0VCw&cry=1&dbm_d=AKAmf-DMe2QtLlYirDcfZYcUPjv33o9MOKsOAu0aQiKF8glkMjOgbTmAxqvJz0lru4Arbcna4mTGMKKPMDJNB0rff2NNbNkuat9YWfNji9b-XLq548TBmkWNBA5yHvdCl1pntAVqPsT5kB4QuSKPVj5rir-KTMw75OQdO6QO46_UmE4Aqpi1BpZs_65ltwJya90qADKXapvyESYe6N-WoeQILyBMjCp0BQTTQ-p-hSlnvW6L9nQNJAc6ydEomByiwpJE4YkkpAdU3MjH_2sa0hv5Lh8TWoDeguGOFhuz1TzuydKzyMSYIMr_2yKgcixskD75kOHgvRu8OJJkexQ295eKNM2dWiQyqujBbn7Cgsn6gDhEMqXDv_Au336y7ZRd0ewcK1ddRDI72KnvxFs4xE6iQZv9TtZx-6ivB3R9RKieOiIJubDOiKIxHtcZT2y_SRKL2DveTZ8Krw3z_7g6-HX0kUd9kGe4kDM-4iRLpM5pm9lpBBfxUrdM5kZ9FJ5dXnCD_Bi4WBrOBQfU67UpeCEW08vXlB0P6KVUSaFScTugZdMyyIiWnNXR507SmD-tVV6yTDVzMy1t2cJpUG0pvWbLsWdxAHa-ga6D2Y85orQGY9MEJG22bABOifxb8cxENNJuuyrh0whblflS_b5Kj_6UX3JK8Oz3ubgr6N6N-QJ_2_wKV50iHwwxN09dmndep7UvCB5Hc2QuoHEDud5lYKpi0NFbJ5loj0ToeWJHg8WVc2aqlKpWarYicdRP1lrdMugusknyCOOm1UKP6YMCl2Xnw2CDARcyOsBNeooAyZiXkLcu4SQnDdI_cvrPjoglY8mgz9s55yUR8RTt3pgmvJY3jhRgTG-NYov5P4RfW4H-pNX_LbSh4XqopdzjXsCwPo2U7FZFyllb5u_0skwUlH9YDW5CXI8T9U3LkVuMj7QIEMsYdFB52tz75E6CMzPT6qBTvBerTCKlMGdjZpJ7NRrOz80-B0WVLFlGintRhILCewwlX2X2Jayb8grUE__a9c8F0woMTULWPPfc5eS0vPGj8UPpIsHEBvBYfdeM9wXh0CkgY1qzr1k93c6ZhPjTEQpzdbYK-2lLAnO8pBrZXoV2v7anVuDzsDPIl1TiYAR9G1j_8ey1npmh1O7V0ZcrBemodWJgTPntFlnfNl2IB-_oIsXrhSGwLNWNTztzxglPUlOP1Xz52nwP9_VPKYcbSIG6FlT-9eAmE8XQjgGQRbv5fotRuBqWoDg0C7fDzlLdOd1Dq2Pod2VOplG7N7HuoJpYrGkXEto0Br7zyzETJtgjUupPnNNnlbj9ygVjSiPHxL7P58ePWwOGaZm1K1nukdKPGAXt2Nt_pVo6rLwQzPAQbVFSAS3rF-YkK4S-PoK5ksvT_bztIN90xoBHsbWMcIihXWp1i33Xg7lqF8QV8no7CE-9BFciSwALvH_WzwJqabp9y78hP1xxeqsTu_3Ppnkjovt9vvwhkPPtMx3sABqiPnQPxQw7reJYGxXPizs4Xj9CBaAYO01M38F6zRYhmv62EO3GB93HUkMdHxTR7Ix6So_2IWd4Bmmk2Ydf1ObZafEMtmQRiPmSLp8_ZVuABOoYk2InMIChwgJwemwH_mu4tPjxT1QcpfjxIZXqEsvIUfNC7kYW63G1L9CjjonoTjdyHBzcKQhmYpKA2tRBaeLXfD8RGGUzEP4UEfp8QWFrqQpGJn-4VCNWGCkpORIDLFwVaN18bexrJXmKdnzC106MFHkUDv8IG6QPZ4eSM6glGzlClvwNhBIdiXo0kMcX6sYwQ3aJaRrPAxOa_GhyE_aMuOk13Zh3CllCxQI7jtmIUw3WmbsdyYRvG37jf-usl4So2aINDMCq5h2jnwXTiTPKA2MXVDJK_KaMhFcn69xZQEAkRxG0I-HHWUqVqNybhMhGPka8VGjqCv8zrNZdDo2LnnZCTw6hKAdi6tu25nX-OGqTNk7G9k74j32a0B_OkcgkWOdHi5wSSqKWpEZ0ex7lp9NUTM88822WFNemVLHdP8qbUhciRvLTyzbIDJJJXH3HscWAGv-QpW7Ahfz77CBEik3d6kro3qpFKemJFVyqQ69FUzQWTGlVr5yTSIOuLfT7R5ZE8uWtj4QxqwjG5xlhYFEXYKPnfaDFduXV2AON-hm04a_3cZJO9Ngflf7LHOJ0Sxt-YKdUoiz-6GR5GTHSgKuvHSKHjHT7sf1lpjl0fk7PHBZ8kxBUNkorNuDFfdzZZ3DT9qS6qztCRgbYFzt8jBDTM5R9ZeHfqeK1zeaPPvq1aOm44PGwu7KRWXFC_vKLXZOfAHkSjHBl-h2OjqYuCKOhJsiKHDMoMEF8dsHOukvL1qhcYYXPZcpTFwtf-DW4h83q7fcYPN-ZEzd_WH9BKruHUtibuBnEWXoq68xzxmhk5bZxSsMVGKACbGZ2PhXivVvyOEEwVQbLrYjBULnt2V3Ay661m4CY4D_rB-W84O27Y_DL_SSgXoPIckYSaRlfjxJBdiACpZFiitqDEr6IuWqi3cmrohhD6Bv_7tku6FNs9nrqyHfCKbtLDyfq00302x0-dxHWBZ4BYXwwQ1g8GoWmTF5w-aNysknNGjc0I1OwDpaUTkv-Y-4GYhmB0MrIBnZGnj9PtFh2tqKwUGuXZUNOs3_HyXaUOON8K-dm3T_93ym_9IXmVX4ksgirdao1C9--Wm1Y_I10q5qhXeBFKUppJWLwzmd8l8GcvaFoDFbZ168D6HCrCWsMWOwMdNesYfFb1W6CvIadgxOO6eCqzi83KyODNytwEntvh_V8wE3TXblFumRp8JdK5CqOrIzIio-MezWCbacIfrOckup8VRtQMOS9fhvTTDAukGaDMwGnjdaf3bmgZvJS4Gs2PgdlCAr5trm3QGFXWjYEuIC2TsPjxvuKKfRUUVhgCrn5hXbnrnsrdWou3GK7yCQt4FqBkTQLbwaWe9syeU0Wmc0COjiXrqPwbd1xTUKzAg-ANYmIO4QHg4yy7NS64fQ0o4qgvRBsnOXC3giPyMnWTuUStr0Sy6e7R96KeEeo-VYY96AQWQgHQdykUjr5QCx00dMkNyLtCDBV8LjuPc90O6X56LTGRIXcls-KZUKLj5v8O83mGEVzzCN0McFvb7BipWhyKNBbpfMrkgi3tBF-7vd6I0j-sh_ZJM5YdIqTafQ1XysIxo0nIolRqYKAwQkxJdvULfUjtR-6jqB0y4gc_G6ArI02mEWl7pXeU2HGPpukMjEdj-02PTh1AgbAPuiKrUVOBeaDFeqBFKMjQxUaV_mJCmtPSZkh10CRsPPjnJpRnafpW2SHC2f5Df9g2-qwFnTlTxCf_7MIk-MSKwjv9x--OcotOoE_JBHTOj-e39EIZn3xIGLv6oT5GS8-gFMjjuP4b4NEXS9vSd8lUnneYPTkB20dNhZ41X_rGhpVSBUziZh1JdBlabfkEcgnFsCojtUFpO5sOnjTl_8itXnrm4bxZSridmY9P61lmMu9-wq8YYufcQKY7mo&cid=CAQSOwBygQiDIssFOIk4-Fuonty4sjxuFK0ZPNPvXTkR5QIacxNi7MEv16s2kzWYiTgPjvWqPDeavT6kFRHQGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=10833528017972093000&adk=2265872549&idt=144&cac=0&dtd=3

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

142b668d35bd78ba37d42135b37580451691d5c36d8120063781d386e55c1fd0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35111
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame C6E3 640 B
262 B 116ms
81ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDkyTkY-O_NxQEwAQ&v=APEucNWe4ZE2IO-89hNkA1eJC9fros9wfu4l7Ou8qIzQIIyT5lPETuPcCMvERpCZinF55vhKPQN4xIM9P7ejuo1nbO0V-BFd1qS8CHRqOfAMeEbME8c31WOxK9ro16IvVyx3jnI5H-KHEFrQd2CKc5DaPUDOS9BkjT4NOsvJafZib6Nhi3xXrcM

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=250&slotname=2097210043&adk=239546933&adf=744370384&pi=t.ma~as.2097210043&w=300&lmt=1685634514&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634514177&bpp=3&bdt=1740&idt=3&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D76ab65cad0aa0eff%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_Ma0_IwpMBOi7nj9-q6otQoNKDc7Aw&gpic=UID%3D00000c3a8e3515fd%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_MZpfKIRVVeVVB8cjAISCX5v7pmlrA&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=569&ady=3955&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=50&uci=a!1e&btvi=4&fsb=1&xpc=PCTYuyO1NN&p=https%3A//www.farfeshplus.online&dtd=7
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 01 Jun 2023 15:48:35 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame EE28 6 KB
3 KB 70ms
38ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305250101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.farfeshplus.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 01 Jun 2023 15:48:33 GMT
expires: Fri, 31 May 2024 15:48:33 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
481 B 19ms
17ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://live.demand.supply/e/e.js?gl=0.01&b=3&r=farfeshplus.online_fluid_lb_farfesh728x90&sy=6f087f81-a489-4b17-ab6f-f5e2ef760944&ts=72&cd=2&mlbr=ch&mlos=wi&mlla=en&mlco=us&mldo=www.farfeshplus.online&mlre=undefined&mlin=0&mlsi=760x100&mlbw=4g&mlcs=NaN&mltp=90ca8619-0775-4d76-959c-f93104339976&e=lm&dsReferer=ZmFyZmVzaHBsdXMub25saW5lL0ZQNjQuYXNw
Requested by: Host: live.demand.supply
URL: https://live.demand.supply/impl.v16.11.0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

x-nf-request-id: 01H0G4HP91HMRD74KJFXGZPWNV
date: Thu, 01 Jun 2023 15:48:35 GMT
cf-cache-status: HIT
age: 41555
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "847d6f45a54b1a346481710a0a6f4147-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 7d089a0988c31b35-FRA

GET
H3 200 387912947439462052
tpc.googlesyndication.com/gpa_images/simgad/ Frame FDCC 64 KB
64 KB 41ms
39ms Image
image/jpeg 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/gpa_images/simgad/387912947439462052

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=1738279810&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1685634513&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513553&bpp=15&bdt=1116&idt=15&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600&nras=1&correlator=7472659638016&frm=20&pv=2&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=121&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=h6AcjFpLLX&p=https%3A//www.farfeshplus.online&dtd=26

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0941eb45a475433b004b21d09089c2803182f2d31991d60f3faa37311bd382c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 27 May 2023 15:26:07 GMT
x-content-type-options: nosniff
age: 433348
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65528
x-xss-protection: 0
last-modified: Sun, 30 Apr 2023 22:38:07 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 26 May 2024 15:26:07 GMT

GET
H3 200 301155047518184305
tpc.googlesyndication.com/gpa_images/simgad/ Frame FDCC 89 KB
89 KB 77ms
76ms Image
image/jpeg 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/gpa_images/simgad/301155047518184305

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=1738279810&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1685634513&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513553&bpp=15&bdt=1116&idt=15&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600&nras=1&correlator=7472659638016&frm=20&pv=2&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=121&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=h6AcjFpLLX&p=https%3A//www.farfeshplus.online&dtd=26

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

68eaf8ac60d0942a6bcee0b4538d7d50ebe41bd26e332550d05d8b9d37fa16e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Fri, 26 May 2023 21:14:15 GMT
x-content-type-options: nosniff
age: 498860
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 91035
x-xss-protection: 0
last-modified: Sun, 30 Apr 2023 21:37:01 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 25 May 2024 21:14:15 GMT

GET
H3 200 7617230549739558705
tpc.googlesyndication.com/gpa_images/simgad/ Frame FDCC 82 KB
82 KB 85ms
83ms Image
image/jpeg 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/gpa_images/simgad/7617230549739558705

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=1738279810&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1685634513&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513553&bpp=15&bdt=1116&idt=15&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600&nras=1&correlator=7472659638016&frm=20&pv=2&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=121&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=h6AcjFpLLX&p=https%3A//www.farfeshplus.online&dtd=26

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aee0691c1e66565ade6bc5004cba455f209b8999411b3887f45281fdd270a7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 29 May 2023 19:34:16 GMT
x-content-type-options: nosniff
age: 245659
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 84076
x-xss-protection: 0
last-modified: Sun, 30 Apr 2023 21:16:52 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 28 May 2024 19:34:16 GMT

GET
H3 200 13424012955953102693
tpc.googlesyndication.com/gpa_images/simgad/ Frame FDCC 76 KB
76 KB 54ms
53ms Image
image/jpeg 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/gpa_images/simgad/13424012955953102693

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=1738279810&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1685634513&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513553&bpp=15&bdt=1116&idt=15&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600&nras=1&correlator=7472659638016&frm=20&pv=2&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=121&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=h6AcjFpLLX&p=https%3A//www.farfeshplus.online&dtd=26

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8dbee482f4cd458aa85600537ae0bdf16742d2bb655219f5e4cc7d3dc47f2011

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sun, 28 May 2023 08:12:26 GMT
x-content-type-options: nosniff
age: 372969
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 78260
x-xss-protection: 0
last-modified: Fri, 12 May 2023 07:45:54 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 27 May 2024 08:12:26 GMT

GET
H3

200

624907996767536446
tpc.googlesyndication.com/simgad/ Frame FDCC
Redirect Chain

https://tpc.googlesyndication.com/pageadimg/imgad?id=CICAgKDr3ZqF_gEQgAgYgAgyCFFyRh2Ouq9r
https://tpc.googlesyndication.com/simgad/624907996767536446

8 KB
8 KB

38ms
37ms

Image
image/png

2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/624907996767536446

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=1738279810&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1685634513&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513553&bpp=15&bdt=1116&idt=15&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600&nras=1&correlator=7472659638016&frm=20&pv=2&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=121&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=h6AcjFpLLX&p=https%3A//www.farfeshplus.online&dtd=26

Protocol

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

484ec1c347c17d7d3b98d5058aa5d90bb5c7315f3a67f44611e902de4be50831

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 27 May 2023 20:07:59 GMT
x-content-type-options: nosniff
age: 416436
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8502
x-xss-protection: 0
last-modified: Tue, 09 Apr 2019 09:00:52 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 26 May 2024 20:07:59 GMT

Redirect headers

date: Thu, 01 Jun 2023 04:42:35 GMT
x-content-type-options: nosniff
server: cafe
age: 39960
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://tpc.googlesyndication.com/simgad/624907996767536446
content-type: text/html; charset=UTF-8
cache-control: public, max-age=2592000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 01 Jul 2023 04:42:35 GMT

GET
H2 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame C902 172 KB
61 KB 331ms
40ms Script
text/javascript 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 10:17:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19873
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 02 Jun 2023 10:17:22 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/ Frame C902 11 KB
4 KB 35ms
35ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CWL87SnAWBTlPsZchEPccufnBE07ziJv1NKjaAxR7t8AMxfthEtaFOSWuPpjQi986pLAw-8FlEJ9JphgSqRSa4tVpsDq2xA1rKpVQCMNexM9yOAGmAzBviGVxeZuaI4vnfxeFtQR9JsbVkDdjwftpvPlk7Or99Vz2MjoJ95tfJfRk9YrQ&dbm_d=AKAmf-AuJ7-ZjSI8YzQPwA2ZPgV7GKoqHVEJi0L29aoFEVWWUVuAXlOlV_32LM2Xofd7UmyaHX8RcyxkhVK5MOr6Q1iDIADc8iiOWYfAbUrrDyTyIZJEy92Tbx2cVQ7FWd_nfwYRcs1prz_qcsygVCmjEkGjarGDBfn90phKqp3eiJcl25oUAJLbR_awj74fKtGhBxrzcf2AvUA8juiSdA3nYd5AvUBgtq6YsJdEd20HYz5SRKVkBjXaI4M6vMQjsfFbFxkJtKjKa6chOx_0aZUC0y8IDtQ6xxaxmVub7J7EPcRmk2GlkIM58liRktN2dUkY3WYDrKaIkUOEDHjvV-iqhGDNnY8yFw0nC4naoMtNv_cBsmDR2HtFraUmW1crAHxJd0To-1FEtMvU-a6YYg7ZiFJOKtok_y5aW2X7mVXrBy1e9N9zN_GHZ-5sKhin4l1AftxSphmXlPrzzS9MRH6UP6K9VxHbViMi6TUqRRUnkDi4AlCmHI50NEAtJjAOWppmEAToeNIKrK5bnryr_FYYXhr8jqB8IfvSygbva1C7oBjv5jL_YZilOAFUFD7caCdTC1sIwpbhcjxr4-6pF62mEl8_FIm_w3JXth6aK_fIJXcFNBWNL9z6Hq-acUlUrTmMl3YexUHskuebM6no9QL8uGF-cuyitjbJr40B-CA0qJNuXzfE9OkW8YN4RnZA8LeRL5EEoy9ZbehrYCaHayVRMp43YC1sWAYAb-qR7v1dk5BZhqPIACNNm7buj0xdPO4lmQpyMo9ZNIw0NGVmhWpFtYbNbaxB1TqHqbI4rprmXAkgBfVm0D7izKNIB6tSxl76M6sXG7oyeuug8Grh7v9XSo69fpUiHCiG5IwgC2gz8StC4YajdlObFimYWx6S1SDEQCh2I9TgW2lmDbsJ71Q6A7Oowtj8T_-VBAMSg8NSClTxJI7Il-74l1tjwjV1YMavaGxwHm2dYe-0EZnXzpXqjNBjZ4t4LSMuRQl-FlDa4PEfaEBxAFyHO0QLSedb8jrsn6kxRx_wNYa1VJFcjQ2MofA7vOppYizgxbco3QVJql7eyjSbjv2sSuO2PK_yxSy7c6IBN_-LFvJioOpi44g_-j_Cu6pIv0thPsp0_JWKFHCSqSmokuALumJzvK5o22Vl4UnWbp77vGxJY6v_kor8p2AfaZyqklWupfZvPxlMXpmZ0vD160fS08T9dOXVDCb1a6jg1y5WKyamUAyH-VazotOk3H4ZELig86KlnncdOHf_72stGAbU1b0-LSuKrUbEKHEv2aY0P2CSfeI3Uj1BE2YSg2DrU5sC1Qr2kuDMKkP_4XWlM4fuSoH3O4XXQv_0P9JlP980pD1K8fEHwwj5CHIQbLtGiw4APVb3eANpA_prQaidXL_WDNvhHcqnP2dudh2RD-QKFJ1dOijotYACwL-y4HwUTcMh1tv6IRwQTFA--0FLM4355CmQiZFO3j1iEPp_YPHhb1kjuF_wo6xYjGn_XKZp7JnMwv0pJRK9inYEYuhxkj9-g1p75KgCSt-F652gk9Id-rn0BbYOqHkrIxjeYrqRQeW3bGWbfakkMk67Hwka977whwo34imJgT2m00DnUVedbDOjSUmNyEOi2XESX0JbaSX7rrGDUqKikdKJXHI6YLtPIP6FBCqkDZdd-a-Ao3_HKqdQKIOj8n5ycClfsOwFjBYNDhE60VRp6WqCthdvZd2PSfDQpbqUoxg6XSYBC-jmgHFdM2yF_aJNbAGKf4Jxa9g8oa7B0lOvlEtZmoLe736_C7hTsxnXTq8Wr-ttAbmS-0lyFbqSLagAq3vlgg2mHvjhNLBY8ywLAA9g9TEnjL7DrxYwyYimEMdeRaN7bS_c5NAOtIRlm8t3nRn0PrGourJnmU1yGzQAgUDLRGV5g7-yinsFx-yDrJfTfWpZhwq9ufahHeCy6odmD82ePY0CQckkhQbLxnbFQ8C3C05UuFh2PFEndBYnPO1Wo3GkfmuzWkuijwv40JWBoRl2FIIAX4_aA1S46kMoelYbbiL0m2irfs0plX2TGGOxudzXhQGOy4sX8c7whes8XNMCtrDt_2FpwWNkoqYwRoFlfwkM407vA7WsWU4rpoUzcA_jHDvJ272EWGRGU3YTcfTqO4skt3Vtx0z8vRX-3lWa_gfsNqk3P4W-IyMMi4X85YjRd4MG-BzcCPkQKDRZHvPi8EHKxAadFcs8F55IE65buaBB5sZqD3DSxRLBCrJvmVFv7wsRFwGOamCz5sFnp4M-EFnWx1Ij-pUpUb0g0EVSeLAjC5wtmd3-bW-jyQCeH4IVdTAEwySDbujlCCuqVmCktYemuEQKsFqx1GZmrjne2-jcblY_yU92hZ-DvVij17s775uYSmcY_fl0gcmhKOWwaPE2NSfouNJgYpAsgNe5psdHph9OL3NTSWMn-W6MucRLR4emWdJlUeYHYYyJ6O6djYx25SzXeshosDv-wl316OXvpvdYsSa6gJdjfZNdnFB33q0zrwzXW0HXUD2VIbjxJ1YXwl9f91PERlgTS9hoUkdGy7HLyno6rCUgsk89QdSCtX5BtMBT-ZfySPqW0z5JJKbI0iSpBHSvMoZHCTmQatM7xY97RWflv8yv8YkEMWNbd8IftDOEDnS-ikjAsN9AuoOW6oCfysqj3xjIeypNBzQtVPwXi67kpR_jFhSQT2wi2oye75s8ZmpPTuLhQBCVsWnup5ukgm2Bl3_Jqbnl7B4Z4oU3T1kn7JSn_IJSbFkwxFFX2YsXZ2XgYUEGXPFMPwnfiq5c6jwHd4YN7qsCgZz0HbRw-qf5l4R0zp56SzTMpXeaMkS1n3Go-mhOw9ZqtETrwjgzT1sqGbaLYzAfP1jqRSekSpUFkKy4LQWXMhebOfE0ZXg4PZN-U6bbRmqVHvOAtZW4gHDJYyh8jui7wN3V3h4sMbZ0MfkVj47a7wZCnDP3PICut9uSAFhSSEYN7JBmuFHTnw2tpjFqHroog6LZNJp0kX4ivn9MZl8kkp5F_wjQEtYo2NBo4J4S9K1WVQYMJ94RQU9aj5TqKNXZMlRkwbox0rb3N1U5xEd5Cs2tX4TfFW3oHkZmFIrP9L86DUvjX-Bv-ZbaQeY66FDMEWAeLrwHfpK10MwUZC7bqzTZn3bio_PV0wQylJSqjT_mwJ2eflDFAyLXOvt5sFWtZih8nlrLFdyAY9fyEeO5kZwPi1rcDv-fnSMsviIUKYV__MdKY282l--_sppYwSM0p64XqwGISBMKThmRTE_5NeRXr6WTck7g0FKdQ69BqOfxjLARkbDoC_R-_Ta4Jc56Su0JPQBTEDagOWVI3eN3Tbgo_M91vT20NhSKYYqgXutlNa-Ff-lwhSCDrGRvXBwP0DplXH1Qogjt1IB1WaFBCm1P0Dsl_WadhnFRIIbLxNJ8DsdGUxOFZ6ERWt397DkIbARSCx_U_fh4OcOHmEcnWS0Hcc-AIWNMZUfouDy2G66vpXo2g9OVY_2LvVA05YuPL9s-7oLTpGJr7-VGkXlvLwFfnfmF1cFnNtdrxzlYVB_z4WYQVbiGAhUJZawKpSqBT6NXD99mpCOwZLL7ZYPP2eDXh9yt&cid=CAQSKQBygQiDvSzQqRlyqbtf8bfXzwVLlZMO7l8yc72CiKotZSmxXbb-43T4GAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=3952829422269839400&adk=3944675600&idt=131&cac=0&dtd=65

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae8017866a6744d35f26aa9da389e9771d40bcae3ee65df4c1b5e16e57b09fda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:56:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6703
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 6053914914909336730
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:56:52 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/ Frame C902 29 KB
11 KB 35ms
35ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a91fca903f7f2a3d051f657b5b25baed4e99b6c1e51bfee63737f73ff54f2b7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:56:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6700
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11027
x-xss-protection: 0
server: cafe
etag: 5492578185836041520
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:56:55 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame C902 41 KB
15 KB 83ms
82ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 07:39:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 202142
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 May 2024 07:39:33 GMT

GET
H3 200 user_uploaded_nimbus_sans_d_ot_extended_700_normal.ttf
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2009649736748391047/fonts/ Frame 9DEA 26 KB
21 KB 425ms
41ms Font
font/ttf 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2009649736748391047/fonts/user_uploaded_nimbus_sans_d_ot_extended_700_normal.ttf

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2009649736748391047/6c501641620742fc68b0a18fc7ab966e.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

19f05b69bb20754abe63e51bbdf5e3f6de9261fa0dd361689ae3a93b9149d051

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
Origin: null
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 30 May 2023 14:23:36 GMT
age: 177899
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21278
x-xss-protection: 0
last-modified: Mon, 28 Nov 2022 08:24:59 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 29 May 2024 14:23:36 GMT

GET
H3 200 4f15b04a61e905e84860ef8799d55716.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2009649736748391047/media/ Frame 9DEA 90 KB
90 KB 93ms
92ms Image
image/jpeg 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2009649736748391047/media/4f15b04a61e905e84860ef8799d55716.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2009649736748391047/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1538fc2564c4207e12ed180fbb40680bbaa3f3fbaa1257936b2390e2f3a92e8d

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Sat, 27 May 2023 20:12:38 GMT
x-content-type-options: nosniff
age: 416157
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 92413
x-xss-protection: 0
last-modified: Mon, 28 Nov 2022 08:24:59 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 26 May 2024 20:12:38 GMT

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 260ms
24ms Script
application/javascript 23.215.22.18
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.215.22.18 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-215-22-18.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b17917c9805c64cabba12c84121cfc59b8c28c9a9594efa979c3e18a7b1e3cf5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:35 GMT
content-encoding: gzip
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
server: Apache
etag: "d734-5f2f3919e751f-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 17407
expires: Thu, 01 Jun 2023 16:03:35 GMT

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 38 KB
12 KB 8ms
7ms Script
text/javascript 65.9.66.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-97.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6e91aaec2cb3510b97bb0655abdb08942dbefd617b169d0cd97b23fc48e68b2b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 31 May 2023 20:50:11 GMT
content-encoding: gzip
via: 1.1 36d9e1bd4f00d39c57a56679dc44e264.cloudfront.net (CloudFront)
last-modified: Wed, 31 May 2023 20:34:15 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
age: 68305
etag: W/"560498a44e7d42477433425cdafd6a16"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: 4V4C0zcMjxD3Kj_UwIWxeGQ1T1oi1SlYuFmS_TRCgvH70GYF4KfIBA==

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 58 KB
17 KB 22ms
21ms Script
text/javascript 2606:4700:10::6816:3456
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3456 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0325b6c9e68ae3f6ec25f6817b4daef364bd99c2ff5f04588fd6f956bf983b97

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:35 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 06 Apr 2023 12:00:04 GMT
server: cloudflare
x-amz-request-id: P3SXMPB1RMYQ9YWN
age: 1017
etag: W/"b58faeda0c1d193bc50dd25a7640d8ba"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 7d089a09bc2e30f3-FRA
x-amz-id-2: muuynwQCZ6Y4TTgQT7izFCHUmrRKZyM0csmvtZqpbqBsdevXa5RPxFm0LaNHVAeCkDUfIH7i27Q=

POST
H2 200 recordVendorsLoaded Show response
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/ 0
455 B 111ms
111ms XHR
text/plain 18.205.123.80
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/recordVendorsLoaded
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.205.123.80 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-205-123-80.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.farfeshplus.online/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: *
date: Thu, 01 Jun 2023 15:48:37 GMT
content-length: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

GET
H3 200 container.html Show response
24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 56B8 6 KB
3 KB 65ms
38ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305250101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.farfeshplus.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 01 Jun 2023 15:48:33 GMT
expires: Fri, 31 May 2024 15:48:33 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
480 B 93ms
93ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://live.demand.supply/e/e.js?gl=0.2&b=3&r=farfeshplus.online_auto_interstitial_desktop&sy=6f087f81-a489-4b17-ab6f-f5e2ef760944&ts=72&cd=2&mlbr=ch&mlos=wi&mlla=en&mlco=us&mldo=www.farfeshplus.online&mlre=undefined&mlin=1&mlsi=undefinedxundefined&mlbw=4g&mlcs=NaN&mltp=90ca8619-0775-4d76-959c-f93104339976&e=lm&dsReferer=ZmFyZmVzaHBsdXMub25saW5lL0ZQNjQuYXNw
Requested by: Host: live.demand.supply
URL: https://live.demand.supply/impl.v16.11.0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

x-nf-request-id: 01H0G4HP91HMRD74KJFXGZPWNV
date: Thu, 01 Jun 2023 15:48:35 GMT
cf-cache-status: HIT
age: 41555
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "847d6f45a54b1a346481710a0a6f4147-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 7d089a09e9711b35-FRA

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 807F
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEHHGcJo8szgJ25JnG2hq67g&google_cver=1&google_push=ATf1kGNgPfjWkb8x6rSMQDSUE6CG4QoQTZL9PUW7OnPYASM_FpIGvlQR9Xrn-aTIhNsLq5m_jLryLlaNOvB1hLPp9ZtmGqJlbEUx&...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEHHGcJo8szgJ25JnG2hq67g&google_cver=1&google_push=ATf1kGNgPfjWkb8x6rSMQDSUE6CG4QoQTZL9PUW7OnPYASM_FpIGvlQR9Xrn-aTIhNsLq5m_jLryLlaNOvB1hLPp9ZtmGqJlbEU...

43 B
420 B

232ms
209ms

Image
image/gif

2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEHHGcJo8szgJ25JnG2hq67g&google_cver=1&google_push=ATf1kGNgPfjWkb8x6rSMQDSUE6CG4QoQTZL9PUW7OnPYASM_FpIGvlQR9Xrn-aTIhNsLq5m_jLryLlaNOvB1hLPp9ZtmGqJlbEUx&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DATf1kGNgPfjWkb8x6rSMQDSUE6CG4QoQTZL9PUW7OnPYASM_FpIGvlQR9Xrn-aTIhNsLq5m_jLryLlaNOvB1hLPp9ZtmGqJlbEUx%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7d089a0e3947bbf1-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 843
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEHHGcJo8szgJ25JnG2hq67g&google_cver=1&google_push=ATf1kGNgPfjWkb8x6rSMQDSUE6CG4QoQTZL9PUW7OnPYASM_FpIGvlQR9Xrn-aTIhNsLq5m_jLryLlaNOvB1hLPp9ZtmGqJlbEUx&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DATf1kGNgPfjWkb8x6rSMQDSUE6CG4QoQTZL9PUW7OnPYASM_FpIGvlQR9Xrn-aTIhNsLq5m_jLryLlaNOvB1hLPp9ZtmGqJlbEUx%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7d089a0bee39bbf1-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 807F
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEPBgaIzsFqnjJ-gvpk1fU0U&google_push=ATf1kGOSu7BJfrJ7n69lc9naU8efoEp9RGviP6ckG3Ofdc7rbiDbREEYhI...

170 B
188 B

53ms
51ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEPBgaIzsFqnjJ-gvpk1fU0U&google_push=ATf1kGOSu7BJfrJ7n69lc9naU8efoEp9RGviP6ckG3Ofdc7rbiDbREEYhIh_q5bkX4JSILNFrBdnzH5oq1708bz8pQaMja7BTAaV

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-fra-eddf8230027-FRA
pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1685634516.706641,VS0,VE90
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEPBgaIzsFqnjJ-gvpk1fU0U&google_push=ATf1kGOSu7BJfrJ7n69lc9naU8efoEp9RGviP6ckG3Ofdc7rbiDbREEYhIh_q5bkX4JSILNFrBdnzH5oq1708bz8pQaMja7BTAaV
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 807F 70 B
265 B 218ms
29ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESECZ9SvDW_BKUsgMwMe2iHLo&google_cver=1&google_push=ATf1kGN3aScQVjy5nnVOGafAnNvdQps3ecUu4t1DC0_o6_kigFrUw6yxMPnXL8pDAfMWF1A5NdsPordku6kvxaWGqMnCz6-SH1wMew
Requested by: Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 807F
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEF0PxD_yFryACEjX6bm9_84&google_cver=1&google_push=ATf1kGM1Z0g36D02dqnWJkuj5iH3qjI5ledPF6LDavQg65Tsrj-3ZBqrcngcm93tEkyja7rHNVEXxrEW38I...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=ATf1kGM1Z0g36D02dqnWJkuj5iH3qjI5ledPF6LDavQg65Tsrj-3ZBqrcngcm93tEkyja7rHNVEXxrEW38I_jL7LDpNvsbUqyRXE8A&google_hm=-gMPAjn_SbKFCaqOwJ...

170 B
188 B

55ms
53ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=ATf1kGM1Z0g36D02dqnWJkuj5iH3qjI5ledPF6LDavQg65Tsrj-3ZBqrcngcm93tEkyja7rHNVEXxrEW38I_jL7LDpNvsbUqyRXE8A&google_hm=-gMPAjn_SbKFCaqOwJxePpI

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=ATf1kGM1Z0g36D02dqnWJkuj5iH3qjI5ledPF6LDavQg65Tsrj-3ZBqrcngcm93tEkyja7rHNVEXxrEW38I_jL7LDpNvsbUqyRXE8A&google_hm=-gMPAjn_SbKFCaqOwJxePpI
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame 807F 0
174 B 223ms
33ms Image
text/plain 34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESELA1M6kWmiL8F6boeKxXiHM&google_cver=1&google_push=ATf1kGOq9M0P29MIp-MPXlE4TaplvpvC_ULiTBfeZbIvnou32WQk5IujVz_K3u5TTATMfyap4AU2aiJwpgEw0qzz1IGJ5mEvIn9ALA
Requested by: Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:35 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 807F
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEFS5JXTRHzK0rytbllg2gE8&google_cver=1&google_push=ATf1kGN1Zl6hwlMhhwLgBYpcT64RVp3t9ZCt0PUqX7DLrYCe7G2XHlEQkpzlXs_UV25aFd1EwRlAKPuvqL0o...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGN1Zl6hwlMhhwLgBYpcT64RVp3t9ZCt0PUqX7DLrYCe7G2XHlEQkpzlXs_UV25aFd1EwRlAKPuvqL0oBblJnpi7-okq-XGK

170 B
188 B

51ms
49ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGN1Zl6hwlMhhwLgBYpcT64RVp3t9ZCt0PUqX7DLrYCe7G2XHlEQkpzlXs_UV25aFd1EwRlAKPuvqL0oBblJnpi7-okq-XGK

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGN1Zl6hwlMhhwLgBYpcT64RVp3t9ZCt0PUqX7DLrYCe7G2XHlEQkpzlXs_UV25aFd1EwRlAKPuvqL0oBblJnpi7-okq-XGK
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2

200

report
sync.teads.tv/um/ Frame 807F
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEHpDnigR1AnceQmdlKdENMA&...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=ATf1kGPZJPnAKQJFsYXSN639noI_YCjDjUck2IocPoSiEArynOkLmqVZj9F_9XUOHq1ioT0g7wWbtz9GFHL0538iaUMWxEnFlDZKin8
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
165 B

64ms
62ms

Image
image/gif

104.111.217.42
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Requested by: Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 104.111.217.42 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-217-42.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

expires: Thu, 01 Jun 2023 15:48:36 GMT
pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 807F 0
12 B 54ms
45ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KgTpjVPz8YMk-UXiZyQzJ7IEp_9C9P6gCffTNAK30btjxrTMBKEJDQA1XgTDHgZraVfIO84w

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:35 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 2A7B 0
105 B 209ms
22ms Image
text/plain 2a02:fa8:8806:12::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEB45zMIWlU_YgLfA30i5RZw&google_cver=1&google_push=ATf1kGPB5sLpKy4mfbfHgxnB7ccmEkhqWsA4IusKjm2RiAGzxmpuC1Q6z4G9rGBRuM65XMBFm4pfFnRn0MSCqJWeNyiI20kM34kqVg
Requested by: Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1400 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 2A7B
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEHHGcJo8szgJ25JnG2hq67g&google_cver=1&google_push=ATf1kGNGWEJkmwNNJcHNTkdpxqz12niZa00puJE94uiQ3ng80jiKDF39NOzwhzlgvsmYOK8m7tubwqx8B-Zs4MYHS86kJsBxUk-uJ...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEHHGcJo8szgJ25JnG2hq67g&google_cver=1&google_push=ATf1kGNGWEJkmwNNJcHNTkdpxqz12niZa00puJE94uiQ3ng80jiKDF39NOzwhzlgvsmYOK8m7tubwqx8B-Zs4MYHS86kJsBxUk-...

43 B
390 B

217ms
216ms

Image
image/gif

2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEHHGcJo8szgJ25JnG2hq67g&google_cver=1&google_push=ATf1kGNGWEJkmwNNJcHNTkdpxqz12niZa00puJE94uiQ3ng80jiKDF39NOzwhzlgvsmYOK8m7tubwqx8B-Zs4MYHS86kJsBxUk-uJA&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DATf1kGNGWEJkmwNNJcHNTkdpxqz12niZa00puJE94uiQ3ng80jiKDF39NOzwhzlgvsmYOK8m7tubwqx8B-Zs4MYHS86kJsBxUk-uJA%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7d089a0f3af1bbf1-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 1413
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEHHGcJo8szgJ25JnG2hq67g&google_cver=1&google_push=ATf1kGNGWEJkmwNNJcHNTkdpxqz12niZa00puJE94uiQ3ng80jiKDF39NOzwhzlgvsmYOK8m7tubwqx8B-Zs4MYHS86kJsBxUk-uJA&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DATf1kGNGWEJkmwNNJcHNTkdpxqz12niZa00puJE94uiQ3ng80jiKDF39NOzwhzlgvsmYOK8m7tubwqx8B-Zs4MYHS86kJsBxUk-uJA%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7d089a0bee3bbbf1-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2A7B
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEI59nEU2zP-ylXkpJQeYVd4&google_cver=1&google_push=ATf1kGOkHORgekX1aVqtquWid4Tx3OTYXswOHK-mAu3KmCWChrHU70lrcFXl6WgITumxVn5pdAsSbrPfWKWOSV-txQ66Oe6PuBXSxkY
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=B271353183294576B2158BA1778B6CA1&google_push=ATf1kGOkHORgekX1aVqtquWid4Tx3OTYXswOHK-mAu3KmCWChrHU70lrcFXl6WgITumxVn5pdAsSbrPfWKWOSV-...

170 B
188 B

58ms
57ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=B271353183294576B2158BA1778B6CA1&google_push=ATf1kGOkHORgekX1aVqtquWid4Tx3OTYXswOHK-mAu3KmCWChrHU70lrcFXl6WgITumxVn5pdAsSbrPfWKWOSV-txQ66Oe6PuBXSxkY

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 01 Jun 2023 15:48:35 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=B271353183294576B2158BA1778B6CA1&google_push=ATf1kGOkHORgekX1aVqtquWid4Tx3OTYXswOHK-mAu3KmCWChrHU70lrcFXl6WgITumxVn5pdAsSbrPfWKWOSV-txQ66Oe6PuBXSxkY
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 31 May 2023 15:48:35 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 2A7B 70 B
266 B 216ms
28ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESECZ9SvDW_BKUsgMwMe2iHLo&google_cver=1&google_push=ATf1kGNCS5a8yuYf_5mgM-jOSdeGywQQXqca9aIG6E0kkB6T-h67KExNPQQuRIWbHwP78p1-FoBqeU8zJ0IWTuGom9PVXZhPZfnKJw
Requested by: Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 451 466606.gif
id.rlcdn.com/ Frame 2A7B 0
99 B 1086ms
21ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/466606.gif?cparams=google_push%3DATf1kGO7-kBjFkyfuVhNWlmnVpdzmdGNBzHsTbBUt6Pt1HcpD5y6hdDoOTIsql4C9iG6wN8YQg1PAyE_QVVM-8QAtpYg-6v4zaRxl4I&google_gid=CAESEN5kqDn6N2oo1_27bNYP2Jw&google_cver=1
Requested by: Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:36 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2A7B
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEN_wUpYFK8BDaOHu-WQgDhA&google_cver=1&google_push=ATf1kGPcY8UjMqdCxceNwiJMSy6Z4kdWfT3f1oNfSDDtAleZvCsGZl6zzrR8UDvfKFai6HkCH4rvfWU3uIQST08_1pMWYwm...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEN_wUpYFK8BDaOHu-WQgDhA&google_cver=1&google_push=ATf1kGPcY8UjMqdCxceNwiJMSy6Z4kdWfT3f1oNfSDDtAleZvCsGZl6zzrR8UDvfKFai6HkCH4rvfWU3uIQST08_1pMWY...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGPcY8UjMqdCxceNwiJMSy6Z4kdWfT3f1oNfSDDtAleZvCsGZl6zzrR8UDvfKFai6HkCH4rvfWU3uIQST08_1pMWYwm4JcA0-Yg

170 B
188 B

49ms
48ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGPcY8UjMqdCxceNwiJMSy6Z4kdWfT3f1oNfSDDtAleZvCsGZl6zzrR8UDvfKFai6HkCH4rvfWU3uIQST08_1pMWYwm4JcA0-Yg

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGPcY8UjMqdCxceNwiJMSy6Z4kdWfT3f1oNfSDDtAleZvCsGZl6zzrR8UDvfKFai6HkCH4rvfWU3uIQST08_1pMWYwm4JcA0-Yg
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H2

200

cookiematch.aspx
dis.criteo.com/dis/rtb/google/ Frame 2A7B
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DPUSH_DATA&...
https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=k-LXQVCGJ2-AbpzohmaDk7ORgd00gyRSU3Pfvw4g&google_push=PUSH_DATA
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_error=5

43 B
368 B

28ms
27ms

Image
image/gif

178.250.7.11
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_error=5

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

178.250.7.11 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 99996
timing-allow-origin: *
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 274
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 2A7B 0
12 B 56ms
48ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KwkmMLLcamZCb0hmPz1USrXy-DYLLMnKqdOR2X5SO7uqtonXB36Xryb2q71CQzQEYX0ulm

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:35 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js Show response
pagead2.googlesyndication.com/bg/ Frame 7760 37 KB
14 KB 42ms
36ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ae70268abe00d0f5f9a58ce23f5af80fd5f8d9e8b5a647855901f5321cbd23a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:09:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5936
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 31 May 2024 14:09:39 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 4BAC 1 KB
643 B 61ms
35ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 77604
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 18:15:11 GMT
etag: 48472445140208031
expires: Thu, 01 Jun 2023 18:15:11 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame C902 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a21466e21da7b04bd62ee4f04e05dcaac195a785cc6971b149bdd7172d1028ff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame C3E9 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 17c12dad8e77925a35af5e2be83d610538c2fa612b3babb8e00879e2e6c826c7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 9932 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ee67ab7cc2159e4e8e1ab38cb450d32f612929e8aaa58bf649c7b404d54813d5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: image/png

OPTIONS
H2 200 recordVendorsLoaded
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/ Frame 0
0 1770ms
112ms Preflight 18.205.123.80
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/recordVendorsLoaded
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.205.123.80 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-205-123-80.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.farfeshplus.online
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 1800
allow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
content-length: 0
date: Thu, 01 Jun 2023 15:48:37 GMT
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

GET
H2 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 04AB 172 KB
60 KB 176ms
97ms Script
text/javascript 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 10:17:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19873
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 02 Jun 2023 10:17:22 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/ Frame 04AB 11 KB
4 KB 37ms
37ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ACZ9bG-aLTnZWf6qxMp7KZ3-eXqHDeNrb6zo3d86sI_osqyA2wyQxVcuuarsliXgJ3Z3fKgKrm8sLB6LWdsUUgZGX2w08Kwm6vpxYZ4MThLEFGlYrOJig476-8pOkZPHJoXLmZuQcoCwwTzh4gIhxcFkkXvoa-o4bu5oF2GZ-dDYREzz0&dbm_d=AKAmf-ALRk73CYMrC2xtdSNIetkTA3Zw6RVkYxU2OaVnpHqCB52M4dS6B81XxM6A2NEBLWZPY8HgLESSRQsBhuNNfVkXxvlCg7Wd1nteCnFzR3uQQjnIXJS07-Yb62G9hYstVI8T74RGfe2IAVovD_9fyf00dsJq2b0rmT3qAHctUCoVHjVQXD9XbtvGD88ymLKBDmacUPJexpuRO66p7Ug-8rT0CTjBi1jwxAzwRZLf3SvJzmQebcHgBF07xsUa4OXRrc7l_FV1oQCA9zCy0cJ2oo10g1nJIZQAdfiIsqhOVJ3O5sTGK4V_5fnrleCcPkY1JyD3g5PHxJsNkZ3PX1b1xuNL97mrVuzm5I1hHjQOCngPf9r7rbCpC9NPjD_qgmmzKYi0nYZUfZxuKQ15UoeOEsmkr6p7QaI51mv5EnE5Qtll35pCBAPv5V6Ei5u8mgqXXXMVKlb5JfADU92A7eHfZQIr0WJ8YBQ2zJTlJJ196yIxw9z-JMjm0Tqr9_8XrT2RK9WsLIq23vabGZlEbe2S6Wg6R5oytpmIdZP_qc7-8CPBviT8EAK7CuQ3HZayjVHzycgTB6jZ03uKQE6gUSR2m0bpVUXehE-1RYc3TfYhLmg5rC7kf9--ZBWCg3xUQChCRWN_ubqz7nednQgmLGW-cLP7iLRfdrZYQUHTUwVuzT5JIdtqq0fJnhw9fo7DYywgeVsBoIrLjC7hDMd4blxQ1rwW6h1wPXyAbGnEy9fLKu4oARg4Oa2bgFCTGsZ8PtO1WpuzsEzbmtGsbGWiWPCQ5WSoBehrwBPziS-Flh6ncJuI_n33XIgP6ebxIDW4WxPk9ce7L5eJxOHMYHlkBFfDnknypeIKzRiZ_hi6Ft8n15WOo1ibhx7giWPdZoC_HK51FIccD7AqvQ9vO4jvIs4MJb5LnLJ5Y_i7zGj-IJLS21jJr5Rg80VgX21vUph1j1lQ0sgPHqDKiYSPAqFfLCjvVWTsdoLUsDWqMOMQN8A2jsz0s9g9gMQ4Ec3wWHf9jEsAD9JiMdY146Sbfv24lR8a75kPPyM01GLoJczIxjv1xwG8dIbb87UCHs3_HBqsKfd2WX1bfTDbNlLq4NKOy8FBsWes-1i1BcrjTEWjOdAQtr7u6wtMk0ct6YO4G5fANoPvMT39qjAOeR6p_fXsJbyJwWVZhnl0ZBv76553n7NioBgJY3JdScRUzic9vQdcOcy0A9lSZhgF_t03XffZkg_D4sjoKXQtoK-Vt29r5Z1iAW3k6PJqJqu4yEcLm9SwcvKGqLZRoHhhKUyae5TjfdhSlHj5OsAoOQGDVuAMiM5lyDqwBkmeTQmTn4j-xWn3ZeCLfh2maAdxTxSSoFU3Cqlc93qll2_mmXlwUW83YPgZN1PpFeGvEBnL-SbSYRqn0tqdVmkMHvsDzT5v-HIEJhl5ne_8lh3IJrDCP5IRN9k4Qlmsr3P5PFl0GYhgEQSB_oYQtRnezILD5c-iyxJKI8PlYk2bHsaLk8ywv47D4DyQbB_hzSUKm6cepGt-oA1I4aAVWQM4GnmK6hCpqxi2eg_uzeqondUoRIWASGarN6mcry5VxKOxc1a8VjLIuojL66IgbqEGkq8aC_N_utEHLw60NuEvKKEmtlYDSeYpd0c8jGZpx8743ce8pGe7v7pA_2cvqdoBBgm4LBuoEWLUMYM1cUusX4l7T4p5TdyfOQT9dMAEE6BsIWhHZZOA_YTrnODt6k695lixCwRQlGG21xM4y6wioCOVWf4csSI1dCqe7GaH5kz9lJxJKXTTAlbe0wnqmYQO78kjG7B3a0oP1p-wyCTCvn9kNY8KYoIxSLHpXNc7vFLGnCPjcb8SEWquoCOcnz2x4MEKaeZ5URLNgV5xpxSI_A4yzf7XHKRccXZcFVbNocIscqsyoB9Vblo0z7LlKHAjTYSXtpBchNh_qUjZSxq9vb3WIuzUjv5f7KWjcH0B5AIRWIlTogjigm38Q5JwAxPdDT0VfBziRql_zIVPofSW-bicR89iyj_tjogLJh2diXYJYXuyKalxLTL3lGWj1heezj5VN8fswhES-hJemMFy2p6iyYZFCr6PbaqP4iHoWk33Oli6ipN3Ro_6c5t47RvqfZgDvUk1KQlH1iFJsZhjsovKxlPgJU5oCORnziW8SwCKE-JCVYEbPiyrJ8yAGTa0BXasCZEWgwaShgalivd7F6ULfzHoe365Nh_vKJLsKWx8nc3qSj2jzj-bDD5n2htGTH09ab5ySGS7xsNMowuPIXlCnjiSSxaxPn4mYUGVaUHhBUZ7anwcF2MvH9pybyLbaPEG9XqIGK0MCa0IThY8eumtaV1i9SCv2Cbk7lUeFTrCrdtpo0LizTyNjGQvy8gznqHnfZtC8dMIZKyPGeKtRIKwWqjiVF1taXwjQDbOBQtepkS_1VSdfUol3si4fH3Ia6SZWaXDSFZ2IBsUmXB5dPamT5fCpssgx3397keQ5xJkU3NsLDLLUIAgq5dsnm6koUkzWUW06iHMUpNtfTTkZQ8-QSIkEp1qN2itHJXPTxbsL0rbdVU0J9rrgPx1D9DRIo9rfT-4P3n_hlokaUQdyintJ6ZGk4Z0dIxKdOhV8xMqLMjp-j8XyTL-st9fQ2woyEmM8SsBd70k-Jkxr8l0pf4H6lXLpHmHGvqq43VvURGf-UPNPZ_Xc3hS1XLFEwnA10LimkPDwPI-7e11R4t6UiXJQG3FhCi6Ma2YFfNC40GQNWtCMBrK6i6Fmv5co7JC2OhvZxd9vqpDeC_hnIhyX_P8hxjAd0rkQmtsoS7t_VKEdMu5qRXZYkm-0tzRVrgcyVpjnIps3gRwe0CBk2Ra0SUUwzueAhxodM2V4vNw9CU4fLTjEphD0vFCo0xYf5PTWdW9gJbawG4dayCax1UcIlp2Tq9jvwiiUm0aWuPaPXfPSBoTHzvFtwB2MaCUSrtSzU8b30fTEVoeKpYtuxPFGNGyt47h06QsK7hCpJ_fdj8Qap-LG5l_ZpCzrrCaZHGEmL9YWZPQ52h0sE4iAtoVKImWa9wHbB4PtKEojSw4hsDgPIUpAN6Wk_hgfMkGAKTpiO5WnsAvh9sNSODWrGmsbCI1-KcsrO0pfau_nBWzvDdgfrdGRg-6RdnQ_3PpJAkyKQQhVqQICQc0Bvuk5OP4CmWhLd7RmNlx8ITUWFSAR5e0bp1jykApF6WqHxDj-1qg1LqV5pSyKv42YPzdiIZsIlTiW4ZvkflCqRHz_OVnzYfI3VXeVEGsTNT8dyjvzBuWIF2ts-lptHGuHozvxvbXlBU_DP5awQZSfmKBP10Idr9QZ7mBlv6CxvWH65sTJHDeaMRD9NTUpcZyTq_XjiZYPgj-FhwM3H_W8OBOMCsIEzKbhzfGSIOTmd3eBhhYb9WOnx4e4fi-l97cuuNm1nMnfStjxmUB_OyuHFm3TsSVrD_fXddPf8bUn-EQf2hafjKMPXhqLiGwMcrEpTzAqPnPQ4C4eNg1vKcXDxAYXGiIduYHoTONK27ZQk2K8FqPgIp11UT5ymojd8OOIRbWyncNhvyjY2PK0phmTRDsgxhlcPMbTPgwuMOGi6zPX4EtlNbfFlH6&cid=CAQSKQBygQiD1eBBEsspmuVyIE65WOOfgo7E-pnyRRDVtJYA7i6rT2RbQiwfGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=16339457621137353000&adk=2086295851&idt=246&cac=0&dtd=8

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae8017866a6744d35f26aa9da389e9771d40bcae3ee65df4c1b5e16e57b09fda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:56:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6703
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 6053914914909336730
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:56:52 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/ Frame 04AB 29 KB
11 KB 38ms
35ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a91fca903f7f2a3d051f657b5b25baed4e99b6c1e51bfee63737f73ff54f2b7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:56:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6700
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11027
x-xss-protection: 0
server: cafe
etag: 5492578185836041520
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:56:55 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 04AB 41 KB
15 KB 41ms
38ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 07:39:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 202142
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 May 2024 07:39:33 GMT

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/990511/61634100/ Frame 9E03 245 KB
74 KB 508ms
35ms Script
application/javascript 18.203.7.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/990511/61634100/skeleton.js?ias_dspID=3&ias_campId=1010147412&ias_pubId=pub-8367749956917006&ias_chanId=1&ias_placementId=19422215943&bidurl=https://www.farfeshplus.online/FP64.asp&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0g8KgpN0DqpeNdLhxBBbeSm
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.203.7.152 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-7-152.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 9a2fe7c69646aba810c211a098f09abf1ed78cf45670e414017d8aff89b7fd76

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 9E03 111 KB
39 KB 188ms
123ms Script
text/javascript 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 10:17:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19882
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 02 Jun 2023 10:17:13 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/ Frame 9E03 11 KB
4 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Ba-g1JELTGwZIMs6G7K-3CE_ND6MWT0y4d5Npq0Ka3n1Ti8yfJlq3zW2aIzH78IZPURsceZVZWyLjnyybYLVwz7sDCdmovTWXtAQiESy7ctanqw8CYeClz77BubUR1tV-yinpG7xdwrlCqECI71zPn5vxE-_tplWxxYTPwqWxTh2_skDg&dbm_d=AKAmf-BlC3nDmTfTPT9V3iIvBuThez3j3Ia0YlMYGjpMKrQ11cEKmFsCsc9YmHU0RyjEK-tJMe01ofSPaNmnaVqEhfh43Yn2D-_kjPBs_2n3PfoxT9uQmXiAfgoTnJyoKJKVP3d4FTCdrRFfiZyK5kx6Sz-t719zBubwl6_l16GVJeEnt0EJFnRRqj2jGt2fIA1b504qjgHbWYKo7_74-fagB3o0WFnwlLFtaWPUefdeYv-lcEDs4ve-aLiOPq3GZLkbwCDYHC6TF3qgcbIo-hNe1sRXtzaKZ2zwXwTz-mV149Bgs-byJf192-FhUCH91Fyq6TJNEBDiK3Kkt2VuNy3N5LfVPVDp083ZZOhRMQRPdQgiLWE6HgdD0oFrc7Sn165Rz8UjAwrn41hhdfeKXXBFXxVu59u3a8mfdYo86kQ0BYyAdQkiuD5tx7K9Tutj47Uc80g-VgH9ieNx_xbmXnG7GgktunGO3nGgqPEFzCDW4fNufAM191KvVyoYVmN5-CDCz-1Tq6rXSaz3HAEn3_cqCpB6I-gVyaili5ba4FsrK1ilw8xXH_0FVsQ7Fsa8nukK9gQGxIdcev96W9AGijh93JuhvGv1u8Ef9-wRMJ3o_lJ5uOXYbIwZeHWq-17KByYSVHjz924ehEk3EHjoe7-cfgGt_E7sbgiT3K11twAOTxh3jXnUhGaGlzFs1uI3qUiImUk-qEW-2QPEJGkm_0mydUZdW2g-gx57ZoWvmsqk_7ZZZbhb_EJlzt2unVUO-dhJaWDMVoT4-gCk-cjAP29rp3Cr5cdT_xOzFBvramERbEXQsfdN2qya1w4k1QpOR0CjPoRVUy0gv88mMoY3vbWc4KjDkcUTUC0E9w4UXs9fkfyISevaxCU4jR7MF_kUvhBC0x51C0dlcZCrVas9lqv83Kc2CycAeRtTQnDCCjCMO2L9X4AtrXXCFg-wK_iQ4X9lcfNRB00FlHxXpivwUQ7C_Z0mFlyLYaL0lZn9_f4WFM-HrOW7yCfPWRG1MrWUTS-OUyv2flan5IfC5d9FhhKHpEb4Cd2T2AwXs2HDbCAJEUCs4kk2Ua5fuCIzB8y0o4QvqK_QZF5Xzl4d9cSzV2NB_8eiiBeJVXCbc-GQCLGI_vIlGW5b5SIVD0L7A4A88GJnZExQqzNnNXDbD5sOCyWk3ijNSzrqQV9ipUziOLd57DmpDY1MFK5eCApDIuUg1rUDOa4BvWFxgDeCKtRXYKB1GjsEAFmazY28a7WSu89b7fbL0ghgI0fEaE-GkLX4dQX2xHNbnXPNsfGAhgrDdYIc57Y-QzlHH68lgl5O1l-SYiRO4MK7iSVpT04dyIadbMOnpQVb6Jqa77gvwsee4NvwWR2nRDxchu9y4WFVY_hwhBVj7w0iiE86neQ0b7I8XALhSzICdY800uHJHLHsY8VPW9ggp8gAOs7fj-mD8eaDD3MOCUwPbZGse1b4bhTNE6ceMAq65Jk9FPmydtGCeuG-nCvvclfzfLd-O43ii1NhRC3U9g5cYxE0c7bCPWSM7mtIVKJDd1hYA2pXF0aRAJLTIhcaTx3-AZzN5ysIrrwMvsomBmTMT2UsByqOcjVfaaP_2cpNnXwNcY54s80pfMJXV91RgWo9bkDZetiuJa23KG04LU5w2P5v796ZBN4SmpmdMuZTEqSS7GEq64kURimD_sZP_dcrF88Qx2YT2Uy8KraugNW936tftsDNbKPnifQ_meb8b7xNbYsgDa0pq6VYu1Ny8BzPGSMLO0P3v4qXoh-xqpbIw1maov29n9HWZXS42VR74PAx89qlhB1qn1WtOuwkQR9w0MpYaLw5L_Fqw0IYQwMmUu4Ox2yI4LcbTjJfcsYQXi52v9LO-yNvx7f53fKXj3WlB_3WmrgFA-Mq5YXYRXn06eYJrkGZYYk7z43I8WTDZC5ib2PYQiMLL3k8W6wWW7dIFHQqTm8XZx5imCvWj3hdGfh6CKG0R7iqmOlubu6erZIZ40VBbtmZ6WDUSRu0gpOdLQ9imy5HUlTcnM6RnP9Sivji3ogPDvBQ6RIzHJjvYPIg6EUVLE_LQ0R2lZDqtmt9ZopPAUlsjUZHwp12azhcSiRxJgarLTHV_MfPoanj3Ud93NiNq3v7yFLsgAW45dprfEfw8WZMdtUnP8XyYHncM62dS-_bInept83BbmCR_govEiicBTxt81HYhlXDrZbT1lRMybitErKmwhcIzbDGjbRs8B_vLB1qRMoXbYe-ncGu_VLKwdLZ8pkDPFUPsCBmJddt8KxhlVsnBf7-WeMkrfijZ7q4nCRmy7IFUMMLcbi17dGWmLuBJr8u8rhCHdMC2KZRIOUpRO7QYjvaAiD6tmiel_Iym-m5tMK-v6Bkd2iiNvCJhid-j-rn3Cif_iB6s7uI4R-KeycNhBG-T0_yvO8u8HNqtNqjwW64FHQeGsOCOBlDYc6Y82lxLEdIlDWDfSmZZ7PhXuRTneC8DTZ56wUzzPTPfkh-aW6F-DlG9VJ32lKiLelu7e6Ai42VTTin72Osbh6lil0kHfGqrG3-Cc5xGlgCfURU35gDZASuWR7-A3Rjbxv8LGlOMPD9GWKy6At30TP-iw_sRCxsfTa-csfdeSMgNC-75-QHC2wRkfleRGHoCarL_rn1a2owbSqyv-UG_HwaaOcfn_VszWjCH6gs364xRDhblbpk9wz0RNPGc-KAlwjk75l2b3UrOzWQdYoFkE31VBeRzxrsLQgq4B8Xx8McfSNSxq4sLRlr31Ec84Q4RrqF2NMjlw1eRzcmVB1DkswI0bOUdmHAr90sfdwcHGfb7KH4HmdYBC1sShNp921_s5bY-n-ahEdEgpPvoBZEuoKEElZgjOdJCmYF4uNWxkkk8STbJ1gq9iKwlaDKhOegCepeTy_6diWG25eRAuSEgnkRNnPFpfgWEBNv7aUfE5r2ZJi5eYSwyTxGQLzOrbz28Z1r0hyxzy2PGYpDluJbEFIEz1cBDyxvIqTfU68NbVUn2n8UXEBiZc5Ow-348i-TCz7SqVu_ykrvJ-qVy_QrFjLj1IGJCjmI6mbDu7X2NDyl9TTrOUWxNX9zDggp3X1VCA2MvtN1UA40I1S7QRuBpa6z9af_ti3j_T-dw7uaqFrMzKiMbks8tmpREau8bmftIlxLN3a2IV_YlZzajV4UtidrZCQ-IxNGAUAal7aR3-Gz0y98zVNKPsz987a0awMCo2HBnh7Gi2y6wDLSwYe81pzPAEtOGTUb9n7RXc146ei5mBmakHedYn4ZzYUoQXz2lGbgDmJa7eU5XOMe_geNBJCEdU1KZNdiFYKD3eXIcJEZVSS0kAAW2LXD-qCwkVoyP05YxpwdC1gWqTscFF4b04bZAUf4feByJyHIKFeaJbxMKzJT9QHeKtygYIQWyL7GwgmCwLptLgBGuOBvjCbdowoFZJ-Ejr74UMh3jOSR8eYY_HJRcwhHNY6PaX70Y0rdGhsQtq99vvn6YsOeaJKU8igHkV-JTCjB-hmG9yfJIPGy_iGXwIZtPp8M3fccCt3gbDiDseTH7sLklzqpJ_eDr4gPU294xQco8vcHDN4&cid=CAQSOwBygQiDsgHVasdLGwhjKMCBe2nDabZ2MmH8IL0SW-g7FhDHsIrIDonpksmWKhZgL-hdeChmMROOI-ATGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=6941547220702214000&adk=4188270525&idt=212&cac=0&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae8017866a6744d35f26aa9da389e9771d40bcae3ee65df4c1b5e16e57b09fda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:56:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6703
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 6053914914909336730
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:56:52 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/ Frame 9E03 29 KB
11 KB 52ms
36ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a91fca903f7f2a3d051f657b5b25baed4e99b6c1e51bfee63737f73ff54f2b7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:56:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6700
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11027
x-xss-protection: 0
server: cafe
etag: 5492578185836041520
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:56:55 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 9E03 41 KB
15 KB 52ms
38ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 07:39:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 202142
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 May 2024 07:39:33 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 68C4 0
20 B 79ms
69ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=403480182807&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 68C4 0
20 B 80ms
69ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=403480182807&version=m202301230201&ct=76&x=1&cor=5982605649199138000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 68C4 85 KB
35 KB 93ms
88ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AfeE_9_Mtk8L3sEVDuTXFX5se17Wo10LRSTzuTw33jUbNTZ5397GaSyW8__0Osmf9rpdpICWfq70ADF6v50YYW4qR8AWDDhqOiLBeTJQRWvFISTZS52DyvuMs2mZ4lhvdRMoFb_DvE6xSopgm3nTDuotWvfeXJ_3d67m42Y7Pt_MV0GVs&dbm_d=AKAmf-AIQjdc3ndhS-fkdd0yGIz5gFvk-WyvPF6XoGBw_Is6IK4XYpCPYcXyHAnC6_jHxu10lYQ1OI_XAYMyw-5-hHzoUcYlfutjlEYa0xXDt0JU2lZ8AMFxf7oxjI3PmmA2mOFFGXRq1ZUyf_XWlyrdTFtW_os8u_cQWA_tPVq9GkZ0EUURiSfo4Vl2pmMuwQ2DJSE3sQe1_-v2dfttJuVDW7wNGIedbeCf9I_6PrTxr-hKylHEfDJ7HsGifm5LULVGPAIIZp7RU_EOuXeieBnB6LKbPd2YUNVHMACf8P1vRGSzPCq3x5cGlgYpysnk88TwHWmWJIBuaY-0Lkl0mFMwpPIpL82oftQ0c9LT0q8hKEOBqvdw_wL6_H8fTPvbqd5vKKCs3C2-IjX5JkDH62oX4p8qAkjDD7xeXF_ArpPfHZOvsFWgA-Jkm4mJ-6FxJyeGi6o1i7q2cUN7qHR7GW-q1B0UB66Oj7MUglTRMfsFjY5yQyVyO1IhoPvhwbqDT7RchQyZZ9dVAEx2bp-uJ_xztDptJXwcxtPb6wwvtUXm9uQyCVDoHrLexvG3Ek7qN_p52YzJksP_Xk365uRkcuaiVBobgTEHqu6ZZ4qQ7KFwjF1GqWFJwFRvURdkMyp3NWk3Eaf_U3NBJxhXrDigmL5NG9b-e1TaJ-ZwQi0MI8Z56Dl4tpAcli6bAYq4wqDuIx46SYjdUWHJhHN1ut0GABMLbdJIbK213wxFNBPCyml3xs5IUcQijFic5b75NXGaSHcqnkX-BW_Glcycjfpjm0ReBAFmeukApFJMoQJoMS6erTGDJJBilLc3EoeSXVL_POaNgDtZbUAklCUpsCKrqjhHTeBAzzPStv7WqGCLdgUimlak6o10HOQIWEI0q13yb_wGqNEJTRobsG-IbfJQzjg1LH1WD8umgrxA7nEct6htebZcFB3ub4-LK7TS_gi0hrK2UHSoKqTU7uopdmu-3pecBL1y_-VwRrsumoP6TeQRdgn8gtnDp9qlCpRs8mdpgOObeRbrnqpz1r8jSTIAXy_qSrOFiWwiuV2Dh12gUgwi0XwUjYnJf6AiDB4jnSYYAUWOujbudpsJq0Iu8DTOPb1JibJfhbZW_9L7O3sIWx2Q32gPMSBolCJPOJkAPukmIz312MKs8XEB5aNC3UQWwRDdhATO3VuxKBn4B7P0ePOgLQ35rAUWmxEWbwdM61cPiL_2uslEO8AzagtOXdMb_LrNxbys-6gb0ExGgqN4Mkt-dPmtfzHAqfql7gfMoOU7y3JQISCfly-74vDHNtGp2909aDZ4c2jEJ6MCKb2QkSoqf781vCWhX_wbph-YZ5c6rzzsvsnY3c7p7i66Pu6GnaBS0HaNNoYs52fOMZVZXIQMWUU0th35gjKwZQzxHlvSv_KLPC8vE7hsnTd-QLcI6OHsoHmK1zf1RPLVVL_ywHLoW5hvXiicHoLHyOirF10RkC8meXml89jfBCRZN3xyIcTyz0MY-lTnS0jVshiIoNj7oQZ6gbC2w_Lz28ywl4dlmWGRP-W5BFhsNMgzyrYEmCLdlLiwBaP5Q8EZ8mmEP1LIhcyF-pap1o_BpXIF4eRUv2N0ejNkbHqxS6v2wJGNIDQkvhNLnodLMQGUuWulcHtTC5gbLZC10aDg4FcdWORkBCNuzaeQNoOG7jd6q4Sjs776hlKhfzYAHWROk4k1mDbKyo9jMBVT8X1_PK_4Uce1tczp4hSkqbTHjt6NhaX0PfjuW4lH-9raSJH-YEwhnqxOJ8DjiIMpfKDKUc6HgTywWo_epIszPoeCiSC-_qwtT0HR4sZ94esioiT1IAvhwkyqMWl4GfBb5tfxGuxHB4tcNCU1BSypglEH2-ndpvZgoNP-pTcjRHWQAbakUZF05YvgV3gGW1XoJJPjDPQaZqiGpxn_KtLvv5G7YQ29T4slXmW6AwJoDcf-X6tC8eek-pinlSiCwwvSAew8taCo1X_RtDOlFGHd89zRpFDDM2KYkW2QIWUiJf5RKXAwH7whfFHUehA2C0K1ZTBzWLab2YYje4jL6o6HW_KMGUL3WR2pRY2lznNbyo_32WOdzRPXzL6P5-w852sl4dp_0_5iq103nSbemLqXnfgBXgJV8mcZOYJE1BemSah5CR2ph3i86Tp06omq_Q4x_w1Z_fNUqXYFoyhmt9zAZ__taqs7DCWL6UEbvU1tKSRFp8PNAct2F0odunjA9AGfQR93YNvXEWy4V9gtTg8gDCl1vxfbATg-6gh6xlRihixCHvX4Q-bBu9at4zJWH0o7oDDQrPYftXIINwtnhdRV5bDr_XCAwX_5FNWkZT3Ky4gwpFi6pzax8TcM09o-KJVgpotZfakyQgl8EAKKDTGjU-UaCIjyN_NGb-U0dHIIQAr3Ucw8Og3LqPuBB1nWzHapGHkxzQYvikd-BxdUiswSL_4JajeHa3Q8MUkga4yVzrgdU5Zppq472XDP7e5eYyLnxVIrZlTfIuxpgKVp_JyYLJNI05Bjno7tAGrPeMB0DeC-_Q6UMRFtlF9NxA4LBobFDZ2Pa6ABcRNh_RCOMVrw_eoVmw-btkrXquLRRIWoVD9L-L-DhC2bXEoZE91dH3Ohz50b2bfNudsSn8uryZu2JdgL_Wsb1ovUyEsoHmijkxwckm_DpB2H-YnnudU6YmoSg_Yh3N24OVd4-e5Z_n-ZBkenSmnW636OjjXtm0cJR_Otmo6HsIBGHit_xWH74H66H0gjgjvaKOx3Zfya0a2xDPGAjza08afnaxI7I3y9VTCAAL95w9tySJWKuDAHYyQplDVaG1GuE72zDaDB4xuLRRs1_ketN3uUN50xXHZfALmddzGO0KDlhIqtGtDcO4iwAEE8kC3VKLJdMQkRZUveEqmk9E-AFzBj914g9goVTVhTbqm7cKnEamUMAqQt2T03Cow7l7mNZIH-mZxq1n3wWcN1hBVYJvocrjHdF9f6CuatONQrsIf-ht_uLeNhdO1L2CkpF_EKEzxui_RSLGFyTvwJmvjhETLh25Yhy831PfqjZrm5ylnJ_qOej1Za2qcbKZgQT9HTWbjEDePuJg3n19Xqgo5GcOGxMgGH7X1OEz3LxozdM_dEj91ECKWbtlJYbPP25JTX92v-4czJH2FqybNkMj05nuXAznji8MLnClfUdu3Buy45k7h2alTRChRKUxNYljRSLq5ELoiSto2lJabOobV0Qymg9hU_JqJp5pIFX_WoQF5KBCwv18iIYvx_NC-h2w_kKfpN3-mULluh5mkjIXqqWB-oi4ihpTzcntOFhsAgqrpYVnoHRIaVdssTn2o&cid=CAQSKQBygQiDy2rOiUpyxgfxP-VCpDejv9cuRHT7GPFh7Ze-z7Hhq4MS6QR6GAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=5982605649199138000&adk=2515327512&idt=165&cac=0&dtd=14

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7160ce9df55b0a7f3fe46dff70789eddf6b8dba85b931f9d1ecbda8aa7d2f67a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1231661633440980&output=html&h=280&slotname=9134183485&adk=3378407940&adf=2021203405&pi=t.ma~as.9134183485&w=336&lmt=1685634514&format=336x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634514084&bpp=5&bdt=1647&idt=5&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=551&ady=3160&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=48&uci=a!1c&btvi=3&fsb=1&xpc=ih4ds9qhg1&p=https%3A//www.farfeshplus.online&dtd=9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36229
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/ Frame 8AD6 29 KB
11 KB 37ms
35ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BjISqUVEz3oYzjrbR0edcAmLnhHoPE9fZB_JSSq4W3T_aj8nHWS40swVDbnYc6oL_Eur33cXPDIw-tIGLaSc8ock0VCw&cry=1&dbm_d=AKAmf-DMe2QtLlYirDcfZYcUPjv33o9MOKsOAu0aQiKF8glkMjOgbTmAxqvJz0lru4Arbcna4mTGMKKPMDJNB0rff2NNbNkuat9YWfNji9b-XLq548TBmkWNBA5yHvdCl1pntAVqPsT5kB4QuSKPVj5rir-KTMw75OQdO6QO46_UmE4Aqpi1BpZs_65ltwJya90qADKXapvyESYe6N-WoeQILyBMjCp0BQTTQ-p-hSlnvW6L9nQNJAc6ydEomByiwpJE4YkkpAdU3MjH_2sa0hv5Lh8TWoDeguGOFhuz1TzuydKzyMSYIMr_2yKgcixskD75kOHgvRu8OJJkexQ295eKNM2dWiQyqujBbn7Cgsn6gDhEMqXDv_Au336y7ZRd0ewcK1ddRDI72KnvxFs4xE6iQZv9TtZx-6ivB3R9RKieOiIJubDOiKIxHtcZT2y_SRKL2DveTZ8Krw3z_7g6-HX0kUd9kGe4kDM-4iRLpM5pm9lpBBfxUrdM5kZ9FJ5dXnCD_Bi4WBrOBQfU67UpeCEW08vXlB0P6KVUSaFScTugZdMyyIiWnNXR507SmD-tVV6yTDVzMy1t2cJpUG0pvWbLsWdxAHa-ga6D2Y85orQGY9MEJG22bABOifxb8cxENNJuuyrh0whblflS_b5Kj_6UX3JK8Oz3ubgr6N6N-QJ_2_wKV50iHwwxN09dmndep7UvCB5Hc2QuoHEDud5lYKpi0NFbJ5loj0ToeWJHg8WVc2aqlKpWarYicdRP1lrdMugusknyCOOm1UKP6YMCl2Xnw2CDARcyOsBNeooAyZiXkLcu4SQnDdI_cvrPjoglY8mgz9s55yUR8RTt3pgmvJY3jhRgTG-NYov5P4RfW4H-pNX_LbSh4XqopdzjXsCwPo2U7FZFyllb5u_0skwUlH9YDW5CXI8T9U3LkVuMj7QIEMsYdFB52tz75E6CMzPT6qBTvBerTCKlMGdjZpJ7NRrOz80-B0WVLFlGintRhILCewwlX2X2Jayb8grUE__a9c8F0woMTULWPPfc5eS0vPGj8UPpIsHEBvBYfdeM9wXh0CkgY1qzr1k93c6ZhPjTEQpzdbYK-2lLAnO8pBrZXoV2v7anVuDzsDPIl1TiYAR9G1j_8ey1npmh1O7V0ZcrBemodWJgTPntFlnfNl2IB-_oIsXrhSGwLNWNTztzxglPUlOP1Xz52nwP9_VPKYcbSIG6FlT-9eAmE8XQjgGQRbv5fotRuBqWoDg0C7fDzlLdOd1Dq2Pod2VOplG7N7HuoJpYrGkXEto0Br7zyzETJtgjUupPnNNnlbj9ygVjSiPHxL7P58ePWwOGaZm1K1nukdKPGAXt2Nt_pVo6rLwQzPAQbVFSAS3rF-YkK4S-PoK5ksvT_bztIN90xoBHsbWMcIihXWp1i33Xg7lqF8QV8no7CE-9BFciSwALvH_WzwJqabp9y78hP1xxeqsTu_3Ppnkjovt9vvwhkPPtMx3sABqiPnQPxQw7reJYGxXPizs4Xj9CBaAYO01M38F6zRYhmv62EO3GB93HUkMdHxTR7Ix6So_2IWd4Bmmk2Ydf1ObZafEMtmQRiPmSLp8_ZVuABOoYk2InMIChwgJwemwH_mu4tPjxT1QcpfjxIZXqEsvIUfNC7kYW63G1L9CjjonoTjdyHBzcKQhmYpKA2tRBaeLXfD8RGGUzEP4UEfp8QWFrqQpGJn-4VCNWGCkpORIDLFwVaN18bexrJXmKdnzC106MFHkUDv8IG6QPZ4eSM6glGzlClvwNhBIdiXo0kMcX6sYwQ3aJaRrPAxOa_GhyE_aMuOk13Zh3CllCxQI7jtmIUw3WmbsdyYRvG37jf-usl4So2aINDMCq5h2jnwXTiTPKA2MXVDJK_KaMhFcn69xZQEAkRxG0I-HHWUqVqNybhMhGPka8VGjqCv8zrNZdDo2LnnZCTw6hKAdi6tu25nX-OGqTNk7G9k74j32a0B_OkcgkWOdHi5wSSqKWpEZ0ex7lp9NUTM88822WFNemVLHdP8qbUhciRvLTyzbIDJJJXH3HscWAGv-QpW7Ahfz77CBEik3d6kro3qpFKemJFVyqQ69FUzQWTGlVr5yTSIOuLfT7R5ZE8uWtj4QxqwjG5xlhYFEXYKPnfaDFduXV2AON-hm04a_3cZJO9Ngflf7LHOJ0Sxt-YKdUoiz-6GR5GTHSgKuvHSKHjHT7sf1lpjl0fk7PHBZ8kxBUNkorNuDFfdzZZ3DT9qS6qztCRgbYFzt8jBDTM5R9ZeHfqeK1zeaPPvq1aOm44PGwu7KRWXFC_vKLXZOfAHkSjHBl-h2OjqYuCKOhJsiKHDMoMEF8dsHOukvL1qhcYYXPZcpTFwtf-DW4h83q7fcYPN-ZEzd_WH9BKruHUtibuBnEWXoq68xzxmhk5bZxSsMVGKACbGZ2PhXivVvyOEEwVQbLrYjBULnt2V3Ay661m4CY4D_rB-W84O27Y_DL_SSgXoPIckYSaRlfjxJBdiACpZFiitqDEr6IuWqi3cmrohhD6Bv_7tku6FNs9nrqyHfCKbtLDyfq00302x0-dxHWBZ4BYXwwQ1g8GoWmTF5w-aNysknNGjc0I1OwDpaUTkv-Y-4GYhmB0MrIBnZGnj9PtFh2tqKwUGuXZUNOs3_HyXaUOON8K-dm3T_93ym_9IXmVX4ksgirdao1C9--Wm1Y_I10q5qhXeBFKUppJWLwzmd8l8GcvaFoDFbZ168D6HCrCWsMWOwMdNesYfFb1W6CvIadgxOO6eCqzi83KyODNytwEntvh_V8wE3TXblFumRp8JdK5CqOrIzIio-MezWCbacIfrOckup8VRtQMOS9fhvTTDAukGaDMwGnjdaf3bmgZvJS4Gs2PgdlCAr5trm3QGFXWjYEuIC2TsPjxvuKKfRUUVhgCrn5hXbnrnsrdWou3GK7yCQt4FqBkTQLbwaWe9syeU0Wmc0COjiXrqPwbd1xTUKzAg-ANYmIO4QHg4yy7NS64fQ0o4qgvRBsnOXC3giPyMnWTuUStr0Sy6e7R96KeEeo-VYY96AQWQgHQdykUjr5QCx00dMkNyLtCDBV8LjuPc90O6X56LTGRIXcls-KZUKLj5v8O83mGEVzzCN0McFvb7BipWhyKNBbpfMrkgi3tBF-7vd6I0j-sh_ZJM5YdIqTafQ1XysIxo0nIolRqYKAwQkxJdvULfUjtR-6jqB0y4gc_G6ArI02mEWl7pXeU2HGPpukMjEdj-02PTh1AgbAPuiKrUVOBeaDFeqBFKMjQxUaV_mJCmtPSZkh10CRsPPjnJpRnafpW2SHC2f5Df9g2-qwFnTlTxCf_7MIk-MSKwjv9x--OcotOoE_JBHTOj-e39EIZn3xIGLv6oT5GS8-gFMjjuP4b4NEXS9vSd8lUnneYPTkB20dNhZ41X_rGhpVSBUziZh1JdBlabfkEcgnFsCojtUFpO5sOnjTl_8itXnrm4bxZSridmY9P61lmMu9-wq8YYufcQKY7mo&cid=CAQSOwBygQiDIssFOIk4-Fuonty4sjxuFK0ZPNPvXTkR5QIacxNi7MEv16s2kzWYiTgPjvWqPDeavT6kFRHQGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=10833528017972093000&adk=2265872549&idt=144&cac=0&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a91fca903f7f2a3d051f657b5b25baed4e99b6c1e51bfee63737f73ff54f2b7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:56:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6700
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11027
x-xss-protection: 0
server: cafe
etag: 5492578185836041520
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:56:55 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/ Frame 8AD6 11 KB
4 KB 43ms
41ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae8017866a6744d35f26aa9da389e9771d40bcae3ee65df4c1b5e16e57b09fda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:56:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6703
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 6053914914909336730
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:56:52 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8AD6 0
0 494ms
99ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstQoGRd6OG8gasWthEsOEaBlkRyJGrgjDZPNFq7VZpkmt4vHrFEqDCM4HnAF7qbhtjJLERYik2c1zrI6MUY_YuPcHbyzyxL5c7tx1KO6yvEke16skH52T4dDf5lLo3HZTFHyndmSCfXWSLjXO-o3gUh1PrbTBXwFrQO0wqtpJFYP-TtC3ExFX8G_0LPC6lYT7zfTUXM7S7c0BHbN3sGM6JKUticPzLGP2pOXUyWd4UGGzIEiIVz2s66f9hy7gKuq9e9Nwln9QiPMXuQULwmozlKwJd0s6rNzph7YFGgeGWrpb1UGEr5kNUmGXLU3NqnDwivbnNEYQh9V7Yhe6SVJ2SI01EfLJNkizGXlqY0rYPSlNvkzeWRSGNn5bUuc-3dCDHriU8rUJo1D6ektiWEd3fXNVno7VGVlRZrr9Gg3G3FqoYZSuvpSOcfS9yAH-VYpbSf68km-Dex4xvQ_e989baa-dEFvljsL1c6LLUujOT70CT4kxeRZq0cpcJhDxMz827Uq7H22oS9A95Lq-G9TlzIAvamM--oez5yi55cLvicAFw_HJ5sfCIitg1lMMQGDj1TppLrip2dXCKfZNRKC2DpfO10fYl9uqj-bJGAuhFDHGl9cKMuO4Y-Fsmip3X9utRiIw1UZYBgD5PIP2w6F7_wODiz_QrA-d2HH6hO6aU-K0Rl_3nYBQtIdPxrBudUsF-GDKqBK475XqNnv9FhZ_Qhh37spyZIzfha2YuLavxnCuLeKCiJPMgD0DZzFCbG2dIDUXEvzcTCeCJI0Oa208LxmX9LKigJM-bvZgsuQJvFDC5ZaVSSCvcgMVdSxAxbdhEnMrk0ym1rb1rjCmekNE414c1iKtniwM11wXVUyOEvLBCPPJx6whdVkkKsz8rRgmfsO4slYfXJ-iHmkbAZq1J7WalAfWg7Jdw2V8XpnFavj4rK6RxVLA44Q0fFcu1oapKd9e9zpOSyJwXhcV1-8qLx3Xl5zValwkFGAQDu0rTRGWk1_TzrpvXtG0XCy6N9HqLIIJeTRah1DHNN5FwGvm7GJCg8xtJhMubsi4MiAR_admi9_PzeQl8zyiwh2WfXSql0TuguCDDeZi2OMHrmYD9Sntrydas04bTwggmgVL-zb5mpwYHVKFsCVYIe7PpTDGWfUFwPdKx-a2nQ9F-KpPSeWIvzMdae18l6bNxTVcAfAJAnwJwhV5wMGRzuOFUuHM1mL5u2wz4TX2gGat_KcFZd3Iri3QtxVwWwpUQmMCqUZgMgZYCwbamrWTnPerY_xTuB8aWuEazSaPD30HrA6MGrsNvneaE_c9Vy2HgCOXdBwXSollNH7ba9L-uZai8-2OXYJgO-BXhmWyaQTSGeJZ2f-BpgqGOKFX4&sai=AMfl-YTqKPuaW-S8DfN8CpwcoCYDXFsNpkf8qUnoZK25FHKNowHxeLXu72Z59o6lCSBikKbuOesyPuq-W5psBzHY-2echJLY72oF6zevI7oPbYNAQMXPhs-sHfIPL4ssd-rlwiH7FGhRH9IMpOp9GXJU1A6oIz-YsStGrcHFbplVS5aVJ6e8wpyPP5OzdplPyFsUwAGKQtAQx8svWYlR84b091OdVnqzPElFl4Sh0RdUUHTBFc-SLFVYyYtv_Z7HTt0qIXJr&sig=Cg0ArKJSzAGDnNYkc5SEEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20230530.95307&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 01 Jun 2023 15:48:36 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Thu, 01 Jun 2023 15:48:36 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 8AD6 41 KB
15 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 07:39:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 202142
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 May 2024 07:39:33 GMT

GET
H2 200 8159883083483140603
s0.2mdn.net/simgad/ Frame 8AD6 77 KB
78 KB 388ms
37ms Image
image/gif 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/8159883083483140603

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bea024b4b00a371bb8aec026d81e452928e720b6aaa6bfe526260b5e0b23098d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 07:52:22 GMT
x-content-type-options: nosniff
age: 28574
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 78987
x-xss-protection: 0
last-modified: Wed, 24 May 2023 12:18:24 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 31 May 2024 07:52:22 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D56B 0
20 B 74ms
74ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=9751046546206&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D56B 0
20 B 75ms
73ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=9751046546206&version=m202301230201&ct=76&x=1&cor=2198531392341991200

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame D56B 99 KB
38 KB 102ms
102ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C2T7KeS3zBuswG1rNbMbbYL5AbzN8xfFiqtmdHmyEYC5r4BjJ1fsWTlKWCsrnGzsB-Rzt-W2Myn7XHbl2zHmH2qqwgElBXI19GB5XbSlvoTK8D4RusiqopnpULspmqX5TGHJVXAyuTOaCF4Si4r_8wPBx2xkpo63_mwhTZSe5HajhUgiw&dbm_d=AKAmf-DaHLCr6sW2zqEU7H1Js31yRdN6z3KpL3vODKl97y3cAEskCsiEyPRb_obQOv-7Mq1Tm0LLE-69U7KzIk7FJA_Guhz9mXuCd9mfd2eMBpj_gZAVaxhYqEc1LDsZZRmUQ7Gs_WwdJRQJpQICQYBIWxGtFZKcDEH-XoheXQeFYgCfTzMTPWkq3cfV-tigmcxjznylJM6yTkVNU-YsqjvKUJwcILkyDG4sxG8zKNCOzQXLAVzgkqoIikB_hpDSScGgbcGx4K4v-KZ4P2qbl2QhFwkYPQed0CgMEVgOcM-QQxy7aapBqVreX-IvuzueCwNZNKjp7QRx16atGKBFyuggGjClySJwGacgriWtlT25Cbd26gzBmzwN9zE_QqCtDv2AI6buFKW_ddXo5R_gR4SHfUlsTmNf0-H3x4uq-liOyfkWrshdaNb_t37P0_iyGGpJWuvdL8QQqTqYkTuJ9eYXLdYymxgrvdstT3is9XTerVCwao-F3i91zdvcebp5dbK2CFDVYeKZzvXxTVnsokxaql8fW_Euz4HnPkh6qgI05Bp1E_Xz2nlypzzrDTao4ZComGEzrTnBIlNsVDo6IEzI3Zg3QjWBekrV2l_DzhIJ-Dcc4wQHUeSSkCgkiNPsTNQbdRdhqDAsqJbq4rRcNvstBlv9_M_Cl3MmrvrKhFJLtfAOARPBffCaC9_3CNtH9K9PHdb4jfqj1XNDC7crcxpMs5ScOdwkOjM8fS4ESKlh4pmDnAV8EcHVtazvTudHQowHHXuBRzNtPyl4Af5HJCheeti3gVqjqBykGwQVUXvAbQTwk-iLHSl2Skf4-MGW_ZCpMx3OMqUJfftWf8w_18EKAVF1-Kql2rEZG9oSFsoaYlNYqBQ1EfGblQ1auxJ-Nsc9jSpSTrJJuRuysBcMG2fR-C8fYrm3Bd4I1kkey7SW9sr8uw4ALAXw2fqdNetQ7pjYCeOLQziDtU1Hy9exC0ZedOKnPekGdpRtIJhBHx0Y_isKsfCqrssnmneJbr7wFV0Zj9D3ZO3E1edYefEs_TbjJwa6Js2GY1owiG9UyL-4YUE0Msf_6g4EABtyDJlh8XSUAO-Qi6zBX_16CSbbdkN2tbb50Xp3hehGOw_wiPnMTdao4c-MB-C5joVW8mfL0jJzUdPzyMx6RP64PuUCKeeNJFhcTpeBUsprCDb7KdzDv-7mjl97YFy71VaxME1gq0_jaOd30xb_gsn2j4FoRaN6gLy9-9wLYv0O7uUzcf_ezbz57w5eCPcqcVWX6ECPKPaaInZQK-pdSO6m8ef7J_-jSufHe1Bc7UpunrSRUyEoEzBbeSh-s7xNnenl8oz2AefkvapYf8fQNd1QCHa67Yc8B4DjD8GgT0KJKZ55ojIBdhkKn85zZQ_wED7qdOAwtXqtBLBIMSR9o3g49Zp7BkfCH_9WMJlx9shuT7kCsuNETIc26R1VanuwsfRGpcQFKGFMGZZger1wY3hac5dDFLflvvAPrheZOvr3JRyb-hF5q9XhgmTzVL9NkGCy0Jr6O5KGjrcEwkTFik2kRO86BJIjrIevvAdrXPs3D7Yv0ZZ0W7SQvCTzvHEP4o8wQee2LuuLXqj0fYdTZPfaII-wmjHrH6fZJBXduf8wAlh5pCPF_uIWYA3LMm2W7NpJDYB27l0hTLa2H5lxd3GFc_MzulKX0ZUPSgcHav8WwLgypjm5zav3D_UulPf_tXRW029vHkxCZxphllpQmteDoO7oAEPe9YMQh_KZ7yKphckOKJPle07Q4_weSVaCn0Ig6VIgWDsi3-Uebxs4E6z0TS8eAnUxrhtIjOOasRSgLEFznC5heQi3nDi8c0wHECqh3p71EZSC4kZbUarzjU-iZuWZGkmXIOPHMv22nagnKRYRA9eSHxxfo5hbMuOABaiV-HGv7FzF25tESPZmSyiLtvrOe7Jt14d6U3K7BnxZ7EC8k8ksBpvSrXotjawjIlnrX4WNMbD87pQo5U2NYbApdah6UUn0UAizrj2S80VzWJ17ioMTmPG3njAoofj4dUKcyMngKsTfk6EkbzzzFKAXBh1wwjWpRyZKN89maee4nx4GE1rUscHQQqLPbyEK32a2UIqBtLWnDygMUh4CZhYi1RghLB1G1Af9dcALSvuQGGn9YW9qYOBCODmAVR_dy31s9Tm08Su5gaDWyFlli8YK59NXKo75de8lwDPc-SRktYAney8oNI-FDG3wi2zypkcRjVOf6hKrYO2b0AnRiSTwwra9qT1p4BRIQsIpNrAsBaN0WbWZA8Vvj5r3wsk_3tDWCUMm53t8k0Q2z0O1dfeo_ZzZ7fz6v5zb2o0B-7O2K9nl8KNQp7OYHtRtqV5-THJ07H3Fq4rQ_wknvVHZwa59fCHbSSdLjS2jozpmIdryC3zRguuDUbJA2mpQcUq1L_d_zR1G_NC3q_KLiRMeaKztGx6ef5SbMSj7669nqWXfsyIBj61qCj3Knl172bZ9YmL38-q4kmzw-nSCqPpBPRgOMRQDkC7MZniLG7C6Ory3ZobyjNLrIUuQERnsQIOypJ-8sdbUJksI63keMaXpOV0l2VZBc3uyEkpc4D8Nmt0yXjNXusFGrG0CAsO3ICbj2zeW8KCgjsR-klt93rfwWu6jsu9msFcHUjVou8kvVuxPmk4aOjm04132_DMZHLVVINbwEa8PxJaGzvqVmmb_JX3gd2_dUS_fpIc79WChH6qIId97diJPNVCd1Pm-hQbi3Rs8zyMLZLDtNEA60jQpz_3vqcYRCgjv0_mOhv_cegW5Ude7KhfuHWzuj3GiOmZ4ew7olUyd5CCUzI8rQUaapYfufQFXZ_0nOWg2jzDPDWKmgH0ZtaQQiQEWq0_z0v6dWbkrqybc3nRjOi8C7f7oaPiw_Qpk5fjcmzFLOkJHL-AAlYe-js1Oj0U8wLUqxa_vltty0lYqWup3zSLW3hSkvajK71UCrlXOqs0zNbbJ57jLUj1Uc7LdowbHXpRsIx8MvKH3_3w9yWBwoNQmd5NAICDY3tc4ynJBEv9EprZ989xnfuGjglJAdwjvw-zRt0AxOPHiW3vR_iWu0eYQBGrIVDcVeBY5zpSfZd8H0wSrKrQmwgmRobqeJl1tpuk8HEitJO-LF3bwElX-N09jwYnZwgArKZIwTC3QKgB9h2nID7V8PIGjri3FGyByWjOdzDjpWzQWAcuSVtXwlK5p534eVH-8cMTphgaXYVvxMPD3Dy_bnkojUWl8BeiDX8jWnG3GSWMoCxJ8GBLzz_vy6J7yEyMzfCAi76eEMS22VIB5sfo8nav51sYhWnW_wLMhoCcT5XZiRZ3Iw9yuraZ05pYz3aiy-lHDdZh8uA03GW_CP7xYQXbl18vLnoUNeIIFeC7IJeYLl0McFQTcqcPKIWJsrV2thshOvxZmQY6Xz_E79rAmbOAO8AqMPBmedONZBpjnkf3Y3dpUgRMtHOYR_73i_rnR7ODH_SqAalkzHUdsKKB00KaL8SHVEIZg-ESVDbXWld__oukE17Bx0bJh4jBKaBy2QOFA7W_LSH7YsVdTQsvLTDYYX_wbFzWeUxC5h7ihmDoM50IhvQV16NGPpxnO&cid=CAQSOwBygQiDiYUQb8fllV31P2p3pZBATAU6K2BIKzhXw5sxWPCiaiACe6iqWIQ-jZt8nFELlJnwZq78Dk73GAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=2198531392341991200&adk=1033480531&idt=320&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

218b4dbc6776858b4ded067fe778e5257358e58b28e64f71cac33b435016570e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=250&slotname=2097210043&adk=239546933&adf=744370384&pi=t.ma~as.2097210043&w=300&lmt=1685634514&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634514177&bpp=3&bdt=1740&idt=3&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D76ab65cad0aa0eff%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_Ma0_IwpMBOi7nj9-q6otQoNKDc7Aw&gpic=UID%3D00000c3a8e3515fd%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_MZpfKIRVVeVVB8cjAISCX5v7pmlrA&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=569&ady=3955&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=50&uci=a!1e&btvi=4&fsb=1&xpc=PCTYuyO1NN&p=https%3A//www.farfeshplus.online&dtd=7
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39191
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 4CC1 1 KB
643 B 42ms
37ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1685634513&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513703&bpp=6&bdt=1266&idt=6&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=8&uci=a!8&fsb=1&xpc=d1Z757MIFV&p=https%3A//www.farfeshplus.online&dtd=11

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 77604
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 18:15:11 GMT
etag: 48472445140208031
expires: Thu, 01 Jun 2023 18:15:11 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 3BE5 1 KB
643 B 41ms
38ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 77604
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 18:15:11 GMT
etag: 48472445140208031
expires: Thu, 01 Jun 2023 18:15:11 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 767A 1 KB
643 B 43ms
38ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 77604
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 18:15:11 GMT
etag: 48472445140208031
expires: Thu, 01 Jun 2023 18:15:11 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 adchoices_default.png
static-de.ad4mat.net/ads/img/ad_markers_folder/ Frame 15E3 3 KB
3 KB 82ms
30ms Image
image/png 2606:4700:20::ac43:444e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static-de.ad4mat.net/ads/img/ad_markers_folder/adchoices_default.png
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/style/0.1.40/one-ad/default.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:444e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2eeaed1b310e214596abec926291c1a41c6333ddaeac312886fc0b5930d71f0e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.ad4m.at/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:35 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1543
x-guploader-uploadid: ADPycdu_bETbAO3L7E3ZwmLe8QxiVBASGCjfRAxwlm_tkXJYko3jNEaJxZb3LISJ1TPqVw-ds5Su5eyQQRqdQCYhbG3a5A
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
content-length: 3262
last-modified: Tue, 21 Jun 2022 12:31:17 GMT
server: cloudflare
etag: "794c84d30e213ec6a144d64215f07551"
vary: Accept-Encoding
x-goog-generation: 1655814677405990
content-type: image/png
content-language: en
x-goog-hash: crc32c=v7nNsg==, md5=eUyE0w4hPsahRNZCFfB1UQ==
cache-control: public, max-age=7200
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6uHx4Igyz3nGm0Nv9%2BIrjf6d3fM%2BpuRYRddQ5WIXd0w7HVeuiOG80MCMHOTRu6Q6cCc1pqXK00rHKTXKwpLGAnPHbxBWtywW5yYLG5BAL8yRkL%2FvOzICU%2B8MBS0SgN8%2BU2sfC%2F%2B3YR6gGqPcoSDTNaOx"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 3262
accept-ranges: bytes
cf-ray: 7d089a0c1b5b3656-FRA
expires: Thu, 01 Jun 2023 16:02:49 GMT

GET
H2 200 adchoices_default.png
static-de.ad4mat.net/ads/img/ad_markers_folder/ Frame 5159 3 KB
4 KB 80ms
29ms Image
image/png 2606:4700:20::ac43:444e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static-de.ad4mat.net/ads/img/ad_markers_folder/adchoices_default.png
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/style/0.1.40/one-ad/default.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:444e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2eeaed1b310e214596abec926291c1a41c6333ddaeac312886fc0b5930d71f0e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.ad4m.at/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:35 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1543
x-guploader-uploadid: ADPycdu_bETbAO3L7E3ZwmLe8QxiVBASGCjfRAxwlm_tkXJYko3jNEaJxZb3LISJ1TPqVw-ds5Su5eyQQRqdQCYhbG3a5A
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
content-length: 3262
last-modified: Tue, 21 Jun 2022 12:31:17 GMT
server: cloudflare
etag: "794c84d30e213ec6a144d64215f07551"
vary: Accept-Encoding
x-goog-generation: 1655814677405990
content-type: image/png
content-language: en
x-goog-hash: crc32c=v7nNsg==, md5=eUyE0w4hPsahRNZCFfB1UQ==
cache-control: public, max-age=7200
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f1vvtP%2BTtnKvkSEWMj40O3AQxMgSGIGbzVNNPPvi2PSybcVcXv%2FYb%2B8lNY%2B2ralnh3OPOl5xFgmvQfSVJezuGoK9n6NWzgoQxstWnX%2B886YOw5C6zQLz8NwaXe%2F2a1xP%2BQULHVaxE%2FtSbJ0jxZE8x4Pb"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 3262
accept-ranges: bytes
cf-ray: 7d089a0c1b5d3656-FRA
expires: Thu, 01 Jun 2023 16:02:49 GMT

GET
DATA 200
OK truncated
/ Frame 04AB 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7932169f585daf37d86339e4533e35a35f8b164b2c8e66f1d2b2b73d0d896756

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 9E03 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d3acd698a6e3494102891ff69661e075a89d7ac8ae8f55a2d030e1a4848988ae

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 8AD6 220 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 09c39ab4acdf280b1eb870541540e181f644812d232418bbc0e0e5e52b7d18fa

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 4D10
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEBis3XfB21dgDLdWZNU4af4&google_cver=1

43 B
107 B

44ms
38ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEBis3XfB21dgDLdWZNU4af4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARjPyrHlATAB&v=APEucNXg_jEYLFeFQlpOknqlgXJBB_Qy8ogYg2sb6T-Cf0n3dhrJLoEYF04h5Ovc3Lo82wXc6pb-XYWzZ5xjbDF2YXEwlI9v2cZZASUHzLZu9ulRW6Flxok6CqTZbDbkGIttNq_t8utl7u44tJiXiOfbEuhphmE7dceNiMvdeSb_GU6C-tjAWUY
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEBis3XfB21dgDLdWZNU4af4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 4D10 43 B
121 B 28ms
26ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARjPyrHlATAB&v=APEucNXg_jEYLFeFQlpOknqlgXJBB_Qy8ogYg2sb6T-Cf0n3dhrJLoEYF04h5Ovc3Lo82wXc6pb-XYWzZ5xjbDF2YXEwlI9v2cZZASUHzLZu9ulRW6Flxok6CqTZbDbkGIttNq_t8utl7u44tJiXiOfbEuhphmE7dceNiMvdeSb_GU6C-tjAWUY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 4D10
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEIc8dOOjljOyONO7M2iZVsg&google_cver=1

23 B
165 B

42ms
39ms

Image
image/gif

104.111.217.42
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEIc8dOOjljOyONO7M2iZVsg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARjPyrHlATAB&v=APEucNXg_jEYLFeFQlpOknqlgXJBB_Qy8ogYg2sb6T-Cf0n3dhrJLoEYF04h5Ovc3Lo82wXc6pb-XYWzZ5xjbDF2YXEwlI9v2cZZASUHzLZu9ulRW6Flxok6CqTZbDbkGIttNq_t8utl7u44tJiXiOfbEuhphmE7dceNiMvdeSb_GU6C-tjAWUY
Protocol: H2
Server: 104.111.217.42 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-217-42.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

expires: Thu, 01 Jun 2023 15:48:36 GMT
pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEIc8dOOjljOyONO7M2iZVsg&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 4D10 23 B
165 B 54ms
49ms Image
image/gif 104.111.217.42
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARjPyrHlATAB&v=APEucNXg_jEYLFeFQlpOknqlgXJBB_Qy8ogYg2sb6T-Cf0n3dhrJLoEYF04h5Ovc3Lo82wXc6pb-XYWzZ5xjbDF2YXEwlI9v2cZZASUHzLZu9ulRW6Flxok6CqTZbDbkGIttNq_t8utl7u44tJiXiOfbEuhphmE7dceNiMvdeSb_GU6C-tjAWUY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.217.42 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-217-42.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

expires: Thu, 01 Jun 2023 15:48:36 GMT
pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame C6E3
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEBis3XfB21dgDLdWZNU4af4&google_cver=1

43 B
107 B

44ms
39ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEBis3XfB21dgDLdWZNU4af4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDkyTkY-O_NxQEwAQ&v=APEucNWe4ZE2IO-89hNkA1eJC9fros9wfu4l7Ou8qIzQIIyT5lPETuPcCMvERpCZinF55vhKPQN4xIM9P7ejuo1nbO0V-BFd1qS8CHRqOfAMeEbME8c31WOxK9ro16IvVyx3jnI5H-KHEFrQd2CKc5DaPUDOS9BkjT4NOsvJafZib6Nhi3xXrcM
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEBis3XfB21dgDLdWZNU4af4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame C6E3 43 B
121 B 27ms
27ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDkyTkY-O_NxQEwAQ&v=APEucNWe4ZE2IO-89hNkA1eJC9fros9wfu4l7Ou8qIzQIIyT5lPETuPcCMvERpCZinF55vhKPQN4xIM9P7ejuo1nbO0V-BFd1qS8CHRqOfAMeEbME8c31WOxK9ro16IvVyx3jnI5H-KHEFrQd2CKc5DaPUDOS9BkjT4NOsvJafZib6Nhi3xXrcM
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame C6E3
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEIc8dOOjljOyONO7M2iZVsg&google_cver=1

23 B
165 B

55ms
52ms

Image
image/gif

104.111.217.42
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEIc8dOOjljOyONO7M2iZVsg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDkyTkY-O_NxQEwAQ&v=APEucNWe4ZE2IO-89hNkA1eJC9fros9wfu4l7Ou8qIzQIIyT5lPETuPcCMvERpCZinF55vhKPQN4xIM9P7ejuo1nbO0V-BFd1qS8CHRqOfAMeEbME8c31WOxK9ro16IvVyx3jnI5H-KHEFrQd2CKc5DaPUDOS9BkjT4NOsvJafZib6Nhi3xXrcM
Protocol: H2
Server: 104.111.217.42 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-217-42.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

expires: Thu, 01 Jun 2023 15:48:36 GMT
pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEIc8dOOjljOyONO7M2iZVsg&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame C6E3 23 B
165 B 73ms
69ms Image
image/gif 104.111.217.42
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDkyTkY-O_NxQEwAQ&v=APEucNWe4ZE2IO-89hNkA1eJC9fros9wfu4l7Ou8qIzQIIyT5lPETuPcCMvERpCZinF55vhKPQN4xIM9P7ejuo1nbO0V-BFd1qS8CHRqOfAMeEbME8c31WOxK9ro16IvVyx3jnI5H-KHEFrQd2CKc5DaPUDOS9BkjT4NOsvJafZib6Nhi3xXrcM
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.217.42 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-217-42.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

expires: Thu, 01 Jun 2023 15:48:36 GMT
pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

GET
H3 200 frame.html Show response
ad4m.at/ Frame 9599 2 KB
1 KB 36ms
33ms Document
text/html 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/frame.html
Requested by: Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d485f783c7cc440cba21bb750ce67e191bce0783bfc6cff5f98e236e401b7ab

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 355603
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=3600
cf-cache-status: HIT
cf-ray: 7d089a0c8c7e3a86-FRA
content-encoding: br
content-language: en
content-type: text/html; charset=utf-8
date: Thu, 01 Jun 2023 15:48:35 GMT
expires: Mon, 08 May 2023 00:16:30 GMT
last-modified: Thu, 25 Aug 2022 14:12:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U%2Byr70ojiEjQJL5aLCU%2FknCOYMwqIoXo8p%2BKQFoh2BQ04DU3omPvDNxEuKH5fYoaHrJqT2raWOqz42aAd1gOhhuH2IkwIEDx9RXCkIwjO7sP5JmOkTH%2FMQNVahT6gHCuewIGQi0%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H3 200 frame.html Show response
ad4m.at/ Frame 071F 2 KB
1 KB 39ms
25ms Document
text/html 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/frame.html
Requested by: Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d485f783c7cc440cba21bb750ce67e191bce0783bfc6cff5f98e236e401b7ab

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 355604
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=3600
cf-cache-status: HIT
cf-ray: 7d089a0d9f743a86-FRA
content-encoding: br
content-language: en
content-type: text/html; charset=utf-8
date: Thu, 01 Jun 2023 15:48:36 GMT
expires: Mon, 08 May 2023 00:16:30 GMT
last-modified: Thu, 25 Aug 2022 14:12:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PsRVkeOjHBG8Ujhuh%2BZICl3DuN5SEq7otsonp33j6PNzy25z%2Fv7SiRdLkJIwN8omqoQuk2WPTHH0%2F99JBSH67%2BqWItgYl5jVGcqOIGA88s26QBrXeObA1oIDdtIASVpWInI3H70%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 7EC9 466 B
235 B 141ms
109ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhC5lOngAhjV_KnbATAB&v=APEucNXVni6CXJ9ykXoHfE2jMszQ2JC2fLTwbHdl17VmnntBhDooaJSREHaYoQuBb3R5ENFK2xVQgyzef3BP7ev2S1ZebEPPfFApOku0PI25ETFsGY7Wm1jyVDwy68d7k6AjS0W8rdiROe4V5HS8O-vClz5unBPWHRm3WLlnyrmGUquRBP3OOMgHhJ3oX8uuLXc5bR3skT8WN5g-5xGw97aLPYFPRjdVag

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

37ab5c060ae53ccda75b8bd212d874a17650f7954b11c4e31f568990ab40196b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 215
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 01 Jun 2023 15:48:36 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame D79E 78 KB
27 KB 146ms
141ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:36 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 01 Jun 2023 15:48:36 GMT

GET
H/1.1

200
OK

px.gif
d.adtriba.com/ Frame D79E
Redirect Chain

https://d.adtriba.com/collect?atb_ptid=e774d0b4&atb_dpuid=nayoki&atb_dcaid=display-pp_paket_m_alw-on
https://d.adtriba.com/px.gif

42 B
227 B

9ms
9ms

Image
image/gif

3.123.69.224
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adtriba.com/px.gif
Requested by: Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 3.123.69.224 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-123-69-224.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Thu, 01 Jun 2023 15:48:36 GMT
Cache-Control: public, max-age=86400
Server: nginx/1.16.1
Connection: keep-alive
Content-Length: 42
Content-Type: image/gif

Redirect headers

Date: Thu, 01 Jun 2023 15:48:36 GMT
Last-Modified: Thu, 01 Jun 2023 15:48:36 GMT
Server: nginx/1.16.1
P3P: CP="This is not a P3P policy! See https://www.adtriba.com/privacy-policy.html for more info."
Location: /px.gif
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 01:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/ Frame D79E 3 KB
1 KB 49ms
45ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/window_focus_fy2021.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:09:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5936
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 14:09:39 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/ Frame D79E 19 KB
8 KB 50ms
46ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3735e94afb2539b14515fdd10d7cc066cffa99d4b52762959e342295e08a770e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:02:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6366
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7991
x-xss-protection: 0
server: cafe
etag: 2412543371950383451
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 14:02:29 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame D79E 0
0 55ms
51ms Image
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTcnuknbZba19u1BK4i65zbXwU7oJhpRSYLvjuW-TvA4LmuF4JEUltSBT0YqjRe9FdR2DT7O2cc29V3Cc55SCUdGyNctQ
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D79E 171 KB
53 KB 58ms
54ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b108d10517b218ebb22d63ad00b85baf89a7b4f1884c3fd01eb03f0790b1cd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54276
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1685532878231373"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 01 Jun 2023 15:48:35 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame D79E 42 B
63 B 81ms
77ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CM6Mbeumwjmfb-WAU64EB9n6305QOv9ywq05O5xoU8UtjhggqSiB8VPjYdj4AuDJ6R9ZyO21ExBNMkAUOUDxPtG8YsBzQI4nSBZjNl7MDryGSF0Nk

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D79E 0
20 B 81ms
78ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=2436493295178628315&x=1&ct=119

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 css2
fonts.googleapis.com/ Frame 56B8 4 KB
671 B 52ms
51ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 01 Jun 2023 15:48:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 14:55:34 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 01 Jun 2023 15:48:35 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/ Frame 2696 2 KB
892 B 38ms
38ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:02:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6360
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 14:02:35 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230530/r20110914/ Frame 2696 22 KB
9 KB 46ms
45ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230530/r20110914/abg_lite_fy2021.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

551debe8c4f0db7b25699af72a204caf099af55413f90eb34b5f546330d6187c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:02:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6363
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8798
x-xss-protection: 0
server: cafe
etag: 11317101923912129037
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 14:02:32 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/ Frame 2696 3 KB
1 KB 47ms
47ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/window_focus_fy2021.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:09:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5936
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 14:09:39 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 1F22 1 KB
643 B 65ms
37ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 77605
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 18:15:11 GMT
etag: 48472445140208031
expires: Thu, 01 Jun 2023 18:15:11 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/ Frame 2696 19 KB
8 KB 47ms
47ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3735e94afb2539b14515fdd10d7cc066cffa99d4b52762959e342295e08a770e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:02:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6366
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7991
x-xss-protection: 0
server: cafe
etag: 2412543371950383451
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 14:02:29 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 2696 0
0 49ms
48ms Image
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaR9BhRVy1m3EXpuDnZ_LOdDdlbYImWiIk4HVL5AwedRLWoaZ31S5njs36Z0SEuVmGr3yv0VcXYkINGKDp7__PmczaqRhQ
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2696 171 KB
53 KB 69ms
69ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b108d10517b218ebb22d63ad00b85baf89a7b4f1884c3fd01eb03f0790b1cd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54276
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1685532878231373"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 01 Jun 2023 15:48:36 GMT

GET
H3 200 0a0369f67a094afc57e3321b90807283.js Show response
www.gstatic.com/mysidia/ Frame 2696 32 KB
13 KB 47ms
47ms Script
text/javascript 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/0a0369f67a094afc57e3321b90807283.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

88a51fe784c58c712a93f3f4e123e163e901042438df74cf793bdcf28eb090d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 29 May 2023 17:15:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 253971
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13649
x-xss-protection: 0
last-modified: Mon, 22 May 2023 16:52:21 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 27 Aug 2023 17:15:44 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/ Frame 56B8 20 KB
8 KB 54ms
53ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

410f4228aa677eb20622c6f1e0f67966fcecca198ad07bb096f0265b2689ded7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:48:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3606
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8300
x-xss-protection: 0
server: cafe
etag: 2697337515266134059
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 14:48:30 GMT

GET
H3 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 56B8 205 B
229 B 54ms
54ms Image
image/png 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 10:52:27 GMT
x-content-type-options: nosniff
age: 17769
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 31 May 2024 10:52:27 GMT

GET
H3 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 56B8 604 B
628 B 56ms
55ms Image
image/png 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:13:54 GMT
x-content-type-options: nosniff
age: 5682
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 31 May 2024 14:13:54 GMT

GET
H3 200 WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js Show response
pagead2.googlesyndication.com/bg/ Frame 44E7 37 KB
14 KB 52ms
45ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ae70268abe00d0f5f9a58ce23f5af80fd5f8d9e8b5a647855901f5321cbd23a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:09:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5937
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 31 May 2024 14:09:39 GMT

GET
H2 200 html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 68C4 170 KB
59 KB 44ms
33ms Script
text/javascript 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

96da839661d63f7cab3dc3e43613fee97166a472555cc91df21777d6d83e58d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 07:18:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30590
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60311
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 02 Jun 2023 07:18:46 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/ Frame 68C4 11 KB
4 KB 46ms
38ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AfeE_9_Mtk8L3sEVDuTXFX5se17Wo10LRSTzuTw33jUbNTZ5397GaSyW8__0Osmf9rpdpICWfq70ADF6v50YYW4qR8AWDDhqOiLBeTJQRWvFISTZS52DyvuMs2mZ4lhvdRMoFb_DvE6xSopgm3nTDuotWvfeXJ_3d67m42Y7Pt_MV0GVs&dbm_d=AKAmf-AIQjdc3ndhS-fkdd0yGIz5gFvk-WyvPF6XoGBw_Is6IK4XYpCPYcXyHAnC6_jHxu10lYQ1OI_XAYMyw-5-hHzoUcYlfutjlEYa0xXDt0JU2lZ8AMFxf7oxjI3PmmA2mOFFGXRq1ZUyf_XWlyrdTFtW_os8u_cQWA_tPVq9GkZ0EUURiSfo4Vl2pmMuwQ2DJSE3sQe1_-v2dfttJuVDW7wNGIedbeCf9I_6PrTxr-hKylHEfDJ7HsGifm5LULVGPAIIZp7RU_EOuXeieBnB6LKbPd2YUNVHMACf8P1vRGSzPCq3x5cGlgYpysnk88TwHWmWJIBuaY-0Lkl0mFMwpPIpL82oftQ0c9LT0q8hKEOBqvdw_wL6_H8fTPvbqd5vKKCs3C2-IjX5JkDH62oX4p8qAkjDD7xeXF_ArpPfHZOvsFWgA-Jkm4mJ-6FxJyeGi6o1i7q2cUN7qHR7GW-q1B0UB66Oj7MUglTRMfsFjY5yQyVyO1IhoPvhwbqDT7RchQyZZ9dVAEx2bp-uJ_xztDptJXwcxtPb6wwvtUXm9uQyCVDoHrLexvG3Ek7qN_p52YzJksP_Xk365uRkcuaiVBobgTEHqu6ZZ4qQ7KFwjF1GqWFJwFRvURdkMyp3NWk3Eaf_U3NBJxhXrDigmL5NG9b-e1TaJ-ZwQi0MI8Z56Dl4tpAcli6bAYq4wqDuIx46SYjdUWHJhHN1ut0GABMLbdJIbK213wxFNBPCyml3xs5IUcQijFic5b75NXGaSHcqnkX-BW_Glcycjfpjm0ReBAFmeukApFJMoQJoMS6erTGDJJBilLc3EoeSXVL_POaNgDtZbUAklCUpsCKrqjhHTeBAzzPStv7WqGCLdgUimlak6o10HOQIWEI0q13yb_wGqNEJTRobsG-IbfJQzjg1LH1WD8umgrxA7nEct6htebZcFB3ub4-LK7TS_gi0hrK2UHSoKqTU7uopdmu-3pecBL1y_-VwRrsumoP6TeQRdgn8gtnDp9qlCpRs8mdpgOObeRbrnqpz1r8jSTIAXy_qSrOFiWwiuV2Dh12gUgwi0XwUjYnJf6AiDB4jnSYYAUWOujbudpsJq0Iu8DTOPb1JibJfhbZW_9L7O3sIWx2Q32gPMSBolCJPOJkAPukmIz312MKs8XEB5aNC3UQWwRDdhATO3VuxKBn4B7P0ePOgLQ35rAUWmxEWbwdM61cPiL_2uslEO8AzagtOXdMb_LrNxbys-6gb0ExGgqN4Mkt-dPmtfzHAqfql7gfMoOU7y3JQISCfly-74vDHNtGp2909aDZ4c2jEJ6MCKb2QkSoqf781vCWhX_wbph-YZ5c6rzzsvsnY3c7p7i66Pu6GnaBS0HaNNoYs52fOMZVZXIQMWUU0th35gjKwZQzxHlvSv_KLPC8vE7hsnTd-QLcI6OHsoHmK1zf1RPLVVL_ywHLoW5hvXiicHoLHyOirF10RkC8meXml89jfBCRZN3xyIcTyz0MY-lTnS0jVshiIoNj7oQZ6gbC2w_Lz28ywl4dlmWGRP-W5BFhsNMgzyrYEmCLdlLiwBaP5Q8EZ8mmEP1LIhcyF-pap1o_BpXIF4eRUv2N0ejNkbHqxS6v2wJGNIDQkvhNLnodLMQGUuWulcHtTC5gbLZC10aDg4FcdWORkBCNuzaeQNoOG7jd6q4Sjs776hlKhfzYAHWROk4k1mDbKyo9jMBVT8X1_PK_4Uce1tczp4hSkqbTHjt6NhaX0PfjuW4lH-9raSJH-YEwhnqxOJ8DjiIMpfKDKUc6HgTywWo_epIszPoeCiSC-_qwtT0HR4sZ94esioiT1IAvhwkyqMWl4GfBb5tfxGuxHB4tcNCU1BSypglEH2-ndpvZgoNP-pTcjRHWQAbakUZF05YvgV3gGW1XoJJPjDPQaZqiGpxn_KtLvv5G7YQ29T4slXmW6AwJoDcf-X6tC8eek-pinlSiCwwvSAew8taCo1X_RtDOlFGHd89zRpFDDM2KYkW2QIWUiJf5RKXAwH7whfFHUehA2C0K1ZTBzWLab2YYje4jL6o6HW_KMGUL3WR2pRY2lznNbyo_32WOdzRPXzL6P5-w852sl4dp_0_5iq103nSbemLqXnfgBXgJV8mcZOYJE1BemSah5CR2ph3i86Tp06omq_Q4x_w1Z_fNUqXYFoyhmt9zAZ__taqs7DCWL6UEbvU1tKSRFp8PNAct2F0odunjA9AGfQR93YNvXEWy4V9gtTg8gDCl1vxfbATg-6gh6xlRihixCHvX4Q-bBu9at4zJWH0o7oDDQrPYftXIINwtnhdRV5bDr_XCAwX_5FNWkZT3Ky4gwpFi6pzax8TcM09o-KJVgpotZfakyQgl8EAKKDTGjU-UaCIjyN_NGb-U0dHIIQAr3Ucw8Og3LqPuBB1nWzHapGHkxzQYvikd-BxdUiswSL_4JajeHa3Q8MUkga4yVzrgdU5Zppq472XDP7e5eYyLnxVIrZlTfIuxpgKVp_JyYLJNI05Bjno7tAGrPeMB0DeC-_Q6UMRFtlF9NxA4LBobFDZ2Pa6ABcRNh_RCOMVrw_eoVmw-btkrXquLRRIWoVD9L-L-DhC2bXEoZE91dH3Ohz50b2bfNudsSn8uryZu2JdgL_Wsb1ovUyEsoHmijkxwckm_DpB2H-YnnudU6YmoSg_Yh3N24OVd4-e5Z_n-ZBkenSmnW636OjjXtm0cJR_Otmo6HsIBGHit_xWH74H66H0gjgjvaKOx3Zfya0a2xDPGAjza08afnaxI7I3y9VTCAAL95w9tySJWKuDAHYyQplDVaG1GuE72zDaDB4xuLRRs1_ketN3uUN50xXHZfALmddzGO0KDlhIqtGtDcO4iwAEE8kC3VKLJdMQkRZUveEqmk9E-AFzBj914g9goVTVhTbqm7cKnEamUMAqQt2T03Cow7l7mNZIH-mZxq1n3wWcN1hBVYJvocrjHdF9f6CuatONQrsIf-ht_uLeNhdO1L2CkpF_EKEzxui_RSLGFyTvwJmvjhETLh25Yhy831PfqjZrm5ylnJ_qOej1Za2qcbKZgQT9HTWbjEDePuJg3n19Xqgo5GcOGxMgGH7X1OEz3LxozdM_dEj91ECKWbtlJYbPP25JTX92v-4czJH2FqybNkMj05nuXAznji8MLnClfUdu3Buy45k7h2alTRChRKUxNYljRSLq5ELoiSto2lJabOobV0Qymg9hU_JqJp5pIFX_WoQF5KBCwv18iIYvx_NC-h2w_kKfpN3-mULluh5mkjIXqqWB-oi4ihpTzcntOFhsAgqrpYVnoHRIaVdssTn2o&cid=CAQSKQBygQiDy2rOiUpyxgfxP-VCpDejv9cuRHT7GPFh7Ze-z7Hhq4MS6QR6GAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=5982605649199138000&adk=2515327512&idt=165&cac=0&dtd=14

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae8017866a6744d35f26aa9da389e9771d40bcae3ee65df4c1b5e16e57b09fda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:56:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6704
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 6053914914909336730
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:56:52 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/ Frame 68C4 29 KB
11 KB 44ms
38ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a91fca903f7f2a3d051f657b5b25baed4e99b6c1e51bfee63737f73ff54f2b7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:56:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6701
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11027
x-xss-protection: 0
server: cafe
etag: 5492578185836041520
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:56:55 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 68C4 41 KB
15 KB 46ms
41ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 07:39:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 202143
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 May 2024 07:39:33 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame E483 1 KB
643 B 61ms
38ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 77605
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 18:15:11 GMT
etag: 48472445140208031
expires: Thu, 01 Jun 2023 18:15:11 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/990511/61634100/ Frame D56B 245 KB
74 KB 121ms
35ms Script
application/javascript 18.203.7.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/990511/61634100/skeleton.js?ias_dspID=3&ias_campId=1010147412&ias_pubId=pub-6266313190087173&ias_chanId=1&ias_placementId=19422215943&bidurl=https://www.farfeshplus.online/FP64.asp&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0iG9mFJ72zQHE9rmY6cIr5d
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.203.7.152 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-7-152.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: fbc41b42bfe7211eec16fce94b75bf3d99e80b9cc23bafb5ac5891423980a412

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame D56B 111 KB
39 KB 43ms
41ms Script
text/javascript 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 10:17:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19883
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 02 Jun 2023 10:17:13 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/ Frame D56B 11 KB
4 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C2T7KeS3zBuswG1rNbMbbYL5AbzN8xfFiqtmdHmyEYC5r4BjJ1fsWTlKWCsrnGzsB-Rzt-W2Myn7XHbl2zHmH2qqwgElBXI19GB5XbSlvoTK8D4RusiqopnpULspmqX5TGHJVXAyuTOaCF4Si4r_8wPBx2xkpo63_mwhTZSe5HajhUgiw&dbm_d=AKAmf-DaHLCr6sW2zqEU7H1Js31yRdN6z3KpL3vODKl97y3cAEskCsiEyPRb_obQOv-7Mq1Tm0LLE-69U7KzIk7FJA_Guhz9mXuCd9mfd2eMBpj_gZAVaxhYqEc1LDsZZRmUQ7Gs_WwdJRQJpQICQYBIWxGtFZKcDEH-XoheXQeFYgCfTzMTPWkq3cfV-tigmcxjznylJM6yTkVNU-YsqjvKUJwcILkyDG4sxG8zKNCOzQXLAVzgkqoIikB_hpDSScGgbcGx4K4v-KZ4P2qbl2QhFwkYPQed0CgMEVgOcM-QQxy7aapBqVreX-IvuzueCwNZNKjp7QRx16atGKBFyuggGjClySJwGacgriWtlT25Cbd26gzBmzwN9zE_QqCtDv2AI6buFKW_ddXo5R_gR4SHfUlsTmNf0-H3x4uq-liOyfkWrshdaNb_t37P0_iyGGpJWuvdL8QQqTqYkTuJ9eYXLdYymxgrvdstT3is9XTerVCwao-F3i91zdvcebp5dbK2CFDVYeKZzvXxTVnsokxaql8fW_Euz4HnPkh6qgI05Bp1E_Xz2nlypzzrDTao4ZComGEzrTnBIlNsVDo6IEzI3Zg3QjWBekrV2l_DzhIJ-Dcc4wQHUeSSkCgkiNPsTNQbdRdhqDAsqJbq4rRcNvstBlv9_M_Cl3MmrvrKhFJLtfAOARPBffCaC9_3CNtH9K9PHdb4jfqj1XNDC7crcxpMs5ScOdwkOjM8fS4ESKlh4pmDnAV8EcHVtazvTudHQowHHXuBRzNtPyl4Af5HJCheeti3gVqjqBykGwQVUXvAbQTwk-iLHSl2Skf4-MGW_ZCpMx3OMqUJfftWf8w_18EKAVF1-Kql2rEZG9oSFsoaYlNYqBQ1EfGblQ1auxJ-Nsc9jSpSTrJJuRuysBcMG2fR-C8fYrm3Bd4I1kkey7SW9sr8uw4ALAXw2fqdNetQ7pjYCeOLQziDtU1Hy9exC0ZedOKnPekGdpRtIJhBHx0Y_isKsfCqrssnmneJbr7wFV0Zj9D3ZO3E1edYefEs_TbjJwa6Js2GY1owiG9UyL-4YUE0Msf_6g4EABtyDJlh8XSUAO-Qi6zBX_16CSbbdkN2tbb50Xp3hehGOw_wiPnMTdao4c-MB-C5joVW8mfL0jJzUdPzyMx6RP64PuUCKeeNJFhcTpeBUsprCDb7KdzDv-7mjl97YFy71VaxME1gq0_jaOd30xb_gsn2j4FoRaN6gLy9-9wLYv0O7uUzcf_ezbz57w5eCPcqcVWX6ECPKPaaInZQK-pdSO6m8ef7J_-jSufHe1Bc7UpunrSRUyEoEzBbeSh-s7xNnenl8oz2AefkvapYf8fQNd1QCHa67Yc8B4DjD8GgT0KJKZ55ojIBdhkKn85zZQ_wED7qdOAwtXqtBLBIMSR9o3g49Zp7BkfCH_9WMJlx9shuT7kCsuNETIc26R1VanuwsfRGpcQFKGFMGZZger1wY3hac5dDFLflvvAPrheZOvr3JRyb-hF5q9XhgmTzVL9NkGCy0Jr6O5KGjrcEwkTFik2kRO86BJIjrIevvAdrXPs3D7Yv0ZZ0W7SQvCTzvHEP4o8wQee2LuuLXqj0fYdTZPfaII-wmjHrH6fZJBXduf8wAlh5pCPF_uIWYA3LMm2W7NpJDYB27l0hTLa2H5lxd3GFc_MzulKX0ZUPSgcHav8WwLgypjm5zav3D_UulPf_tXRW029vHkxCZxphllpQmteDoO7oAEPe9YMQh_KZ7yKphckOKJPle07Q4_weSVaCn0Ig6VIgWDsi3-Uebxs4E6z0TS8eAnUxrhtIjOOasRSgLEFznC5heQi3nDi8c0wHECqh3p71EZSC4kZbUarzjU-iZuWZGkmXIOPHMv22nagnKRYRA9eSHxxfo5hbMuOABaiV-HGv7FzF25tESPZmSyiLtvrOe7Jt14d6U3K7BnxZ7EC8k8ksBpvSrXotjawjIlnrX4WNMbD87pQo5U2NYbApdah6UUn0UAizrj2S80VzWJ17ioMTmPG3njAoofj4dUKcyMngKsTfk6EkbzzzFKAXBh1wwjWpRyZKN89maee4nx4GE1rUscHQQqLPbyEK32a2UIqBtLWnDygMUh4CZhYi1RghLB1G1Af9dcALSvuQGGn9YW9qYOBCODmAVR_dy31s9Tm08Su5gaDWyFlli8YK59NXKo75de8lwDPc-SRktYAney8oNI-FDG3wi2zypkcRjVOf6hKrYO2b0AnRiSTwwra9qT1p4BRIQsIpNrAsBaN0WbWZA8Vvj5r3wsk_3tDWCUMm53t8k0Q2z0O1dfeo_ZzZ7fz6v5zb2o0B-7O2K9nl8KNQp7OYHtRtqV5-THJ07H3Fq4rQ_wknvVHZwa59fCHbSSdLjS2jozpmIdryC3zRguuDUbJA2mpQcUq1L_d_zR1G_NC3q_KLiRMeaKztGx6ef5SbMSj7669nqWXfsyIBj61qCj3Knl172bZ9YmL38-q4kmzw-nSCqPpBPRgOMRQDkC7MZniLG7C6Ory3ZobyjNLrIUuQERnsQIOypJ-8sdbUJksI63keMaXpOV0l2VZBc3uyEkpc4D8Nmt0yXjNXusFGrG0CAsO3ICbj2zeW8KCgjsR-klt93rfwWu6jsu9msFcHUjVou8kvVuxPmk4aOjm04132_DMZHLVVINbwEa8PxJaGzvqVmmb_JX3gd2_dUS_fpIc79WChH6qIId97diJPNVCd1Pm-hQbi3Rs8zyMLZLDtNEA60jQpz_3vqcYRCgjv0_mOhv_cegW5Ude7KhfuHWzuj3GiOmZ4ew7olUyd5CCUzI8rQUaapYfufQFXZ_0nOWg2jzDPDWKmgH0ZtaQQiQEWq0_z0v6dWbkrqybc3nRjOi8C7f7oaPiw_Qpk5fjcmzFLOkJHL-AAlYe-js1Oj0U8wLUqxa_vltty0lYqWup3zSLW3hSkvajK71UCrlXOqs0zNbbJ57jLUj1Uc7LdowbHXpRsIx8MvKH3_3w9yWBwoNQmd5NAICDY3tc4ynJBEv9EprZ989xnfuGjglJAdwjvw-zRt0AxOPHiW3vR_iWu0eYQBGrIVDcVeBY5zpSfZd8H0wSrKrQmwgmRobqeJl1tpuk8HEitJO-LF3bwElX-N09jwYnZwgArKZIwTC3QKgB9h2nID7V8PIGjri3FGyByWjOdzDjpWzQWAcuSVtXwlK5p534eVH-8cMTphgaXYVvxMPD3Dy_bnkojUWl8BeiDX8jWnG3GSWMoCxJ8GBLzz_vy6J7yEyMzfCAi76eEMS22VIB5sfo8nav51sYhWnW_wLMhoCcT5XZiRZ3Iw9yuraZ05pYz3aiy-lHDdZh8uA03GW_CP7xYQXbl18vLnoUNeIIFeC7IJeYLl0McFQTcqcPKIWJsrV2thshOvxZmQY6Xz_E79rAmbOAO8AqMPBmedONZBpjnkf3Y3dpUgRMtHOYR_73i_rnR7ODH_SqAalkzHUdsKKB00KaL8SHVEIZg-ESVDbXWld__oukE17Bx0bJh4jBKaBy2QOFA7W_LSH7YsVdTQsvLTDYYX_wbFzWeUxC5h7ihmDoM50IhvQV16NGPpxnO&cid=CAQSOwBygQiDiYUQb8fllV31P2p3pZBATAU6K2BIKzhXw5sxWPCiaiACe6iqWIQ-jZt8nFELlJnwZq78Dk73GAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=2198531392341991200&adk=1033480531&idt=320&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae8017866a6744d35f26aa9da389e9771d40bcae3ee65df4c1b5e16e57b09fda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:56:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6704
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 6053914914909336730
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:56:52 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/ Frame D56B 29 KB
11 KB 65ms
51ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a91fca903f7f2a3d051f657b5b25baed4e99b6c1e51bfee63737f73ff54f2b7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:56:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6701
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11027
x-xss-protection: 0
server: cafe
etag: 5492578185836041520
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:56:55 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame D56B 41 KB
15 KB 66ms
52ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 07:39:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 202143
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 May 2024 07:39:33 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 4BAC 35 B
466 B 402ms
9ms Image
image/gif 91.228.74.168
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEJiZ_mF3WksxAZzh_EBnLUk&google_cver=1&google_push=ATf1kGODF1fVMryAoNXk2nJCvGHYiKJin8rt5PTj5Rh9ugdplqNjBasDitBbIObYvdoXS53BiEXQMzixU3o352bWWYqo1LRevmWofHavz8rbGSKJPqhXgliQPmzPUR_v3DgdwxNwI4DCWIGRxWUzfhXzrp-8iAU

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.228.74.168 , United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4BAC
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEGcVoL40rsqUDAVOLUNqdU8&google_cver=1&google_push=ATf1kGMRysaTVyQNi3WOvVt36zjVoOie42UATIqWdUQ3A92IUisewVgj7ta2dtmnSdscsxb8Jg0JnlNeo7J2x_OL_oiB7fleRKXpPy...
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=B271353183294576B2158BA1778B6CA1&google_push=ATf1kGMRysaTVyQNi3WOvVt36zjVoOie42UATIqWdUQ3A92IUisewVgj7ta2dtmnSdscsxb8Jg0JnlNeo7J2x_O...

170 B
188 B

50ms
49ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=B271353183294576B2158BA1778B6CA1&google_push=ATf1kGMRysaTVyQNi3WOvVt36zjVoOie42UATIqWdUQ3A92IUisewVgj7ta2dtmnSdscsxb8Jg0JnlNeo7J2x_OL_oiB7fleRKXpPySFztgV-Tjtg5qhkKjXRhNXBr3Ncr3YHi2Dvh32tFNhGGquyN_mDKn9bZ0

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 01 Jun 2023 15:48:36 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=B271353183294576B2158BA1778B6CA1&google_push=ATf1kGMRysaTVyQNi3WOvVt36zjVoOie42UATIqWdUQ3A92IUisewVgj7ta2dtmnSdscsxb8Jg0JnlNeo7J2x_OL_oiB7fleRKXpPySFztgV-Tjtg5qhkKjXRhNXBr3Ncr3YHi2Dvh32tFNhGGquyN_mDKn9bZ0
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 31 May 2023 15:48:36 GMT

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ Frame 4BAC 0
187 B 342ms
24ms Image
text/plain 98.98.134.243
ZEN-ECN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEDLqB-5b5KYgUWUkzslfZM0&google_cver=1&google_push=ATf1kGPfeJjkTIhzOuB5DXmwSCkLrzgH3JF7wMCp59dIlE1XX1MLYp51iqZmycRhkggJJd3lcbAEGc8MUs-grmpfY91VX935mVa1trHAsTJhY4jcAFFC388VnowtX41zJgBZHqtjBK-T6gBrdARD_Wx7d0UZaQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3759532572&pi=t.ma~as.5788561387&w=728&lmt=1685634513&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513760&bpp=12&bdt=1323&idt=12&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1461&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=9&uci=a!9&btvi=1&fsb=1&xpc=SidpaiTUUu&p=https%3A//www.farfeshplus.online&dtd=18
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 98.98.134.243 , United States, ASN21859 (ZEN-ECN, US),
Reverse DNS
Software: A /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
cache-control: max-age=0,no-cache,no-store
server: A
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4BAC
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEPz5F_6nQElUFeMKN4xOtLY&google_cver=1&google_push=ATf1kGNlHOivWnyX3rwKrlT9myR8B4rPTAuODeMIbEL_2AOkAN_Rbp55nw_YmsbIZzvUpAv1-LXn16zLvS3xAJ7kjAr4...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEPz5F_6nQElUFeMKN4xOtLY&google_cver=1&google_push=ATf1kGNlHOivWnyX3rwKrlT9myR8B4rPTAuODeMIbEL_2AOkAN_Rbp55nw_YmsbIZzvUpAv1-LXn16zLvS3xAJ...
https://a.sportradarserving.com/sync?ssp=bidswitch&bidswitch_ssp_id=google
https://a.sportradarserving.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=google
https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=1&user_id=9c525564-7929-45a5-ae59-fb7b9e8ef384&ssp=google
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ATf1kGNZCEZ7KDCZ5IRftIJrbS4ptwnCE6gsHOlVa1NmLvXPE0l0owfvjYP1O6mS23cG89VTr1MlozjUE8NwnxkEkuAe840ZlTo&google_hm=VT1qsdQHSTezCp4rfDVtGw==

170 B
188 B

65ms
64ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ATf1kGNZCEZ7KDCZ5IRftIJrbS4ptwnCE6gsHOlVa1NmLvXPE0l0owfvjYP1O6mS23cG89VTr1MlozjUE8NwnxkEkuAe840ZlTo&google_hm=VT1qsdQHSTezCp4rfDVtGw==

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ATf1kGNZCEZ7KDCZ5IRftIJrbS4ptwnCE6gsHOlVa1NmLvXPE0l0owfvjYP1O6mS23cG89VTr1MlozjUE8NwnxkEkuAe840ZlTo&google_hm=VT1qsdQHSTezCp4rfDVtGw==
date: Thu, 01 Jun 2023 15:48:37 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H2

200

cookiematch.aspx
dis.criteo.com/dis/rtb/google/ Frame 4BAC
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DPUSH_DATA&...
https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=k-LXQVCGJ2-AbpzohmaDk7ORgd00gyRSU3Pfvw4g&google_push=PUSH_DATA
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_error=5

43 B
369 B

20ms
16ms

Image
image/gif

178.250.7.11
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_error=5

Requested by

Protocol

Server

178.250.7.11 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 118683
timing-allow-origin: *
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 274
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4BAC
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEBGVik6jQNOnnMMY9c-OnEE&google_cver=1&google_push=ATf1kGOsqLE3VpeKC7SLbsO3aYXTYdtc48R_C70b-RdZCp3PsWpsex7ofJD6vXyw2vg6eLoRWyjdav6i...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDkxNTYyMTg2MzY0NTQ5NzQ3Ng&google_push=ATf1kGOsqLE3VpeKC7SLbsO3aYXTYdtc48R_C70b-RdZCp3PsWpsex7ofJD6vXyw2vg6eLoRWyjdav...

170 B
188 B

51ms
50ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDkxNTYyMTg2MzY0NTQ5NzQ3Ng&google_push=ATf1kGOsqLE3VpeKC7SLbsO3aYXTYdtc48R_C70b-RdZCp3PsWpsex7ofJD6vXyw2vg6eLoRWyjdav6i-7tMGZyrBliqGDfvGcZPeN07C1i1msH9dRsZEV4FClhrv-mR3FU1_Yc8oAR4waNPI3sTxup0Sj7bfak

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDkxNTYyMTg2MzY0NTQ5NzQ3Ng&google_push=ATf1kGOsqLE3VpeKC7SLbsO3aYXTYdtc48R_C70b-RdZCp3PsWpsex7ofJD6vXyw2vg6eLoRWyjdav6i-7tMGZyrBliqGDfvGcZPeN07C1i1msH9dRsZEV4FClhrv-mR3FU1_Yc8oAR4waNPI3sTxup0Sj7bfak
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2

200

report
sync.teads.tv/um/ Frame 4BAC
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEM5ztikjRruq7Oou8BHgd7w&...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=ATf1kGP6JvWvawZ5t-uHLAk8MNvqLcHCGMSYhQoEmlydeyijn0ty3aDuXFEWQg-Nqjymj7e-SNqedD_SpT6Om1SaeDqkMj0QDtNGNDfouzZX-IG0oAjTD...
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
165 B

31ms
31ms

Image
image/gif

104.111.217.42
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3759532572&pi=t.ma~as.5788561387&w=728&lmt=1685634513&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513760&bpp=12&bdt=1323&idt=12&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1461&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=9&uci=a!9&btvi=1&fsb=1&xpc=SidpaiTUUu&p=https%3A//www.farfeshplus.online&dtd=18
Protocol: H2
Server: 104.111.217.42 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-217-42.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

expires: Thu, 01 Jun 2023 15:48:36 GMT
pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 4BAC 0
12 B 57ms
50ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KyZ4mCYzSLZ89nKPSdNHi_n6POvIx-BGrdd6kW6J3aZ1wFhPZz1HNYToEAfo8-qJCk6AZ3kg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
DATA 200
OK truncated
/ Frame 68C4 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4766d651444090f5705d47d6d9edafcaa92bb6b5d8229108cacdada59b1cc628

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame FDCC 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bf2d15634cb82302ae6514ff46f83ab9254279216c97492ae7be292e880620c7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 4CC1
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEHchWKh6tikNETWiGFDjM0w&google_cver=1&google_push=ATf1kGOnIbNrckfXozL5md2wHG9OKHE_0o9xDW_QDK197GXAilKBnn3_swO2tu_4ymRUL9I-oLriaVQozTk_vYbe5iSqWahndWv21...
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=NzAyNjg3NDcwNjA4NjcxNTE1Mw==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEIV1Fr_x5GJh2RbbOS_2Mhs&google_cver=1

43 B
398 B

79ms
17ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEIV1Fr_x5GJh2RbbOS_2Mhs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1685634513&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513703&bpp=6&bdt=1266&idt=6&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=8&uci=a!8&fsb=1&xpc=d1Z757MIFV&p=https%3A//www.farfeshplus.online&dtd=11
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEIV1Fr_x5GJh2RbbOS_2Mhs&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 4CC1 0
104 B 32ms
30ms Image
text/plain 2a02:fa8:8806:12::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEKlyt1hVogyUMhpjFjJ07iM&google_cver=1&google_push=ATf1kGMUS_NMaJjOC4k1vy00TQbuHM99vWTOWCttB3raWvyP4F9CZBUsjeLZXyKUmZ1Oa7NV4NGzjaNGU1zfO26JIK9Du75Pul-D7qAZfzCbrohzLoyK-oT7E4bI48x10wXSi3HhA_JAKBWS_uWli0CrSX_OtQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1685634513&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513703&bpp=6&bdt=1266&idt=6&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=8&uci=a!8&fsb=1&xpc=d1Z757MIFV&p=https%3A//www.farfeshplus.online&dtd=11
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1400 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4CC1
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEAVqIe0n7rJt7J0uKnMbrUk&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEAVqIe0n7rJt7J0uKnMbrUk&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=SnBkZXZFTHExUTRLeHU1&google_gid=CAESEAVqIe0n7rJt7J0uKnMbrUk&google_cver=1&google_push=ATf1kGOTzyjVfQeMdZ1PSx6he7ar7rasffwdgI0nfzAPjSp...

170 B
188 B

50ms
50ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=SnBkZXZFTHExUTRLeHU1&google_gid=CAESEAVqIe0n7rJt7J0uKnMbrUk&google_cver=1&google_push=ATf1kGOTzyjVfQeMdZ1PSx6he7ar7rasffwdgI0nfzAPjSpjQWetgyH68Gtj8BRWixZBrOGKAuZq2agPnMbKx4MZVmjvFUZMMCio9kBoVDQWaSOV3jSr6BicVYqvUT8Ivm-rEBhT6dV52ltsZEPa6vsmzqikxME

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1685634513&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513703&bpp=6&bdt=1266&idt=6&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=8&uci=a!8&fsb=1&xpc=d1Z757MIFV&p=https%3A//www.farfeshplus.online&dtd=11

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 01 Jun 2023 15:48:36 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-777-g304ac51#rel-ec2-master i-0943143fd00beb9c6@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=SnBkZXZFTHExUTRLeHU1&google_gid=CAESEAVqIe0n7rJt7J0uKnMbrUk&google_cver=1&google_push=ATf1kGOTzyjVfQeMdZ1PSx6he7ar7rasffwdgI0nfzAPjSpjQWetgyH68Gtj8BRWixZBrOGKAuZq2agPnMbKx4MZVmjvFUZMMCio9kBoVDQWaSOV3jSr6BicVYqvUT8Ivm-rEBhT6dV52ltsZEPa6vsmzqikxME
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 4CC1 70 B
265 B 47ms
44ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEKnMA8qMNfsfQFrrRsID3bA&google_cver=1&google_push=ATf1kGPZNDK8hfoEd94i1ijyCZQzxx1lira9El9X6F1bcic2v85zFK5rZpJLXfv0wSbWi9rdvpzDTLNrebn2dsHLqHBfsB0m7uVbrQ-MdUKDvQ-agvvXWI7tWLKtc9vwDwkpNfpCSmRshvNbIzshrIarAJ3GFkQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1685634513&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513703&bpp=6&bdt=1266&idt=6&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=8&uci=a!8&fsb=1&xpc=d1Z757MIFV&p=https%3A//www.farfeshplus.online&dtd=11
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2

200

cookiematch.aspx
dis.criteo.com/dis/rtb/google/ Frame 4CC1
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DPUSH_DATA&...
https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=k-LXQVCGJ2-AbpzohmaDk7ORgd00gyRSU3Pfvw4g&google_push=PUSH_DATA
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_error=5

43 B
368 B

16ms
16ms

Image
image/gif

178.250.7.11
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_error=5

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1685634513&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513703&bpp=6&bdt=1266&idt=6&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=8&uci=a!8&fsb=1&xpc=d1Z757MIFV&p=https%3A//www.farfeshplus.online&dtd=11

Protocol

Server

178.250.7.11 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 87122
timing-allow-origin: *
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 274
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4CC1
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEHgiPAz237Npz8ET00mu1TM&google_cver=1&google_push=ATf1kGPiJopInguJpA9LAp8r643l8UCzxSSvk0QIPSnVeUcWZuyf7Cpc5QK2JLTCPNcCGpHm0p3T0GSS...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDkxNTYyMTg2MzY0NTQ5NzQ3Ng&google_push=ATf1kGPiJopInguJpA9LAp8r643l8UCzxSSvk0QIPSnVeUcWZuyf7Cpc5QK2JLTCPNcCGpHm0p3T0G...

170 B
188 B

51ms
51ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDkxNTYyMTg2MzY0NTQ5NzQ3Ng&google_push=ATf1kGPiJopInguJpA9LAp8r643l8UCzxSSvk0QIPSnVeUcWZuyf7Cpc5QK2JLTCPNcCGpHm0p3T0GSSSTPVpPLG0kRS3xwGT6FNqXLJcIqo05Ztz-w_asrdJk040iejIk6U7Ymak93OY7b5Rpl5_cOEwv_G-Q

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1685634513&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513703&bpp=6&bdt=1266&idt=6&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=8&uci=a!8&fsb=1&xpc=d1Z757MIFV&p=https%3A//www.farfeshplus.online&dtd=11

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDkxNTYyMTg2MzY0NTQ5NzQ3Ng&google_push=ATf1kGPiJopInguJpA9LAp8r643l8UCzxSSvk0QIPSnVeUcWZuyf7Cpc5QK2JLTCPNcCGpHm0p3T0GSSSTPVpPLG0kRS3xwGT6FNqXLJcIqo05Ztz-w_asrdJk040iejIk6U7Ymak93OY7b5Rpl5_cOEwv_G-Q
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4CC1
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEJQeeXapLW5kZfBhv02LSrg&google_cver=1&google_push=ATf1kGPsQbpenHYabJ6qpRLiHWXRcjXzrq1d2Roho2DmtC0jDHqgyh08OXeijCyuVWZTAh8C2oMQJLhTX6pf...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGPsQbpenHYabJ6qpRLiHWXRcjXzrq1d2Roho2DmtC0jDHqgyh08OXeijCyuVWZTAh8C2oMQJLhTX6pf0E_ljY0yaTJ6-iy8K5RP44iYWCc_E-ClV4Vf...

170 B
188 B

51ms
50ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGPsQbpenHYabJ6qpRLiHWXRcjXzrq1d2Roho2DmtC0jDHqgyh08OXeijCyuVWZTAh8C2oMQJLhTX6pf0E_ljY0yaTJ6-iy8K5RP44iYWCc_E-ClV4VfGmL-wFbhT-xHpipCJ6441zprufcdjF7zLv9hpjg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1685634513&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513703&bpp=6&bdt=1266&idt=6&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=8&uci=a!8&fsb=1&xpc=d1Z757MIFV&p=https%3A//www.farfeshplus.online&dtd=11

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGPsQbpenHYabJ6qpRLiHWXRcjXzrq1d2Roho2DmtC0jDHqgyh08OXeijCyuVWZTAh8C2oMQJLhTX6pf0E_ljY0yaTJ6-iy8K5RP44iYWCc_E-ClV4VfGmL-wFbhT-xHpipCJ6441zprufcdjF7zLv9hpjg
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 4CC1 0
12 B 66ms
64ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LbEvAdAt8uNliSfbxZs6EDUKhR6QsbfoSfkE0iiAnI9rhwijo1Ra2NhXiQQPXCqT9biqzP

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1685634513&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513703&bpp=6&bdt=1266&idt=6&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=8&uci=a!8&fsb=1&xpc=d1Z757MIFV&p=https%3A//www.farfeshplus.online&dtd=11

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 441F 22 KB
8 KB 63ms
62ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 151884
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 30 May 2023 21:37:12 GMT
expires: Wed, 29 May 2024 21:37:12 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 4f15b04a61e905e84860ef8799d55716.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2009649736748391047/media/ Frame 9DEA 90 KB
90 KB 52ms
52ms Image
image/jpeg 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2009649736748391047/media/4f15b04a61e905e84860ef8799d55716.jpg

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1538fc2564c4207e12ed180fbb40680bbaa3f3fbaa1257936b2390e2f3a92e8d

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Sat, 27 May 2023 20:12:38 GMT
x-content-type-options: nosniff
age: 416158
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 92413
x-xss-protection: 0
last-modified: Mon, 28 Nov 2022 08:24:59 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 26 May 2024 20:12:38 GMT

GET
H2 200 index.html Show response
s0.2mdn.net/sadbundle/9548364509937149214/ Frame 8854 15 KB
2 KB 77ms
72ms Document
text/html 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9548364509937149214/index.html?e=69&leftOffset=0&topOffset=0&c=bnyTc2AwWf&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ff067250a334697aa929240baa053c275243c0bbc1a5cf9b1e280ff2eff85aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2270
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Thu, 01 Jun 2023 15:48:36 GMT
expires: Fri, 31 May 2024 15:48:36 GMT
last-modified: Thu, 16 Feb 2023 16:30:06 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame C902 0
0 93ms
91ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstAXMwVwYibUPAv67iUs36wZ-SBhHKOk8flpdmTFTLytwLL0MLi6cyRzGBxYKgYAh_BPQqcllNnHZEp_kf1s-AL21guXwXMgjCE60m-2BDiFE8fuXTbk407U2V3VQDfMWtqEP3YmIm3crVJHp2ZLB81-J3XmRODhaB8UR6j_bvInhB9jNZEwoXRCo9s3-NRp_hy-sN5C8Jdr5GNsCZ766BNtZsgVIKa2hossWPohhj46hdq2FEnO9SrGZd-booEmb55jCu22gqGj3BvdP6MPy6bvCjqX0Kp-QVP0490PelCOpqLNrjCmusqnFljkAEtDnY8iw1OgFrerdn5HaD3rTMgshrUu-MQb2xbJdYcY01lPVKm-aSE68RhHtYol9wRFVqfACMLGYnyRhkAyPm0_O0HK7SUPJHKs7tJyWKdFCiSCucVcdmOsol1QQDK0jIXnkQ9P9Nhd40FjSHts12UYJeVImlt6CG54T4knZCOWgv8eSOpM6sBnmDGAsGymw6KwtfaTcMR3w6F--9mIm-psSBIuvtCRFfU17U86ZRsLLfgw-gUiDlR3HrkU5aZJVQN8HOvCPpotgkyc7IpPX_F3VHW0UL_-USTuSeSp0XWkz19z2NLJnzEHNdh8VkGyrNvSYW61QSsCSxnUEXAVSjQTd3I_Q0WuA2QSNPspHjaNrjfj6GODplZnXiSKyR_U5TNXB5dlkTgrNFf7TLPN9UPwuiS4E7_5onjrVdvusCPtY24cckX_UvQFLuxhVamrevjVk_B4p4paVdMhJnomphxxPdjtqDKOwOs9gZi5s3m0pa9S5XgbbQXdTGYf56dkEEIQ8jAIenFOuOm8izDQm-CqWhV5KJihW-oMEMEOxZkLoe3-fTEaWn-119pR4-KQWsfl3Cz6vDid3cvNWvlKwYn0uV8ai4tYf7y4sdhF8Wv-5w4FL_G-uDMxS5W1_iK_Gt4c04ZAS-qKqQeK0hPKLN7k-C0z-U7xoqIHNQgWkxM_Bmrp-9oACLiEgXoIATWy4hzJ4hbfrXthe2gsHMtpKZg4oRY7KqtfW7qZ5ecmZwIbBEBbszl_qTOkhry3mdBbYgWkQqKqVHuRZ_l2BDahXQr7qCP3hwehsYneNJNHQf4MpOYZsSqSluqrgWNxS1QabN29nlw3WLeYgUZM6deekArZyB7Bgk4TOUQpkzulYtmaPWK9g_PUNyEv5diPK_2Sjv2DLTrUvsejvfyuxC6PjF5gJ4_xGG4sRQHXWJpqswoFO4bmNUpA0sMSNRSIpgdfRMVg2mBnsCOpYHaBDHHV-O2MiVIxxMQN5awbxxXEw&sai=AMfl-YREcv1BRR1qxTcRLTz2PGvcYk6rbfS02_-EyBS9Orh-1UHH1Ip3yAjYsbyzJbWfXLPQPEsokKGfOHnzDJc3mnpkZMc9Lzg_EFbBVMWSgQOhjlqNkRojC761ZEVXvTjKaS-nGpDQst649QQQmdVEhFR2SGfG6KeZCySpwnhnKPdetZT4fb48iIL-2getOaLWXeC5IliitylC&sig=Cg0ArKJSzKLxIs2Lqs-oEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=924&cbvp=1&cstd=907&cisv=r20230530.32218&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 01 Jun 2023 15:48:36 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Thu, 01 Jun 2023 15:48:36 GMT

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 3BE5
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEGXdl3kvN7orddylqN6majU&google_cver=1&google_push=ATf1kGN73HD8kHJewjYmmp-ofaaGz861Y4mtIG_TIsoZg8MLvwSNd2N0x42bz16ZX9Z6-_bhrxTClVC9Y6wPp6XAjgrfPjlcmMyrClo
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=NzAyNjg3NDcwNjA4NjcxNTE1Mw==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEIV1Fr_x5GJh2RbbOS_2Mhs&google_cver=1

43 B
398 B

14ms
14ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEIV1Fr_x5GJh2RbbOS_2Mhs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=250&slotname=6076681977&adk=2278793534&adf=954853469&pi=t.ma~as.6076681977&w=300&lmt=1685634514&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634514187&bpp=2&bdt=1749&idt=2&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D76ab65cad0aa0eff%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_Ma0_IwpMBOi7nj9-q6otQoNKDc7Aw&gpic=UID%3D00000c3a8e3515fd%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_MZpfKIRVVeVVB8cjAISCX5v7pmlrA&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280%2C300x250&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=569&ady=4690&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=51&uci=a!1f&btvi=5&fsb=1&xpc=iUalWkZx01&p=https%3A//www.farfeshplus.online&dtd=5
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEIV1Fr_x5GJh2RbbOS_2Mhs&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 3BE5 35 B
465 B 99ms
9ms Image
image/gif 91.228.74.168
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEGaWMdwIbq0BWXBBM4TzZJU&google_cver=1&google_push=ATf1kGMd29Sxpkj6lgJy59ieGuPBuDDdTWcsxEIQZ6Re3lKIDjPRIK_fXXm7z7wqjJng_oxQfD9jBG77tYw0JdWAOFQeT1P7bhLety4

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.228.74.168 , United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 3BE5 0
104 B 19ms
8ms Image
text/plain 2a02:fa8:8806:12::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEFpOGLh-zGZwCsZy72esQ2s&google_cver=1&google_push=ATf1kGNkWejpQ7IHb4TfH47P-FuOjZEiKIBSKeI_Jyk6zCgo935udNS3_rA0W0SUiN2BLFNQSEgFY8pxOnyrOTDOF47Gf2rDeJl9Fw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=250&slotname=6076681977&adk=2278793534&adf=954853469&pi=t.ma~as.6076681977&w=300&lmt=1685634514&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634514187&bpp=2&bdt=1749&idt=2&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D76ab65cad0aa0eff%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_Ma0_IwpMBOi7nj9-q6otQoNKDc7Aw&gpic=UID%3D00000c3a8e3515fd%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_MZpfKIRVVeVVB8cjAISCX5v7pmlrA&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280%2C300x250&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=569&ady=4690&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=51&uci=a!1f&btvi=5&fsb=1&xpc=iUalWkZx01&p=https%3A//www.farfeshplus.online&dtd=5
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1400 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3BE5
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESENjUEEn2p1ZWdkGgfwj5dMw&google_cve...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=SnBkZXZFTHExUTRLeHU1&google_gid=CAESENjUEEn2p1ZWdkGgfwj5dMw&google_cver=1&google_push=ATf1kGNeFzG36vBr3BsSg5dnHKI8GaB-YGCb-HNCvWO_13-...

170 B
188 B

53ms
49ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=SnBkZXZFTHExUTRLeHU1&google_gid=CAESENjUEEn2p1ZWdkGgfwj5dMw&google_cver=1&google_push=ATf1kGNeFzG36vBr3BsSg5dnHKI8GaB-YGCb-HNCvWO_13-R5E3ciBmvx1B5EHnSKWd7ao5G0nLVF6lANlwXd76OXm_44LUm5M8tYeM

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 01 Jun 2023 15:48:35 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-777-g304ac51#rel-ec2-master i-03b3f67f69a828fdc@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=SnBkZXZFTHExUTRLeHU1&google_gid=CAESENjUEEn2p1ZWdkGgfwj5dMw&google_cver=1&google_push=ATf1kGNeFzG36vBr3BsSg5dnHKI8GaB-YGCb-HNCvWO_13-R5E3ciBmvx1B5EHnSKWd7ao5G0nLVF6lANlwXd76OXm_44LUm5M8tYeM
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3BE5
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WkhpOTB3QUJVSWY5RXdCUg==&google_gid=CAESECXqGYtBDuDT_SJiW7t4cqU&google_cver=1&google_push=ATf1kGOZD1-nJhawSh5sDTKVoh2dc265wQ...

170 B
188 B

54ms
53ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WkhpOTB3QUJVSWY5RXdCUg==&google_gid=CAESECXqGYtBDuDT_SJiW7t4cqU&google_cver=1&google_push=ATf1kGOZD1-nJhawSh5sDTKVoh2dc265wQsx7PpRokBPffsypXWU92RFf5_IBowqjhDybBrnb3Qbm7VE2WTIUOkegpvs9kNSXWW-Kw

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-fra-eddf8230027-FRA
pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1685634516.395340,VS0,VE0
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WkhpOTB3QUJVSWY5RXdCUg==&google_gid=CAESECXqGYtBDuDT_SJiW7t4cqU&google_cver=1&google_push=ATf1kGOZD1-nJhawSh5sDTKVoh2dc265wQsx7PpRokBPffsypXWU92RFf5_IBowqjhDybBrnb3Qbm7VE2WTIUOkegpvs9kNSXWW-Kw
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3BE5
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEEE0SOtS7WQaV14B6W7zwRY&google_cver=1&google_push=ATf1kGM_Zd9yDxZmrj1ucuAYTtfjOehU_j--xj-Z_JN-K3piWSSQjXXEi_QD31Tn9q-rJ95M5RsUq-vuLT08bW3HC9HZ2LI4OXHZwGs
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=B271353183294576B2158BA1778B6CA1&google_push=ATf1kGM_Zd9yDxZmrj1ucuAYTtfjOehU_j--xj-Z_JN-K3piWSSQjXXEi_QD31Tn9q-rJ95M5RsUq-vuLT08bW3...

170 B
188 B

53ms
51ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=B271353183294576B2158BA1778B6CA1&google_push=ATf1kGM_Zd9yDxZmrj1ucuAYTtfjOehU_j--xj-Z_JN-K3piWSSQjXXEi_QD31Tn9q-rJ95M5RsUq-vuLT08bW3HC9HZ2LI4OXHZwGs

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 01 Jun 2023 15:48:36 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=B271353183294576B2158BA1778B6CA1&google_push=ATf1kGM_Zd9yDxZmrj1ucuAYTtfjOehU_j--xj-Z_JN-K3piWSSQjXXEi_QD31Tn9q-rJ95M5RsUq-vuLT08bW3HC9HZ2LI4OXHZwGs
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 31 May 2023 15:48:36 GMT

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ Frame 3BE5 0
187 B 37ms
23ms Image
text/plain 98.98.134.243
ZEN-ECN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEOsvwjjWkktAB5aUnpqs9Wc&google_cver=1&google_push=ATf1kGMAu8wPERMPC0c2VNwb7JXfI78rFhNuWVgBhXUS_Mye1XQzTK3U_OpHCISHXNP2oll-v5dMKWNSFNBR8HkHGcSz76J3F-06Uys
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=250&slotname=6076681977&adk=2278793534&adf=954853469&pi=t.ma~as.6076681977&w=300&lmt=1685634514&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634514187&bpp=2&bdt=1749&idt=2&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D76ab65cad0aa0eff%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_Ma0_IwpMBOi7nj9-q6otQoNKDc7Aw&gpic=UID%3D00000c3a8e3515fd%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_MZpfKIRVVeVVB8cjAISCX5v7pmlrA&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280%2C300x250&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=569&ady=4690&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=51&uci=a!1f&btvi=5&fsb=1&xpc=iUalWkZx01&p=https%3A//www.farfeshplus.online&dtd=5
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 98.98.134.243 , United States, ASN21859 (ZEN-ECN, US),
Reverse DNS
Software: A /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma: no-cache
date: Thu, 01 Jun 2023 15:48:35 GMT
cache-control: max-age=0,no-cache,no-store
server: A
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 3BE5 0
12 B 59ms
58ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Iz10ntxGt90DroEf-Riv_vuxgfnDFdi0a-HOIi3EXuTG9fsDZ-eiDJbUKvysR_R2TOrn8m

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 3691 1 KB
643 B 53ms
41ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 77605
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 18:15:11 GMT
etag: 48472445140208031
expires: Thu, 01 Jun 2023 18:15:11 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame D56B 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bf8de94309b1e3f02365b2c0ec85fd640c1abd6d22ab8f2cf94bf6c06497ec9b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 767A
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEDu3dlmZa6d_LDgp9Eohb3Q&google_cver=1&google_push=ATf1kGNgXsnGP606wizbFVWojfFwC0NEgkMO2dSPBOVvZLQKZOZ3_J-EmqCF_QOsxqBA664mfprBSgBnp2Ja0_5KVTZOo-m41yYx
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=NzAyNjg3NDcwNjA4NjcxNTE1Mw==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEIV1Fr_x5GJh2RbbOS_2Mhs&google_cver=1

43 B
398 B

24ms
18ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEIV1Fr_x5GJh2RbbOS_2Mhs&google_cver=1
Requested by: Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEIV1Fr_x5GJh2RbbOS_2Mhs&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 767A
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEChUGf0rtFEu7UdYI8egHEA&google_cver=1&google_push=ATf1kGPnzY7qNXcv2VZm2IJHPk9oztvwRtm5SZ2ISQahLOgbIPcXMgAF4USekCr5pAx7v76ZJ_5-iMKB2ivb7p2m...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=V4RkeL3VQQC2_coXfwffuw&google_push=ATf1kGPnzY7qNXcv2VZm2IJHPk9oztvwRtm5SZ2ISQahLOgbIPcXMgAF4USekCr5pAx7v76ZJ_5-iMKB2ivb7p2mEkeMdSXV...

170 B
188 B

49ms
48ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=V4RkeL3VQQC2_coXfwffuw&google_push=ATf1kGPnzY7qNXcv2VZm2IJHPk9oztvwRtm5SZ2ISQahLOgbIPcXMgAF4USekCr5pAx7v76ZJ_5-iMKB2ivb7p2mEkeMdSXVm2SQ

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 01 Jun 2023 15:48:36 GMT
Server: MT3 851 9bd98ae master zrh-pixel-x25 config_version:"unknown"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=V4RkeL3VQQC2_coXfwffuw&google_push=ATf1kGPnzY7qNXcv2VZm2IJHPk9oztvwRtm5SZ2ISQahLOgbIPcXMgAF4USekCr5pAx7v76ZJ_5-iMKB2ivb7p2mEkeMdSXVm2SQ
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Thu, 01 Jun 2023 15:48:35 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 767A
Redirect Chain

https://a.c.appier.net/gcm?google_gid=CAESECYfc8PuWmIdvRmEiAX3b-g&google_cver=1&google_push=ATf1kGMV-kspkF5pJRMUg6fPJgZJ47SpHR_PEkvO5IgslU8-QGhMeC6kehUPJeK6sSg4qDXTR7TcsvPlX11sFvr9oovp_-B5zCUz
https://cm.g.doubleclick.net/pixel?google_nid=appier&google_hm=dE45VEI0QTJBbWUzMHFoQTFiMTRaQQ%3D%3D&google_push=ATf1kGMV-kspkF5pJRMUg6fPJgZJ47SpHR_PEkvO5IgslU8-QGhMeC6kehUPJeK6sSg4qDXTR7TcsvPlX11sF...

170 B
188 B

48ms
48ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appier&google_hm=dE45VEI0QTJBbWUzMHFoQTFiMTRaQQ%3D%3D&google_push=ATf1kGMV-kspkF5pJRMUg6fPJgZJ47SpHR_PEkvO5IgslU8-QGhMeC6kehUPJeK6sSg4qDXTR7TcsvPlX11sFvr9oovp_-B5zCUz

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=appier&google_hm=dE45VEI0QTJBbWUzMHFoQTFiMTRaQQ%3D%3D&google_push=ATf1kGMV-kspkF5pJRMUg6fPJgZJ47SpHR_PEkvO5IgslU8-QGhMeC6kehUPJeK6sSg4qDXTR7TcsvPlX11sFvr9oovp_-B5zCUz
date: Thu, 01 Jun 2023 15:48:37 GMT
cache-control: no-store
content-type: text/html; charset=utf-8
server: nginx
content-length: 243
p3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 767A
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESELWGlJAve2am3K4c53B41dM&google_cver=1&google_push=ATf1kGNJKXYnoZGtqiiPaKJ_W0jAyKBSOvK5z58qtYsac2UUVGcq_fM2eIL5Jjvv0qsx9Tej0glrQ8Oz3D5cS-5JZ52R7LS...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGNJKXYnoZGtqiiPaKJ_W0jAyKBSOvK5z58qtYsac2UUVGcq_fM2eIL5Jjvv0qsx9Tej0glrQ8Oz3D5cS-5JZ52R7LSB087Q&google_hm=eS1Gc1YzSmdoRTJwSC5pOT...

170 B
188 B

51ms
50ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGNJKXYnoZGtqiiPaKJ_W0jAyKBSOvK5z58qtYsac2UUVGcq_fM2eIL5Jjvv0qsx9Tej0glrQ8Oz3D5cS-5JZ52R7LSB087Q&google_hm=eS1Gc1YzSmdoRTJwSC5pOTF1X1VwOUNwejBDdXJzY1ZTcH5B

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 01 Jun 2023 15:48:36 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGNJKXYnoZGtqiiPaKJ_W0jAyKBSOvK5z58qtYsac2UUVGcq_fM2eIL5Jjvv0qsx9Tej0glrQ8Oz3D5cS-5JZ52R7LSB087Q&google_hm=eS1Gc1YzSmdoRTJwSC5pOTF1X1VwOUNwejBDdXJzY1ZTcH5B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 767A
Redirect Chain

https://tg.socdm.com/rtb/sync_before?proto=google_ebda&google_gid=CAESEIaxmcTKd9-9EWVqS_KFGVQ&google_cver=1&google_push=ATf1kGNKvELKukSIF-zqWdJji-KUAYT1vht_s7koHZCsAHYM7OrD9bMMwE753C5vsXlhbzlJtNRhj...
https://cm.g.doubleclick.net/pixel?google_nid=ad_generation_eb&google_push=ATf1kGNKvELKukSIF-zqWdJji-KUAYT1vht_s7koHZCsAHYM7OrD9bMMwE753C5vsXlhbzlJtNRhj6WFa51TDq3rm9E8qjfAKocX&google_hm=WkhpOTJNQ28...

170 B
188 B

51ms
50ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ad_generation_eb&google_push=ATf1kGNKvELKukSIF-zqWdJji-KUAYT1vht_s7koHZCsAHYM7OrD9bMMwE753C5vsXlhbzlJtNRhj6WFa51TDq3rm9E8qjfAKocX&google_hm=WkhpOTJNQ281c01BQUI2alMxc0FBQUFB

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

X-SO-Cluster-ID: 0
Date: Thu, 01 Jun 2023 15:48:40 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/rtb\/sync_before?google_cver=1&google_gid=CAESEIaxmcTKd9-9EWVqS_KFGVQ&google_push=ATf1kGNKvELKukSIF-zqWdJji-KUAYT1vht_s7koHZCsAHYM7OrD9bMMwE753C5vsXlhbzlJtNRhj6WFa51TDq3rm9E8qjfAKocX&proto=google_ebda","cluster_id":0,"gdpr":true,"ipv4":"0.0.0.0","key":"ZHi92MCo5sMAAB6jS1sAAAAA","privacy_sensitive":true,"uid":"","upstream_id":"m-ad211"}
X-SO-Key: ZHi92MCo5sMAAB6jS1sAAAAA
Server: nginx
X-SO-Upstream-ID: m-ad211
P3P: CP="See also http://www.scaleout.jp/privacy/"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ad_generation_eb&google_push=ATf1kGNKvELKukSIF-zqWdJji-KUAYT1vht_s7koHZCsAHYM7OrD9bMMwE753C5vsXlhbzlJtNRhj6WFa51TDq3rm9E8qjfAKocX&google_hm=WkhpOTJNQ281c01BQUI2alMxc0FBQUFB
Cache-Control: private
X-SO-HostName: m-ad211.dc4p.scaleout.jp
Connection: keep-alive
X-SO-Ads-Time: 1
Content-Length: 0
X-SO-LB-Hostname: a-tgng40005.dc2p.scaleout.jp
X-SO-IP: 185.213.155.146

GET
H2 204 /
cc.adingo.jp/adx/push/ Frame 767A 0
45 B 1334ms
559ms Image
text/plain 54.92.110.211
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cc.adingo.jp/adx/push/?google_gid=CAESEGkCibPEtRcNUCO2X5-x0L4&google_cver=1&google_push=ATf1kGNNoiEPWBf3J7334LkH8sj2J7PhBjJK_Tgqj33KqMPP_QBbc6ki8lfcoeJCzPzQXbsHSGMDKOTAEfcAzbDeEUecUD0r9c1e
Requested by: Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.92.110.211 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-92-110-211.ap-northeast-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:37 GMT
server: awselb/2.0

GET
H2

200

/
onetag-sys.com/match/ Frame 767A
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEGcHU5LJYGo72enkt0yMXX8&google_cver=1&google_push=ATf1kGMERR-PlaAKzYGmOQgPKTeNO7JV59jkA8_vTV58bmwG0saQcT5QWAUF0ZpiV7Haq80rDr5cq148ZvW...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGMERR-PlaAKzYGmOQgPKTeNO7JV59jkA8_vTV58bmwG0saQcT5QWAUF0ZpiV7Haq80rDr5cq148ZvW2lHF5R09HNM-07Z1q8A
https://onetag-sys.com/match/?int_id=19&google_error=5

0
151 B

14ms
9ms

Image
text/plain

51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=19&google_error=5

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip253.ip-51-89-9.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=19&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 255
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 767A 0
12 B 79ms
57ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JCI1n9nRZCYdAzPnvwztYVEBoG0BRYS7XXpSrk5ZXBIBduQAg_bnYYBssKodiwI6EUokpP9g

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/9548364509937149214/ Frame D052 15 KB
2 KB 54ms
54ms Document
text/html 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9548364509937149214/index.html?e=69&leftOffset=0&topOffset=0&c=UBPaKZQ8tN&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ff067250a334697aa929240baa053c275243c0bbc1a5cf9b1e280ff2eff85aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2270
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Thu, 01 Jun 2023 15:48:36 GMT
expires: Fri, 31 May 2024 15:48:36 GMT
last-modified: Thu, 16 Feb 2023 16:30:06 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 04AB 0
0 86ms
84ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv997K21sqtxyrk92ZnQO6-p3Y-JjknrnewMsDDlGDD9c43-XZPdmdMuzJtUl3njVccWUxCMaQ-fec7UrQxerah9T0lwIx6vAMlv67FyxCfJViduc2EfPbtr6lDVbC-Sb4q8Mk56-_D1kzDmSkwVF7RzXJJNA1t-wBkxQcZZWa589zpF08bknecDYeiXJAuJKJslCphFMZHRMGZgxV09qTw09lT_OHxpi46Zaii1RzwqEjTN3PYTG-BSUiUngkICgRJzzy5Mb7OJbeEa3auu7MxjopU8CjxROK35ij6JTbEcN_gGCPP4wmC6J82y_uV-qCCqZKVtOjHC0TPanMih0TsZLMaWC9e_UmDZ7BuaG90uw9R7psLmIA8XIiOqiP12SXuJZENcP7A2TZKDxrpObjFJv89hiErxh7z3uBiHFKYHFQvXpTSCXa-8VN2coOKkrcz3BUefNzdReQCo4DngkRw_jlXG22-R83lpKlzLOBKE9-udp_0s7t1oAvVDv9GyZX1cIaRjmdvrjzQvhw25-3iJgexysmGlQzRp8ju2YCpCUveGfeKiFdeSCimk3bpSlgd09LAPUlpC1Vxhic06qEtlh5Gwh2V1YZ2V0CEQKKYpZY4KRThGeWPv7cGfmvBHBb7NI3KzgAMTBnjfKVJiCceeuO90aEl5bF_Nx0vAti4dUoOQW_GI29Iq9Y5xqK-wZE64T_uCiwtE4yRM0EaFvW8Lwihc-ldF1xYZEz6pHiRzZFHB0iR4qP3Fq9SGuqwfjWypfkQsSURyBbu0mIplxZotw4J2IHWmWP0a14ENx5Lc17GkPHr8UI3gun2AU_YNJyeHmef_ebloTmGWLSPirCJTy95aJL7UzYtkqn2kst6TGJ6elnUSEdVN-2rYqp7S4TtgNO53F3vnlZRoEoVvF1TEJJz66Gf7ctW97xCV621Rm-bNy4mfeIp-BL-t2UuBBHEYmHgLFFoqi_AJbIOSo52lTUF2pLBif9qzY_pHdFoKd0Vhluq7kkaM_iPeBnWvXlbMzw20TxQblLRyMdKBMEsIDI9V5q2n-2TUncxkmQbGS15dQzX_-qqkQ6Jdhsyx0LqoKcflSwX9kEeTLaooR4fpTwz6Yx1_are3OtB0m35cbBySTzC37eyxKfhai8f6JhRr0fCN9mOkOiJFr8tbxBQgiy85PSPN9KPVqwI4YBPKxv3TVR7qMqKWv3SKgmKxGm731BUPQvtoAWarn4DxSbdhb1w85pYCxT_fP8gKQlEpKouaBRINdeVUIR4aSsHfYHG78Q-b-IngWqVwfdKNkvMjhFHOXRP8TAZ&sai=AMfl-YTmAKN7Fuwqb23BE2M-KkKdZ2WT-8oQT9hmxy3R-oTUU_W3_rCazdVFh2InjmEvF1UkpOqwN2FP0FE2QMrXzJ3ifqiSC_L-uQLeo6u4-fQRv64Xthxw3MStm_Ljb8frw7nRH30iWMsPtV2AjOx58pS6kQXVj0tugqChL6cZbZu8-1RXctpD8joaMRZELKmI3ikJ0ROFaZIh&sig=Cg0ArKJSzAZTbZN6aR7LEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=849&cbvp=1&cstd=825&cisv=r20230530.93095&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 01 Jun 2023 15:48:36 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Thu, 01 Jun 2023 15:48:36 GMT

GET
H2 200 ea8IacM9Wef3EJPWRrHjgE4B6CnlZxHVBg3etBD7TA.woff2
fonts.gstatic.com/s/googlesansdisplay/v21/ Frame FDCC 21 KB
21 KB 63ms
38ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesansdisplay/v21/ea8IacM9Wef3EJPWRrHjgE4B6CnlZxHVBg3etBD7TA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92a7f8224a1ba2ccfa92d3e1fc55ee5aa7ae20a0fcd80d3331bd660878a090f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 27 May 2023 21:26:50 GMT
x-content-type-options: nosniff
age: 411706
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21428
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:32:46 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 26 May 2024 21:26:50 GMT

GET
H2 200 ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2
fonts.gstatic.com/s/googlesansdisplay/v21/ Frame FDCC 20 KB
20 KB 70ms
50ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesansdisplay/v21/ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

acc5497e76f832d950d14fcfa047dc3c864f7a0aae4c7a20521c0c655a53033b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 27 May 2023 16:40:42 GMT
x-content-type-options: nosniff
age: 428874
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20784
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:21:31 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 26 May 2024 16:40:42 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/8545329873006492075/ Frame 5C94 142 KB
22 KB 43ms
40ms Document
text/html 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/8545329873006492075/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5728239d6302f134e425b17d7758bc6f4206b4acfc035db7f8625c2f1bbdea5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 537435
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 22810
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 26 May 2023 10:31:21 GMT
expires: Sat, 25 May 2024 10:31:21 GMT
last-modified: Wed, 09 Feb 2022 10:36:00 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 9E03 0
0 86ms
83ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss-JPnXDa1MtpZAFzY5rVyV5w5q9kO7EMUCgwNNeHhY0GQ-rCQ8369VlDU1KKAng1hOqklzVgWFm9ZkID95C_NMrLWqYAySMnQixUT1SYqmDTszwFy7y7MtsMZw3k0DAZo46sx5G_Fzxx0udJDU_1nsgl7YOXHCQfsIX8gdCW2XBCH-oVgUpl6-WujjMoTlkBR3aJqjp5EA8x1ESnQE7dTfGExqFxxKnTgm1LW5pmsX6aZst-6TBe8DYQOF3oUMjX_EfvI-UthM9THcpvcyY6RQ5ATJ6iY21lL1USxGDZbSZ_MJnt-efOPip0dx4W3M9xnwressy2Fq9pIZMni_63DIKW0Cy1MGmnMRHd4Wky9cKHtniqw6aRPRJG_lIpBoEe8TwzB70XxhwNNE5iVUwk0VbQV-WKrYI1I-8rjxNtf9QXXv12shDXT6CIn5HYB2avIposxjo4js1gVS4R_d-W_QxwCk6wl-N8HeYdBRHTsC7rczXQQ-Fl46SGucgHx5vC9RBRO6dNUMNobmW5zPqf9-vzp6L5zkIcQdeJtFPmBy5iKhpUjG_ucGfsFVc4Lq4agFZDlik016uhjDWx2Mn6uVOvcsjRquhWzc2XbEd7XOiwjEHPD8sl87s43LMDZ6aJ372Ha_nGXxDNhdfo3E4vlvOK_CHZ6T9NQGIvC8amNr_MSptyeTP9ESX38-MiQ4FQeemEQ0GyQvrfNLuGgbmTUDkf82DsEJI9y_FBBbbXX6uf811vPG30_sc1QiTn09U-Stt_Mis21J22dx8vkhDXSHp7hzhCYFy2vfu5VXTdOG5BFaqn4aoRWlYYCbBjJBhH2o5GKNtj5L7xdFD6meEE91islXT1Ed-tHtmIXYqWhU8HdnIMnzbIBu3vmKrLX8DbFOst4oELWLx3o2omEwW0swx2zhnxAWmpEoOgOQmDe9KmY7M8GZyPgEdc_24WY0Xab7tueh2miwoESumz7AXhp44dCuikOd35E9seEzfNuJRnTHYyG_yNYv9SUtKIuoPmV3Ib4ysPtkCbatHtUNTove-mCdnTlVB-YtEeu--5cPMoh9BzLFTIJ-xC5TU4zauCxjlfipInhcnDtweiW-atI8X2qQOrBS8ckXRWMifCD0P7EMFCEP45RyykjZ3eP-Yx3TFV0KXlAdNIaHT2Ih2zHJlW3yAQEA87KShxOqXO2jR2G9lt7zRppB4BhmNKV43u-zq75mGtoQYwjlar3Rq87roKAYcDpOud44dX7M7M_RvrzTXS33QsKXJFnvY2e7uz7TmTVgq2fTfk6cr3Tfwxeb_7Xp3hXCSvWND-tkwYQu5VII6o3Jj1_ZsnhoozfFADNaQv_5__LEKDAV&sai=AMfl-YR6JqAxU2E4RKcmUyrmE1LFIpSLzAeG0VZ-6RSxsCd0Lr5Xovo8IUqJKD2MBtISV-9oDpDOpCGhzGrrQP38-I7P56h23fGfnFOSSInBlNedmpeIiwiel1DI17u0kYWnohLmfckjlJlcp_GKul7DppdzZUnl78WwocLyCrC66MkAUVzN2KIjFCzYtaonvwitOdKCOVp5tfsVZQd_tc-yCefo6YXTQJsVhg4WZ_Gq0cboR7l8mU0er67Io_RSAht71F66&sig=Cg0ArKJSzLXFZOVtIY67EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=909&cbvp=1&cstd=904&cisv=r20230530.07167&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 01 Jun 2023 15:48:36 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Thu, 01 Jun 2023 15:48:36 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 30AA 22 KB
8 KB 46ms
42ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 151884
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 30 May 2023 21:37:12 GMT
expires: Wed, 29 May 2024 21:37:12 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1

200

partner
sync.search.spotxchange.com/ Frame 7EC9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEOqiv2Oj5Hp9PEL26GF4rfQ&google_cver=1

43 B
549 B

181ms
15ms

Image
image/gif

185.94.180.126
SPOTX-AMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEOqiv2Oj5Hp9PEL26GF4rfQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhC5lOngAhjV_KnbATAB&v=APEucNXVni6CXJ9ykXoHfE2jMszQ2JC2fLTwbHdl17VmnntBhDooaJSREHaYoQuBb3R5ENFK2xVQgyzef3BP7ev2S1ZebEPPfFApOku0PI25ETFsGY7Wm1jyVDwy68d7k6AjS0W8rdiROe4V5HS8O-vClz5unBPWHRm3WLlnyrmGUquRBP3OOMgHhJ3oX8uuLXc5bR3skT8WN5g-5xGw97aLPYFPRjdVag
Protocol: HTTP/1.1
Server: 185.94.180.126 Amsterdam, Netherlands, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software: nginx /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Thu, 01 Jun 2023 15:48:37 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 106
Connection: keep-alive
Content-Length: 43

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEOqiv2Oj5Hp9PEL26GF4rfQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 306
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7EC9
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID
https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID&__user_check__=1&sync_i...
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=YzU2ODkzZTItMDA5My0xMWVlLWI3YWEtMTg2MGYwNzEwMTA2

170 B
188 B

48ms
48ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=YzU2ODkzZTItMDA5My0xMWVlLWI3YWEtMTg2MGYwNzEwMTA2

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhC5lOngAhjV_KnbATAB&v=APEucNXVni6CXJ9ykXoHfE2jMszQ2JC2fLTwbHdl17VmnntBhDooaJSREHaYoQuBb3R5ENFK2xVQgyzef3BP7ev2S1ZebEPPfFApOku0PI25ETFsGY7Wm1jyVDwy68d7k6AjS0W8rdiROe4V5HS8O-vClz5unBPWHRm3WLlnyrmGUquRBP3OOMgHhJ3oX8uuLXc5bR3skT8WN5g-5xGw97aLPYFPRjdVag

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 01 Jun 2023 15:48:37 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Location: https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=YzU2ODkzZTItMDA5My0xMWVlLWI3YWEtMTg2MGYwNzEwMTA2
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 98
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7EC9
Redirect Chain

https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&redir=true
https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS1oaXBIeEIxRTJ1R29SOXY5aHVwRTNsVGV3UHZYU2d3Q35B

170 B
188 B

69ms
69ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS1oaXBIeEIxRTJ1R29SOXY5aHVwRTNsVGV3UHZYU2d3Q35B

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns31533569.ip-162-19-138.eu

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS1oaXBIeEIxRTJ1R29SOXY5aHVwRTNsVGV3UHZYU2d3Q35B
date: Thu, 01 Jun 2023 15:48:37 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
409 B 53ms
11ms XHR
application/json 162.19.138.118
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

fe5a8544ab484c9078c57809519fa909a4c7803e4382d85e774ba64cdfb4eb0c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.farfeshplus.online/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.farfeshplus.online
date: Thu, 01 Jun 2023 15:48:36 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame A623 22 KB
8 KB 46ms
45ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 151884
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 30 May 2023 21:37:12 GMT
expires: Wed, 29 May 2024 21:37:12 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 1A8C 22 KB
8 KB 46ms
45ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 151884
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 30 May 2023 21:37:12 GMT
expires: Wed, 29 May 2024 21:37:12 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame D9E9 42 B
405 B 466ms
75ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssSjG2ppiP2vOtDHbJ6b9xudgD-sHMBhJII4IedEU7K8dNQItNwYV8T20JdgLP4ufEHJ_XERWcjVHbuMA_fF6E-eothzhTwfJMg84ErZRKklDZoBY9hlMSnDc_ol4lLla-t9MJb8Q&sai=AMfl-YRM35kuHr5bptDKwgoDhb-_aTnNC2IDaZ4Tte7Q-dUVbtnf5gWrdENPwVylELen-_fxq6HHOYFzfh4t&sig=Cg0ArKJSzPsHFtz7e4E_EAE&cid=CAQSGwBygQiDXYXMWvcIFS_h38L7ZwG2WlNjItXS5hgB&id=lidar2&mcvt=1241&p=0,0,600,300&mtos=1241,1241,1241,1241,1241&tos=1241,0,0,0,0&v=20230531&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=2&adk=1530395088&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1685634513527&rpt=1856&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 1676550659977.css
s0.2mdn.net/sadbundle/9548364509937149214/ Frame 8854 9 KB
2 KB 52ms
51ms Stylesheet
text/css 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9548364509937149214/1676550659977.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9548364509937149214/index.html?e=69&leftOffset=0&topOffset=0&c=bnyTc2AwWf&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

232bf950740690a92eb6f4a6110a536fbe24114928c38ebe80f69aa3b2db6709

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9548364509937149214/index.html?e=69&leftOffset=0&topOffset=0&c=bnyTc2AwWf&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 27 May 2023 17:33:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 425696
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2341
x-xss-protection: 0
last-modified: Thu, 16 Feb 2023 16:30:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 May 2024 17:33:40 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 8854 118 KB
40 KB 46ms
45ms Script
text/javascript 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9548364509937149214/index.html?e=69&leftOffset=0&topOffset=0&c=bnyTc2AwWf&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9548364509937149214/index.html?e=69&leftOffset=0&topOffset=0&c=bnyTc2AwWf&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 07:18:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30590
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 02 Jun 2023 07:18:46 GMT

GET
H3 200 1676550659977.js Show response
s0.2mdn.net/sadbundle/9548364509937149214/ Frame 8854 20 KB
5 KB 66ms
65ms Script
application/x-javascript 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9548364509937149214/1676550659977.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9548364509937149214/index.html?e=69&leftOffset=0&topOffset=0&c=bnyTc2AwWf&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cff8001763a4cb0cb81352e07fb9927790673baaeda29140c072f30c5933cf10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9548364509937149214/index.html?e=69&leftOffset=0&topOffset=0&c=bnyTc2AwWf&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 31 May 2023 16:37:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83440
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5491
x-xss-protection: 0
last-modified: Thu, 16 Feb 2023 16:30:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 30 May 2024 16:37:56 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8AD6 0
0 81ms
78ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstQoGRd6OG8gasWthEsOEaBlkRyJGrgjDZPNFq7VZpkmt4vHrFEqDCM4HnAF7qbhtjJLERYik2c1zrI6MUY_YuPcHbyzyxL5c7tx1KO6yvEke16skH52T4dDf5lLo3HZTFHyndmSCfXWSLjXO-o3gUh1PrbTBXwFrQO0wqtpJFYP-TtC3ExFX8G_0LPC6lYT7zfTUXM7S7c0BHbN3sGM6JKUticPzLGP2pOXUyWd4UGGzIEiIVz2s66f9hy7gKuq9e9Nwln9QiPMXuQULwmozlKwJd0s6rNzph7YFGgeGWrpb1UGEr5kNUmGXLU3NqnDwivbnNEYQh9V7Yhe6SVJ2SI01EfLJNkizGXlqY0rYPSlNvkzeWRSGNn5bUuc-3dCDHriU8rUJo1D6ektiWEd3fXNVno7VGVlRZrr9Gg3G3FqoYZSuvpSOcfS9yAH-VYpbSf68km-Dex4xvQ_e989baa-dEFvljsL1c6LLUujOT70CT4kxeRZq0cpcJhDxMz827Uq7H22oS9A95Lq-G9TlzIAvamM--oez5yi55cLvicAFw_HJ5sfCIitg1lMMQGDj1TppLrip2dXCKfZNRKC2DpfO10fYl9uqj-bJGAuhFDHGl9cKMuO4Y-Fsmip3X9utRiIw1UZYBgD5PIP2w6F7_wODiz_QrA-d2HH6hO6aU-K0Rl_3nYBQtIdPxrBudUsF-GDKqBK475XqNnv9FhZ_Qhh37spyZIzfha2YuLavxnCuLeKCiJPMgD0DZzFCbG2dIDUXEvzcTCeCJI0Oa208LxmX9LKigJM-bvZgsuQJvFDC5ZaVSSCvcgMVdSxAxbdhEnMrk0ym1rb1rjCmekNE414c1iKtniwM11wXVUyOEvLBCPPJx6whdVkkKsz8rRgmfsO4slYfXJ-iHmkbAZq1J7WalAfWg7Jdw2V8XpnFavj4rK6RxVLA44Q0fFcu1oapKd9e9zpOSyJwXhcV1-8qLx3Xl5zValwkFGAQDu0rTRGWk1_TzrpvXtG0XCy6N9HqLIIJeTRah1DHNN5FwGvm7GJCg8xtJhMubsi4MiAR_admi9_PzeQl8zyiwh2WfXSql0TuguCDDeZi2OMHrmYD9Sntrydas04bTwggmgVL-zb5mpwYHVKFsCVYIe7PpTDGWfUFwPdKx-a2nQ9F-KpPSeWIvzMdae18l6bNxTVcAfAJAnwJwhV5wMGRzuOFUuHM1mL5u2wz4TX2gGat_KcFZd3Iri3QtxVwWwpUQmMCqUZgMgZYCwbamrWTnPerY_xTuB8aWuEazSaPD30HrA6MGrsNvneaE_c9Vy2HgCOXdBwXSollNH7ba9L-uZai8-2OXYJgO-BXhmWyaQTSGeJZ2f-BpgqGOKFX4&sai=AMfl-YTqKPuaW-S8DfN8CpwcoCYDXFsNpkf8qUnoZK25FHKNowHxeLXu72Z59o6lCSBikKbuOesyPuq-W5psBzHY-2echJLY72oF6zevI7oPbYNAQMXPhs-sHfIPL4ssd-rlwiH7FGhRH9IMpOp9GXJU1A6oIz-YsStGrcHFbplVS5aVJ6e8wpyPP5OzdplPyFsUwAGKQtAQx8svWYlR84b091OdVnqzPElFl4Sh0RdUUHTBFc-SLFVYyYtv_Z7HTt0qIXJr&sig=Cg0ArKJSzAGDnNYkc5SEEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1008&vt=11&dtpt=1007&dett=2&cstd=0&cisv=r20230530.95307&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:36 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 01 Jun 2023 15:48:36 GMT

GET
H3 200 1676550659977.css
s0.2mdn.net/sadbundle/9548364509937149214/ Frame D052 9 KB
2 KB 41ms
38ms Stylesheet
text/css 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9548364509937149214/1676550659977.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9548364509937149214/index.html?e=69&leftOffset=0&topOffset=0&c=UBPaKZQ8tN&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

232bf950740690a92eb6f4a6110a536fbe24114928c38ebe80f69aa3b2db6709

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9548364509937149214/index.html?e=69&leftOffset=0&topOffset=0&c=UBPaKZQ8tN&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 27 May 2023 17:33:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 425696
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2341
x-xss-protection: 0
last-modified: Thu, 16 Feb 2023 16:30:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 May 2024 17:33:40 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame D052 118 KB
40 KB 42ms
39ms Script
text/javascript 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9548364509937149214/index.html?e=69&leftOffset=0&topOffset=0&c=UBPaKZQ8tN&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9548364509937149214/index.html?e=69&leftOffset=0&topOffset=0&c=UBPaKZQ8tN&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 07:18:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30590
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 02 Jun 2023 07:18:46 GMT

GET
H3 200 1676550659977.js Show response
s0.2mdn.net/sadbundle/9548364509937149214/ Frame D052 20 KB
5 KB 56ms
53ms Script
application/x-javascript 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9548364509937149214/1676550659977.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9548364509937149214/index.html?e=69&leftOffset=0&topOffset=0&c=UBPaKZQ8tN&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cff8001763a4cb0cb81352e07fb9927790673baaeda29140c072f30c5933cf10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9548364509937149214/index.html?e=69&leftOffset=0&topOffset=0&c=UBPaKZQ8tN&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 31 May 2023 16:37:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83440
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5491
x-xss-protection: 0
last-modified: Thu, 16 Feb 2023 16:30:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 30 May 2024 16:37:56 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame FDCC 0
19 B 90ms
85ms Image
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=ClB1X0b14ZJ76JZDU6wSxrq5o74PEoW6_yK-svw7Mx5qm_QgQASDg4tlWYJXikIKgB6ABsLqh1wPIAQmpAv7SqCll7LE-qAMByAPLBKoE3gFP0DY_UY-JvCkvlbv_ndsprIFD4y50E3nVyqcjimpwQcpBLXQseBrYWIyUguFCr2lCLA6xEmxq24s7KBE9X5GLlCQlyoVgyiCYQJ3XojVUF7oNvlN2kNxqEFQsR_WTelKUy1iKocVZi0SSpJ4Y4CnMJstwdFvsQ4fjyvP7PCUtYOKC_0tTMqwfZrSqYJqbkxxNcV2k5vVob6SimwvBE7EOnWtJAWua7CLqf6FCjiFUgoZOUEM35J68Tpf_4N4qnzocTAQOkwB5P3OUNLcKEMaXobp50hWbaUNuabc_TW_ABMmYqargA5IFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBoAYugAfF960-qAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgHpr4b2AcA8gcEEOneCtIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgHICwHYEwyIFALQFQGAFwGyFxwKGggAEhRwdWItODM2Nzc0OTk1NjkxNzAwNhgA&sigh=5Dh2ZcCX9qA&uach_m=[UACH]&cid=CAQSGwBygQiD1fhfvfURPkZzAlGEZHezpvCdsquqPBgB&template_id=494&cbvp=2&vis=1

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=1738279810&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1685634513&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513553&bpp=15&bdt=1116&idt=15&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600&nras=1&correlator=7472659638016&frm=20&pv=2&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=121&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=h6AcjFpLLX&p=https%3A//www.farfeshplus.online&dtd=26
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 01 Jun 2023 15:48:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 DcmEnabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 5C94 29 KB
10 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8545329873006492075/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

467a5b06cb117035f7882e8c71d80e093f04ce586c1ac2b84e7e4adf978edb30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8545329873006492075/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 03:05:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 45816
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10136
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 02 Jun 2023 03:05:00 GMT

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
340 B 33ms
33ms XHR
application/json 52.209.172.99
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.209.172.99 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-209-172-99.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 4941d6e3115bcf206575e1a1d6ee5c7ab8adeea67ffb8500d92a7a67e84d9201

Request headers

Referer: https://www.farfeshplus.online/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://www.farfeshplus.online
cache-control: no-cache
x-server: 10.45.12.234
access-control-allow-credentials: true
content-length: 60
expires: 0

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 9932 0
0 100ms
99ms Image
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CpEXd0r14ZJfsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgT9AU_Q8ZBoeXcmdFs3Ne4A0BVHUHpRZOO5PUF8yj21nYvXGukTSVcmJikWDTTdzUDA6tjuYC_T0lMUYcsxvmJNSTXR1k3ustgfuZjkC6gzl4cbT29hO_ApbYH3NUKYpksZBvgNwA8hvm7gcIHysBOKG1CyxwkMVn3_AznTZl1sh-cWEbMnK2kaeT7j1fwtgUh6a8nOjdoqKEMysTZzHC-GT285wF9nl5s-MsqMa7Mglc_e4SdtaF60jUbSkjg-IuO3YB2XMHX4PuHDh-LF2f2Z5BJf7wvqLIxpARHaRA6sJJsDqyuG0eXHmo7euGjQaWyEKGCNBK46H9y6gdSELCrgBAGABoKGjrL8sNmW-gGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBAgAoB-gsCCAGADAHQFQGAFwGyFxwKGhIUcHViLTYyNjYzMTMxOTAwODcxNzMYtfIU&sigh=69DrKzIKZKE&uach_m=[UACH]&cid=CAQSPABygQiDlk4WgEO7gPIex1VE8Jg0cTExZaWZiHzsRtvSsYKlRYjUA91u_MkAV3z2s3q-LzX5eNUdn6MZKBgB&cbvp=2&vis=1
Requested by: Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

GET
H2 204 winResponse
prod-rtb.ad4mat.net/ Frame 9932 0
40 B 254ms
25ms Image
image/gif 2600:1901:0:76b9::
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prod-rtb.ad4mat.net/winResponse?a=1gxc4sa05f68fjgpk485ptxf9n4x6tf8v3xjk9rebdkj9tjc8dqnnw9ttvrrqx0a96bjh19xax65hnenrfbps72v9e0khyc2e63wnhs25mv475wj8884yx628qsypag37v1stvgwtn9kp4ncdmv4jxe20zjnfcrg62v65wqe0ewvkaz8dd6mmwttq381h68f9kr89gf1jeaxvqptfx8390ksse6jb3am4qgzm9yfd00wfky1jcferkqv0vrdng3w5zbqzrq5f4gjm43y46512y5jh65jvywr1kqz9gthkvhry40zytbkevvsbekzz68nwbt0k34axsshjyn10kyqsdcwenw0cgbq5c3qexwd0a405mqy1wt92vd5t6k4b1rp0fvkketjvm&b=ZHi90gACNhcK7cvPAAUdNpPfz18bbCY8YyryUg&cbvp=2
Requested by: Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:76b9:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 01 Jun 2023 15:48:37 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type: image/gif

POST
H/1.1 200 1113.json Show response
id5-sync.com/g/v2/ 241 B
657 B 57ms
9ms XHR
application/json 162.19.138.117
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/1113.json

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

15345c8ab59c90b978bae3f21a14f576a1d92fe3fabd8157db4b2b644eef2529

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.farfeshplus.online/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.farfeshplus.online
date: Thu, 01 Jun 2023 15:48:36 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/11934569601524222564/ Frame 2F82 13 KB
3 KB 60ms
49ms Document
text/html 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11934569601524222564/index.html?e=69&leftOffset=0&topOffset=0&c=b4mNOqcYSi&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

293c4dc30efea546e286c0185dce44c51099dd75f3486716f08547a8df84d6a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2688
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Thu, 01 Jun 2023 15:48:37 GMT
expires: Fri, 31 May 2024 15:48:37 GMT
last-modified: Thu, 30 Mar 2023 10:59:02 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 68C4 0
0 88ms
87ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvUcow9UuYoaBc0TmPqBpMVxsjg2PbU-EFEh1sxJc7WaejilyjkuL44lWfyRE7QbA-yfYG_qrff7uawFM0jsCi_ALL26ZzVRw6zT_znH2VH-wgsZIry1696lbxeVp3CWGN4-9MQekL2aRGNeF00Enl9rLCE48vLgY0c5-OmEWHwnAGHqhkSuk2Uke_DasjWTvklvJ4Hj9I4-Vki0xPeETAsljZ6gN0QaXtDCsxxQk_ifqTQXCXfJ2knGcb-L3o8WrH6la13oxb6vozX7pPFH1YdYHro0p5TrTMIjnOhqokjjVX8h4mK6aoi41rDxD8cup-chdjfyjSjsfS5IYqjlc55NUOvv86F7HGOE5h16w9WwZoqHbvFG3OmarKQp9TGq1CME5Y9cuhog1Bkewe_4Pal03Q7fxF5yHa-LTMY2nSvbvehKKBSXmwv7L5DmAJ_fXyBe6a6jXBwgOdGjdVg6A8RzwopTXrH4d7CUvDwL9LesBcHl-nrLhai86RRjHPvTtcLNtEOiYI4oGIBpM6K_2gJ7qgETchzdpF2rtCF4HE-rD71rGzbdR7VzbM8L-5ZnjDErT1EG6RfECWbDaMomlJZbfyxpSWACKSTzIjAo7fzxAvCyGtOHhtrgTe6ivkjf-ivLhqIezjCD4uWzd713-AQo4qAXAeKyEPA2MhXETStOHyOm-PwZM3MQEeROQwTjaHCC3wRestquV0VXfOLdF8RjicCY06gQFwxbWinEnHT7QGsDqMNl4_pHhVKCk4-_-gzkbQYojfppuXG893viR6yCgAJXy7qLpipfTZwXeQ_W9Suz03-MQlXJZmht_fOjj3kRSGsVS1lTxT-69GwdNo-fqYjoEC4l-vaq7y0ZKfecitYcW51iyDAaZ9mPDqXa6cxOZJhD2u8UXhshNMLpYi-3lxq_38qLkHGR761vh1H2cO6NooN2FTDaGP1z4NtsqxMywPuYnOsRTf13rKgFK5O5JBfeE5Ys-445vCKGLcvcoEUbn82OEL64mjAbVfvFNs2j6cECFmF3v6UXFq9nWHcd9rr44DSUxmORC_n-g2hMn6Hdwe9zcIMO1A3XTfcl7WDTIMmh4jrWNkoMsfPEbO7b2Mtj2sPAmBI8kNYcIpYWpe_I1a2XUZcBlG_LMpPMYJ1HXa_NRpakDamxinYUSgf-WC3C3sjXpEiuO4xLSk8joJKndJKa7qnV3kSpq-zWrosHo4Vqdd64MuTbj0XZJgQZwkNND3dDl5rAbYQ05bwYQR-uujypiPKzXlKeKbNyZ5zoFAAjju0MSoNKTd8dHoa6RGE7s9rJi9Rivz7TVQ&sai=AMfl-YTuRolX7H7sihuPM8xAUdQRcgJCGfTIO5Ryv6puicrGoren41swt3vez1uWt42zplmru4Ch5MY05Bcbzu8C8ImyeRjhOjlmSEMIP7LcOc4Hd8NsVr_q3dlfMJq1AxIMaT2DpTa5ajtb8pqwIotkGuLWReCzf7IlArzVC2baegOPugE5C3PVifG11AjLxeQIW4YOrcfp8cw6iGnQgSLtg7o2bHXzdcw6ISK1Bg&sig=Cg0ArKJSzEOF_yPFH8nqEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1000&cbvp=1&cstd=987&cisv=r20230530.14505&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 01 Jun 2023 15:48:37 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Thu, 01 Jun 2023 15:48:37 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D79E 0
20 B 75ms
74ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=9244528452242&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D79E 0
20 B 71ms
71ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=9244528452242&version=m202301230201&ct=119&x=1&cor=2436493295178628000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame D79E 85 KB
36 KB 86ms
86ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BZJytK53Uo_bolTBtglvZC_FInSYkvsBnSpPZ1s85UY-WSoGdHhJk5OUt-y-FYKuWZ6oxhynYDghu2KE1uRKgXNMLKjXCRzagbhyzWUPmHjvfApNdPcOfQgrGSyMQubUSKPhyKFvgjahRqBLjpSQHWWIqf5CIA4fPoVUVKl2Zwz4HIx_w&cry=1&dbm_d=AKAmf-DCmvyP0GStFIan_T98guyYYLbfcjG4BAAwmMmXQZah9xnearA8QvSf-CvNMXit1h034oID5ytREbnBUlj7dixdptwXIdUTV2lf0LQlqjtCbCtpBsXbDX2mQpmsHk4v7RSRL77jLaHjfipmoiI_43zlhLoQ61B-5UTefwsUlKpSVZZrllsIJGH2zKFqdQ7qVTGeqVtvDcNGiuRDnu53b4vLxldj4fKG4Nt1CBTT5rimskVq58K2g0czIQ5BFtsaoCiDc6Hx-X0NRFp1p95lNGVCYxZ49Ijmhm856S5sd-T_-k1ih8U0m6zpN9NdIfgerXnZFFrejN_Ehe8LGAKpe8YW7UJAjnpOCgbEWRcTyIU5Y8q8VdG9W7VQD4SWSkXlC9Sw6ffGeVhxDTJO8a2d5eHSglotrNC2TguZZaM5BzWU7lsOwJc-LWjhsoY2MY5SfcEpM-vuFFmtRA-ktGKDivMCceZlrN1sQVGLBnPnTeUH2z6V4Ia4PDemrLBZSEefOHC1tcrIEh__dxAwr0gmy9EdCIh9jrFZrpty8GuMgA449lhnhSzxPJHhQZyUJbFbXtTwlCfenQyCNhCRD-Pw3FsdySqEmRX4Esp_lGOQvk8Vomc3P0uFYZsl_jpnZYAldUjo2M_YLHnKgH_yc7HgyF8qykzjb8h7ttOZ5xZV-bjSjnEBY0AJqUmCIIG7cN9YJ5ZeQUBU4dxlJ0KlhcpUOQ1Cbki2410Zl0y5OQXj-BB2V3AzKBI21dEo05L6C0il9u44wuGx8tLPlgnZQ4Z2XOAqRSsntsT0ZFJ3OGngjpu-fyEX6MOWYxEFHeZkqT42oNftgIzC52rhjCadl-lWkmXlfen0ayYwXBzNNmpJDiEuD_2U3SjNwV7juekIGJX33VRpuATIroNParRO1ucxYbxMaQHZ_Y81kiRQNE52LD_LFlG-sQiutlxJQwtggHocxhriMfaSOi117kANchN-3kASji6wYuEL-4HC-1cMw2gThfl1vtCIbiHclc4Z1h9BhzNFt1CnPnRgP04ZGbQERddiDOnKap15QedntUF7oru6KyndgMNGs_FBkejzX13siWX4l4tMuhg7ok208IZCQPPnMkejva9B5qZIAu1FU56XRn8L2sAVjSXJEnqtlO6YW83EvSzDuk1UpgTv6IBi-BuZ5hMRWXdb42PwJ1rcASdeIeAykWTkFsa8ULtf2tQJSNUEX0if627jJw2MTQZUJvu99EgiWv9-DJKs-Fk9UoZ5B5RPTRMsK3eAfI7iVUiN-XDDahWNp9AdYFQ-tsWbUVqmA8eVmYMxZnhnm1iD_JOA7rbEueD8Drg_8E6KDKvd9_pr9SM2sp5UENL8u_ZFJY8QMbAXAysP5WIcSLF0b6UJdiM2-mFjnP2lhjuG1PdV0SoMuTIGFWVbJvN4e0BLPpYJk3ciLz5zd6mp2PS8U2lIrDXv55M1ODSjU-rEIgBWtve3x-_Xp33gHz9vJp2SPn3ngJKW66NXTHFXkORADc0ZIFO0CxIbyEe8Zhv5uofFGKk_IgMDE9yITdu5FcifuktI9ZfeokiBD8TPRKpAmsABqfCwRsukEBSEJR3OvjMtvFOkt4RDjhgij2cQnoAgkWKGjyNHd4J3_K9_943DqIbdgfDvquW3V9_6kEcbCxfbPEMxNicrZnK0PFL82E3OOC_5t5dDrslWx_fWI_TMphSDFS0kP7dUvtb1AEVI_UWz2fUcgwMkg_M7FBx3QsDlb_B2BpbdkK51CpvUq1jJeLXPpEbNEKCxbCoLznb_SUYPKoNj0mLf8qp1GaD_TaXLqIyKSneyPUzfttPUq5l_ZpTo5ERVZv2n9YjYOiDuU9q92m8pYcWW8FXB_fcdH4jlX_WJW1cG55jesvYapeD6JqAlxdwqxMrqXb8V4B1SsOvW2bANq5j5LL9TrbsntpntKDNvU2GyYFTS2zV1gz-44zt_r-y28nQhMyKZqtjwD4_Zu-WXeo6aPV61_z1Itrb1yuKxziBvsNH9HYYiBNwYWafQZYnmCCrdqLonSbtYZcKcqm0mkU4eNbTlYGO-DIeXktnsHF5n6L4oeD6BP-b9-2Jd_hnT0oBjJGe4_YOKGqg89DOmpTamNoKxWkigVogH8PUP6oAbbP1LyLpX3wFl9wSSDGd6F1J6Yx3KhfM4Alm-SHkqTh5qGpIJyIo-AyHaHykyX8bEwtswRkaRKm_tuaSQg8wMiTqyHxZOFVjq88auV1RVSHkBjkhpzvQhn4dY7NPOyw8jaszLyG-85M01icMiAnaaYP6Z6kI30auXolvIddcx6X38xIijpW27qYUKUkm4JA-xjkbfouTg4XkHm_FZIsIGU2i_5Ys5_rUlsrarW7yhXkZkZjcrxs63_2tMFo31HYEEtSiY-L8ifJFd0TRa1jv9G5zbRd2ZvSbbLWCGmurFdWGXw9sfKNMFqyL1QcQDXr3eljM9rA1eAdxRjqG1eZODz4CZLn0JlvUKeJOPigq_FXPsLVi6eQwsGyCGSXzF1R9FSL6ntvjasbuyNOTMleAK4MyK2rAgmmUeXREMyobDHbC6T8w6I2fBYJbzHtvJoDgP9D_mIUzLaQW0y5Mc0bHAQik_pYQm7_FsUUIcD0t4orXYyoBi9bqj0tE-6_MhbLSufD4evF7pb9PdsbEL0m1RAU1tHiALI4GWvP2pyXS9hHYAJUuPavLQFXrAPdcwFb6YFCSOr5UXGdrQ7nnpTVYeSjdu3MBD5FecZ9MxGCGdzMPkez0mcvYTulZBajJHMtjKuMmKFZ9wSYAu--yp4cdvvrsHwUw4PSVTdgmF0zhk474yoKsUXeQ8enrGg2OAGVX_ouwO9KfUN37Sw68nuL1IENHDML9u-W94x2LF8d0zj0vTAq3l3n_RmGr8g1GLYWOXcUEWeBAJ-WifglApX-YR649U48b6AW0l3ik1aa-VXgUHHjxarezcUIC0lTTkJcLwEL1Kb4Uo1dtImcUFvjuVxfZBHjb0xViAhvfgOsVZuIeMFnUM7tg4VWUdTeIYODAysivSUMTUGqW1m0iY0fb8EYdAyv4zk56unrCAk2bMiQg4i8QQ26C2aH9zAUAXp8uKyQHkYdzLKW6YIXTD394i5xHwSwAuMza8y5C6kCQO6KhvBxkV098vnt67tXCMHH3sloALhnt5Fgfjc3gXNCiwdI1NYtwFFiJer3ZgA7jnN_vNa8XcQnYIR4YNUzgQUsaYcfTdQR0DZkOIEtUwF0Kk6WYg4f-Zal21z_bj6neGIk6YIBI1bx9LmQ-FZ50Q33X699qh7HLENgt2fClhi875RpjjrY9LAMekTqyyEyZVDCsykJXTMS1aH-2D7g-aKqVi6ES4sdBc_3IzJdQE0mVW0yMEJ1_H9bgg4msg-pbozGP-IjBhHp_dWzDQSVC8qHTPa3TuB1uacoDPEJE6UVGoVdvLXvQndOXWOMhGuBd5Cr8sm68XTNTjV_NBXaoIuyjVdFyFgrLuT3T7_0oaQkZSRaQVTRWf8LVJt5Ne_Us6JMZcCjLkkVrdrh-ITkTYo68ZBgyXl6xzsEk1h3PDJAoLCuVhojVAt2AMSsW6X-D_hl6tESBMHrcJDJa0ut_eDZy403BDT-xO8BXEqLbdqUld5wKu-5NDn1Jpfl9magq53K0ArakBjP_Aipnf_cR4QCnWK9dJMY0v7RLsM7wkcyFw-8lK53jj6DhVr9Whkplk42p6IbJC1kDX-XLve5U-35yZnw&cid=CAQSOwBygQiDqo4-yU8b6H7F6d_DKX04KBxXAT4w_8mOVBYVYjsBnPspyadEfWjV1KYOzrFuKkwxZcunVAfkGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=2436493295178628000&adk=388007313&idt=152&cac=0&dtd=43

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c74ba5c8dcb9bb7dfb4cfe35a44c3018e00cda26643c87364fe31ce55a2f2ff1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36517
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame C3E9 0
0 81ms
80ms Image
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C_0qp0r14ZJbsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSCAk_QkVhoMQF4FpBrIh4d_96t1lo09_NWbzPp7lG2tQI1aWW3_PxR-4R65_zMorz3LWfRQrcsCPUaIA2XX7K-G1udF6GXISECHtnW1HzPwS2P3v60f0rjsTuCL5MNBCGVDoIwH8AdY_4-d04CAkB5k6_Q_f3vLUHqmJL0Rq5dAkMg4dXI6Ij18GFU6IJCjm75kqw7xbXLWMT2m8_oZMYEAF_3aup20TBrcjEvR0_ralHmbmW96sJFKyotV20HZEGrcHgQv3Mz03HSQKCmdOGr7X_yZSNIHfh6xvZF77SZMwdINg1zg9Cgq0IoZKLAoTwaM4AgkBepwlzul0YZ15B0qTrhheAEAYAGtoyOx-LazYXwAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgECACgH6CwIIAYAMAdAVAYAXAbIXHAoaEhRwdWItNjI2NjMxMzE5MDA4NzE3Mxi18hQ&sigh=qhhbG8Luh74&uach_m=[UACH]&cid=CAQSPABygQiDlk4WgEO7gPIex1VE8Jg0cTExZaWZiHzsRtvSsYKlRYjUA91u_MkAV3z2s3q-LzX5eNUdn6MZKBgB&cbvp=2&vis=1
Requested by: Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

GET
H2 204 winResponse
prod-rtb.ad4mat.net/ Frame C3E9 0
104 B 42ms
24ms Image
image/gif 2600:1901:0:76b9::
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prod-rtb.ad4mat.net/winResponse?a=1kdsm6ngtxte3mgs5gth2p2fe8jvz8bqepkkhm7hacghfhjfv253qy4d3ryvt5g1a5kkqqwtqq5fka4ytcp7qwzyre3hf4dgf7m4z9xc087khsw8jn94qbr5bty6v311xe3v1982bzpgc0tev0an441aeg4dvbrn4tnq809zn3xzkfdtq5jvrmfhqn03j7315dd5m1ceyx23tk3zdwcpxeztpnhvfbpj5de2b4zwczbg15azyvm6e1434k2avzh73nkpmqts9cfg5fc858tbgjwwc3ghtghhxkre01a0j1p1n7f8s3161yyv0nrh1bvhdgwhknjqnqpsys3f8exgx8z4e33j7ypppdps1d35aefpw25ggdwkg6d375gxqcw9c13xs0q961g3adpw&b=ZHi90gACNhYK7cvPAAUdNgjDcYS0ItnMtaIr8Q&cbvp=2
Requested by: Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:76b9:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 01 Jun 2023 15:48:37 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type: image/gif

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 1F22 0
104 B 20ms
15ms Image
text/plain 2a02:fa8:8806:12::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEE2K0tUtwRZ6L0D1rOJ4i-I&google_cver=1&google_push=ATf1kGO7brNlwUntf_XdPcPBypOpvxjUKN9CJhptU2cSZrTaUUF3ZinimFSI0E1_6bVwWR6qahPW8xJuIDtSDaszW2tkloVCTN0
Requested by: Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1400 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2

200

google_sync_status
x.bidswitch.net/ Frame 1F22
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEO2HrlLUpnBCbfxAq95WaOE&google_cver=1&google_push=ATf1kGNZCEZ7KDCZ5IRftIJrbS4ptwnCE6gsHOlVa1NmLvXPE0l0owfvjYP1O6mS23cG89VTr1MlozjUE8NwnxkEkuAe...
https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=google&bsw_custom_parameter=553d6ab1-d407-4937-b30a-9e2b7c356d1b&gdpr=&gdpr_consent=
https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=google&bsw_custom_parameter=553d6ab1-d407-4937-b30a-9e2b7c356d1b&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=4&user_id=4fe8b3cf-2d49-4a4b-ad38-3fecfc488481&ssp=google&expires=30&user_group=5&bsw_param=553d6ab1-d407-4937-b30a-9e2b7c356d1b
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_cm=1&google_hm=VT1qsdQHSTezCp4rfDVtGw==
https://x.bidswitch.net/google_sync_status?ssp_name=google&google_gid=CAESEG8X9vplei51H_e4ptyTA0U&google_cver=1

43 B
146 B

10ms
10ms

Image
image/gif

54.93.152.195
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/google_sync_status?ssp_name=google&google_gid=CAESEG8X9vplei51H_e4ptyTA0U&google_cver=1
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp
Protocol: H2
Server: 54.93.152.195 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-93-152-195.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:38 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:38 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://x.bidswitch.net/google_sync_status?ssp_name=google&google_gid=CAESEG8X9vplei51H_e4ptyTA0U&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 316
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1F22
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEIphqP7iufWNoBZVA_x8CYo&google_cver=1&google_push=ATf1kGNanV5Ds4NPuYLO3Hd8zF_qkG9hXatOe91i8vlbf-ukjUkUcyNdrM7d8cjzmxpHiSqFeqCxmfSZ4hsxk-sX8rD78b6...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGNanV5Ds4NPuYLO3Hd8zF_qkG9hXatOe91i8vlbf-ukjUkUcyNdrM7d8cjzmxpHiSqFeqCxmfSZ4hsxk-sX8rD78b6L6w4

170 B
188 B

60ms
60ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGNanV5Ds4NPuYLO3Hd8zF_qkG9hXatOe91i8vlbf-ukjUkUcyNdrM7d8cjzmxpHiSqFeqCxmfSZ4hsxk-sX8rD78b6L6w4

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGNanV5Ds4NPuYLO3Hd8zF_qkG9hXatOe91i8vlbf-ukjUkUcyNdrM7d8cjzmxpHiSqFeqCxmfSZ4hsxk-sX8rD78b6L6w4
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1F22
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESELzphzv2f2vwGfnEn_A0FYo&google_cver=1&google_push=ATf1kGOy8IWWM8jHWVpmrLEQhDebrYTAtkITO9Z-zF_uotX4qcXZapbyYi0jNlb_YAI2cb02U45fNe-v1M_OINK...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=mzmxb3K2Wgl-40MFkIjrxLnVm5I&google_push=ATf1kGOy8IWWM8jHWVpmrLEQhDebrYTAtkITO9Z-zF_uotX4qcXZapbyYi0jNlb_YAI2cb02U45fNe-v1M_OIN...

170 B
188 B

48ms
48ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=mzmxb3K2Wgl-40MFkIjrxLnVm5I&google_push=ATf1kGOy8IWWM8jHWVpmrLEQhDebrYTAtkITO9Z-zF_uotX4qcXZapbyYi0jNlb_YAI2cb02U45fNe-v1M_OINKG-XE637MXTKE

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=mzmxb3K2Wgl-40MFkIjrxLnVm5I&google_push=ATf1kGOy8IWWM8jHWVpmrLEQhDebrYTAtkITO9Z-zF_uotX4qcXZapbyYi0jNlb_YAI2cb02U45fNe-v1M_OINKG-XE637MXTKE
Date: Thu, 01 Jun 2023 15:48:37 GMT
Connection: keep-alive
Content-Length: 241
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1F22
Redirect Chain

https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESENA9KhCHfR73DSNJs2B9H9Y&google_cver=1&google_push=ATf1kGOwVnJzUVOJG03MvoQ82wP_1I2q5lk0TRvHmSjJGwYz-f8Z-sP5qPh1Dk6WsrbZaVugOR1gmkWS854DhxCyBDlVSAd...
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=ATf1kGOwVnJzUVOJG03MvoQ82wP_1I2q5lk0TRvHmSjJGwYz-f8Z-sP5qPh1Dk6WsrbZaVugOR1gmkWS854DhxCyBDlVSAdRtrcA&google_hm=MzY2Nzc5OTY...

170 B
188 B

52ms
47ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=ATf1kGOwVnJzUVOJG03MvoQ82wP_1I2q5lk0TRvHmSjJGwYz-f8Z-sP5qPh1Dk6WsrbZaVugOR1gmkWS854DhxCyBDlVSAdRtrcA&google_hm=MzY2Nzc5OTY3NjQxNzYyMzk4MA==

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=ATf1kGOwVnJzUVOJG03MvoQ82wP_1I2q5lk0TRvHmSjJGwYz-f8Z-sP5qPh1Dk6WsrbZaVugOR1gmkWS854DhxCyBDlVSAdRtrcA&google_hm=MzY2Nzc5OTY3NjQxNzYyMzk4MA==
Date: Thu, 01 Jun 2023 15:48:37 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 1F22 0
12 B 53ms
50ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13L_ILn_qFrr-Hsy1_9hdwqO2bFSbuZ2Rm6CFxoPZTodKWDpbOhzaW-Oacnm

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:37 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E483
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEND8eNVe3QWaOGLgV5Y381I&google_cver=1&google_push=ATf1kGPWk8ZYDOlfmmzmoLd--h1JxZQ3zkpsGdwnQWvrp4DwQPmoO3fCwZ...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ATf1kGPWk8ZYDOlfmmzmoLd--h1JxZQ3zkpsGdwnQWvrp4DwQPmoO3fCwZcA7nr1lBMB6pnQmJDqzoutfemML2VJ7eiyYghsNzOWtg&google_hm=jngQr49iRC...

170 B
188 B

67ms
66ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ATf1kGPWk8ZYDOlfmmzmoLd--h1JxZQ3zkpsGdwnQWvrp4DwQPmoO3fCwZcA7nr1lBMB6pnQmJDqzoutfemML2VJ7eiyYghsNzOWtg&google_hm=jngQr49iRC0qFqwjkR-k8w

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ATf1kGPWk8ZYDOlfmmzmoLd--h1JxZQ3zkpsGdwnQWvrp4DwQPmoO3fCwZcA7nr1lBMB6pnQmJDqzoutfemML2VJ7eiyYghsNzOWtg&google_hm=jngQr49iRC0qFqwjkR-k8w
pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame E483 0
104 B 28ms
21ms Image
text/plain 2a02:fa8:8806:12::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEIzWzNQVsj4R-0jhdVtNxeA&google_cver=1&google_push=ATf1kGORHpwv0T_paNnjRy2a3xIecZFTdAgeDbtZ0seaxlKkR2-2bL7D8evZc4UrZqw2t2SR7zysaKQ51Dl0m5Ov7_HA1qrXSGcC
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1231661633440980&output=html&h=280&slotname=9134183485&adk=3378407940&adf=2021203405&pi=t.ma~as.9134183485&w=336&lmt=1685634514&format=336x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634514084&bpp=5&bdt=1647&idt=5&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=551&ady=3160&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=48&uci=a!1c&btvi=3&fsb=1&xpc=ih4ds9qhg1&p=https%3A//www.farfeshplus.online&dtd=9
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1400 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E483
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEMCLCip_jv0V9NrygfJDDYU&google_cve...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=SnBkZXZFTHExUTRLeHU1&google_gid=CAESEMCLCip_jv0V9NrygfJDDYU&google_cver=1&google_push=ATf1kGM_gQaGJVechQFh679LyHjpA59YvPrKV_H9K0Nh3tt...

170 B
188 B

68ms
67ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=SnBkZXZFTHExUTRLeHU1&google_gid=CAESEMCLCip_jv0V9NrygfJDDYU&google_cver=1&google_push=ATf1kGM_gQaGJVechQFh679LyHjpA59YvPrKV_H9K0Nh3tt-GLiqpOdZ5kAHOIkb08WMltWFbQv59uxY8Q9O6X2dspzLFOswT6G5fQ

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 01 Jun 2023 15:48:36 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-777-g304ac51#rel-ec2-master i-0a1a90ed6ac66fe36@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=SnBkZXZFTHExUTRLeHU1&google_gid=CAESEMCLCip_jv0V9NrygfJDDYU&google_cver=1&google_push=ATf1kGM_gQaGJVechQFh679LyHjpA59YvPrKV_H9K0Nh3tt-GLiqpOdZ5kAHOIkb08WMltWFbQv59uxY8Q9O6X2dspzLFOswT6G5fQ
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 i.match
a.tribalfusion.com/ Frame E483 43 B
461 B 188ms
182ms Image
image/gif 2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.tribalfusion.com/i.match?p=b6&u=CAESEEkFXPyB1Sa6N1q2P_J74yE&google_cver=1&google_push=ATf1kGPVuz9ofk16BbtaWZNI2ozI3GwmG7eRkWaUsupH_vjCVVV4B9YjYHZdTDo2o1ySz_kYowQ0nsLFjTcDMCH1Eui_m_oc1zUQqw&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DATf1kGPVuz9ofk16BbtaWZNI2ozI3GwmG7eRkWaUsupH_vjCVVV4B9YjYHZdTDo2o1ySz_kYowQ0nsLFjTcDMCH1Eui_m_oc1zUQqw%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1231661633440980&output=html&h=280&slotname=9134183485&adk=3378407940&adf=2021203405&pi=t.ma~as.9134183485&w=336&lmt=1685634514&format=336x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634514084&bpp=5&bdt=1647&idt=5&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=551&ady=3160&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=48&uci=a!1c&btvi=3&fsb=1&xpc=ih4ds9qhg1&p=https%3A//www.farfeshplus.online&dtd=9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7d089a141a70bbf1-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E483
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WkhpOTB3QUJVSWY5RXdCUg==&google_gid=CAESEC5rIqzV46F02U_pli0V9MI&google_cver=1&google_push=ATf1kGNXdEqMm-eYZes-vJR4ZgVTx20N6z...

170 B
188 B

67ms
66ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WkhpOTB3QUJVSWY5RXdCUg==&google_gid=CAESEC5rIqzV46F02U_pli0V9MI&google_cver=1&google_push=ATf1kGNXdEqMm-eYZes-vJR4ZgVTx20N6zfg-J0NjPMlGKnoP5wKYndveMaFFNqSLFRJKui58mbP9rIYSVgoJ6GMwYj6vEFJWPZq

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-fra-eddf8230027-FRA
pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1685634517.138803,VS0,VE0
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WkhpOTB3QUJVSWY5RXdCUg==&google_gid=CAESEC5rIqzV46F02U_pli0V9MI&google_cver=1&google_push=ATf1kGNXdEqMm-eYZes-vJR4ZgVTx20N6zfg-J0NjPMlGKnoP5wKYndveMaFFNqSLFRJKui58mbP9rIYSVgoJ6GMwYj6vEFJWPZq
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E483
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEIQSwQ-D9JM1FF_YRWpn8sQ&google_cver=1&google_push=ATf1kGMXeGcR_TGW62YN1ajiHzjUTvVYF9YAZ-4L2LevNVUTXDJrMSk89XUKSOlTR5NuPWgqP81dQsFfg3SF8FwXXwrzKk1...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGMXeGcR_TGW62YN1ajiHzjUTvVYF9YAZ-4L2LevNVUTXDJrMSk89XUKSOlTR5NuPWgqP81dQsFfg3SF8FwXXwrzKk1DVxPLWQ&google_hm=eS1Gc1YzSmdoRTJwSC5p...

170 B
188 B

58ms
58ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGMXeGcR_TGW62YN1ajiHzjUTvVYF9YAZ-4L2LevNVUTXDJrMSk89XUKSOlTR5NuPWgqP81dQsFfg3SF8FwXXwrzKk1DVxPLWQ&google_hm=eS1Gc1YzSmdoRTJwSC5pOTF1X1VwOUNwejBDdXJzY1ZTcH5B

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 01 Jun 2023 15:48:37 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGMXeGcR_TGW62YN1ajiHzjUTvVYF9YAZ-4L2LevNVUTXDJrMSk89XUKSOlTR5NuPWgqP81dQsFfg3SF8FwXXwrzKk1DVxPLWQ&google_hm=eS1Gc1YzSmdoRTJwSC5pOTF1X1VwOUNwejBDdXJzY1ZTcH5B
content-length: 0

GET
H2

200

cookiematch.aspx
dis.criteo.com/dis/rtb/google/ Frame E483
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DPUSH_DATA&...
https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=k-LXQVCGJ2-AbpzohmaDk7ORgd00gyRSU3Pfvw4g&google_push=PUSH_DATA
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_error=5

43 B
369 B

17ms
15ms

Image
image/gif

178.250.7.11
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_error=5

Requested by

Protocol

Server

178.250.7.11 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 140579
timing-allow-origin: *
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 274
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame E483 0
12 B 50ms
47ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KXQKDBwLx56pIIDfVfHYR2E-8b13nY5AhJr-wDK8yi2bu8qtudAFjSXix80rBaorWd6lXo

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:37 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2

200

4a.js Show response
static.adsafeprotected.com/ Frame D56B
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/990511/61634100/4.js?ias_dspID=3&ias_campId=1010147412&ias_pubId=pub-6266313190087173&ias_chanId=1&ias_placementId=19422215943&bidurl=https://www.farfeshplus.o...
https://static.adsafeprotected.com/4a.js

2 KB
2 KB

12ms
8ms

Script
application/javascript

2600:9000:223f:2a00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4a.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=250&slotname=2097210043&adk=239546933&adf=744370384&pi=t.ma~as.2097210043&w=300&lmt=1685634514&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634514177&bpp=3&bdt=1740&idt=3&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D76ab65cad0aa0eff%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_Ma0_IwpMBOi7nj9-q6otQoNKDc7Aw&gpic=UID%3D00000c3a8e3515fd%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_MZpfKIRVVeVVB8cjAISCX5v7pmlrA&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=569&ady=3955&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=50&uci=a!1e&btvi=4&fsb=1&xpc=PCTYuyO1NN&p=https%3A//www.farfeshplus.online&dtd=7
Protocol: H2
Server: 2600:9000:223f:2a00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bbead98319b2bee5757af35b4eacf615df3e45da2f69cb999cd4694a26bfb90f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:26:31 GMT
x-amz-version-id: 892LuepCTb5ZAkY_HA0pWp5SNmGK56Bu
content-encoding: gzip
via: 1.1 02d68f3a4f2a3f8967c5e021dcd7f96a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 1327
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Thu, 01 Jun 2023 15:26:28 GMT
server: AmazonS3
etag: W/"589d8955c4906ab1b8e63a2f92d932d3"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: XqXC9t_-nbWZzg-4V0kewmhkMEL9s-PE1tDU5OxSF3GsikNPWOQWJw==

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
server: nginx
x-server-name: app02.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4a.js
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 65B0 91 KB
23 KB 45ms
7ms Script
application/javascript 2600:9000:223f:2a00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=250&slotname=2097210043&adk=239546933&adf=744370384&pi=t.ma~as.2097210043&w=300&lmt=1685634514&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634514177&bpp=3&bdt=1740&idt=3&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D76ab65cad0aa0eff%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_Ma0_IwpMBOi7nj9-q6otQoNKDc7Aw&gpic=UID%3D00000c3a8e3515fd%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_MZpfKIRVVeVVB8cjAISCX5v7pmlrA&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=569&ady=3955&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=50&uci=a!1e&btvi=4&fsb=1&xpc=PCTYuyO1NN&p=https%3A//www.farfeshplus.online&dtd=7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:2a00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 15:36:17 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 02d68f3a4f2a3f8967c5e021dcd7f96a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 21859941
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: HK3bwypqgdBPOR2EhZovMWP4mcsrhmqdIECMcmEOvcrz7rQ4Mx7b-w==

GET
H3 200 WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js Show response
pagead2.googlesyndication.com/bg/ Frame A266 37 KB
14 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=1738279810&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1685634513&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634513553&bpp=15&bdt=1116&idt=15&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600&nras=1&correlator=7472659638016&frm=20&pv=2&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=121&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=h6AcjFpLLX&p=https%3A//www.farfeshplus.online&dtd=26

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ae70268abe00d0f5f9a58ce23f5af80fd5f8d9e8b5a647855901f5321cbd23a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:09:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5938
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 31 May 2024 14:09:39 GMT

GET
H2

200

4a.js Show response
static.adsafeprotected.com/ Frame 9E03
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/990511/61634100/4.js?ias_dspID=3&ias_campId=1010147412&ias_pubId=pub-8367749956917006&ias_chanId=1&ias_placementId=19422215943&bidurl=https://www.farfeshplus.o...
https://static.adsafeprotected.com/4a.js

2 KB
2 KB

9ms
8ms

Script
application/javascript

2600:9000:223f:2a00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4a.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=250&slotname=6076681977&adk=2278793534&adf=954853469&pi=t.ma~as.6076681977&w=300&lmt=1685634514&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634514187&bpp=2&bdt=1749&idt=2&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D76ab65cad0aa0eff%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_Ma0_IwpMBOi7nj9-q6otQoNKDc7Aw&gpic=UID%3D00000c3a8e3515fd%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_MZpfKIRVVeVVB8cjAISCX5v7pmlrA&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280%2C300x250&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=569&ady=4690&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=51&uci=a!1f&btvi=5&fsb=1&xpc=iUalWkZx01&p=https%3A//www.farfeshplus.online&dtd=5
Protocol: H2
Server: 2600:9000:223f:2a00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bbead98319b2bee5757af35b4eacf615df3e45da2f69cb999cd4694a26bfb90f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:26:31 GMT
x-amz-version-id: 892LuepCTb5ZAkY_HA0pWp5SNmGK56Bu
content-encoding: gzip
via: 1.1 02d68f3a4f2a3f8967c5e021dcd7f96a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 1327
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Thu, 01 Jun 2023 15:26:28 GMT
server: AmazonS3
etag: W/"589d8955c4906ab1b8e63a2f92d932d3"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: aw-MwJvTeNL7bJa-ylADsXHMJHTOmC6HkM1mShBKS6Jzd5ZJxVXbPA==

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
server: nginx
x-server-name: app01.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4a.js
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 7CFB 91 KB
23 KB 7ms
7ms Script
application/javascript 2600:9000:223f:2a00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=250&slotname=6076681977&adk=2278793534&adf=954853469&pi=t.ma~as.6076681977&w=300&lmt=1685634514&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634514187&bpp=2&bdt=1749&idt=2&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D76ab65cad0aa0eff%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_Ma0_IwpMBOi7nj9-q6otQoNKDc7Aw&gpic=UID%3D00000c3a8e3515fd%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_MZpfKIRVVeVVB8cjAISCX5v7pmlrA&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280%2C300x250&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=569&ady=4690&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=51&uci=a!1f&btvi=5&fsb=1&xpc=iUalWkZx01&p=https%3A//www.farfeshplus.online&dtd=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:2a00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 15:36:17 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 02d68f3a4f2a3f8967c5e021dcd7f96a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 21859941
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: 2K-kEPnG5rr4To4QuTZfIdI-xUKGNouVXqRxYCy6xgugubpZgatR4A==

GET
H3 200 WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js Show response
pagead2.googlesyndication.com/bg/ Frame 9DEA 37 KB
14 KB 36ms
35ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ae70268abe00d0f5f9a58ce23f5af80fd5f8d9e8b5a647855901f5321cbd23a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:09:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5938
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 31 May 2024 14:09:39 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3691
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEGaWMdwIbq0BWXBBM4TzZJU&google_cver=1&google_push=ATf1kGNpIbnIOFnqVr9DO8ZE_LhPh8o2wGEjNjbEkgYuMU5xQJk5tKCH8R...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ATf1kGNpIbnIOFnqVr9DO8ZE_LhPh8o2wGEjNjbEkgYuMU5xQJk5tKCH8R79cVP1zh8Xg3fay8cCM6letD58IVQHwpvYR4xs1WfV_DeUYl4Z7imCjaNmC2Do2J9...

170 B
188 B

51ms
51ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ATf1kGNpIbnIOFnqVr9DO8ZE_LhPh8o2wGEjNjbEkgYuMU5xQJk5tKCH8R79cVP1zh8Xg3fay8cCM6letD58IVQHwpvYR4xs1WfV_DeUYl4Z7imCjaNmC2Do2J9Ke8OO9L8XG4vXcWzO13tr0J3zZS1P_zrtMQI&google_hm=jngQr49iRC0qFqwjkR-k8w

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ATf1kGNpIbnIOFnqVr9DO8ZE_LhPh8o2wGEjNjbEkgYuMU5xQJk5tKCH8R79cVP1zh8Xg3fay8cCM6letD58IVQHwpvYR4xs1WfV_DeUYl4Z7imCjaNmC2Do2J9Ke8OO9L8XG4vXcWzO13tr0J3zZS1P_zrtMQI&google_hm=jngQr49iRC0qFqwjkR-k8w
pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 3691 0
104 B 16ms
14ms Image
text/plain 2a02:fa8:8806:12::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEFpOGLh-zGZwCsZy72esQ2s&google_cver=1&google_push=ATf1kGP7Zpo-LTvWALvmJLnf6TBWkCautbZN1mfqiFvqYE2w38n4P_Bi4_cHLeUXugKUwfB1_F9AFmYDfSRF7lMF7q0AaG5RwAAIKmGUQmB_SvnxBC4eTkOU5JkUcslnf03BBVEwr8XFis6_hDRV6Fyuq68-UYc
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=250&slotname=2097210043&adk=239546933&adf=744370384&pi=t.ma~as.2097210043&w=300&lmt=1685634514&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634514177&bpp=3&bdt=1740&idt=3&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D76ab65cad0aa0eff%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_Ma0_IwpMBOi7nj9-q6otQoNKDc7Aw&gpic=UID%3D00000c3a8e3515fd%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_MZpfKIRVVeVVB8cjAISCX5v7pmlrA&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=569&ady=3955&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=50&uci=a!1e&btvi=4&fsb=1&xpc=PCTYuyO1NN&p=https%3A//www.farfeshplus.online&dtd=7
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1400 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3691
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEEE0SOtS7WQaV14B6W7zwRY&google_cver=1&google_push=ATf1kGOgRToXhAULf3jWVDBMaNISqxNzqUqX44pvXtEiHpwxQoueQpnZDUkotlRGPQ3og0aDvIKLn_FhB6WRGglLB_ZkCurJe8zFWJ...
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=B271353183294576B2158BA1778B6CA1&google_push=ATf1kGOgRToXhAULf3jWVDBMaNISqxNzqUqX44pvXtEiHpwxQoueQpnZDUkotlRGPQ3og0aDvIKLn_FhB6WRGgl...

170 B
188 B

52ms
52ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=B271353183294576B2158BA1778B6CA1&google_push=ATf1kGOgRToXhAULf3jWVDBMaNISqxNzqUqX44pvXtEiHpwxQoueQpnZDUkotlRGPQ3og0aDvIKLn_FhB6WRGglLB_ZkCurJe8zFWJDIL6btT7sadns_AoPw2-WDyzWPu2Ozt4tDuZBkeo2_K29uQU1cJ00joZs

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 01 Jun 2023 15:48:37 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=B271353183294576B2158BA1778B6CA1&google_push=ATf1kGOgRToXhAULf3jWVDBMaNISqxNzqUqX44pvXtEiHpwxQoueQpnZDUkotlRGPQ3og0aDvIKLn_FhB6WRGglLB_ZkCurJe8zFWJDIL6btT7sadns_AoPw2-WDyzWPu2Ozt4tDuZBkeo2_K29uQU1cJ00joZs
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 31 May 2023 15:48:37 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 3691 70 B
265 B 33ms
31ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEEfukTiLHJi9_vK2zZEbZOc&google_cver=1&google_push=ATf1kGOs4B-1iKwd2CNuPIEWpMV9JFwg8JP1Mc0bIA9hikK75pcVuWLVHW2nN-M0UJOj35WK4XQxwU1dDaVeZ1oi28maq1eFVgPpXR6g9Ynoqvq1HK4RiVaDIPyW8uqT7IhVr1_Ai_Njw3osfq5haogkV_eFig
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=250&slotname=2097210043&adk=239546933&adf=744370384&pi=t.ma~as.2097210043&w=300&lmt=1685634514&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634514177&bpp=3&bdt=1740&idt=3&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D76ab65cad0aa0eff%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_Ma0_IwpMBOi7nj9-q6otQoNKDc7Aw&gpic=UID%3D00000c3a8e3515fd%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_MZpfKIRVVeVVB8cjAISCX5v7pmlrA&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=569&ady=3955&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=50&uci=a!1e&btvi=4&fsb=1&xpc=PCTYuyO1NN&p=https%3A//www.farfeshplus.online&dtd=7
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3691
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEK6uP-54rv0N3J73AU9bLZs&google_cver=1&google_push=ATf1kGMM3kXW7y3PT3PADDS3dNI-mTG2b4bkSbDv1xvQwhJXqqGc2oMjjGAhBgToV75sapAd5aaUSmzE...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDkxNTYyMTg2MzY0NTQ5NzQ3Ng&google_push=ATf1kGMM3kXW7y3PT3PADDS3dNI-mTG2b4bkSbDv1xvQwhJXqqGc2oMjjGAhBgToV75sapAd5aaUSm...

170 B
188 B

51ms
51ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDkxNTYyMTg2MzY0NTQ5NzQ3Ng&google_push=ATf1kGMM3kXW7y3PT3PADDS3dNI-mTG2b4bkSbDv1xvQwhJXqqGc2oMjjGAhBgToV75sapAd5aaUSmzEOBTsitZSY9xJ4z0IKwx7gF_HFyHV1czH7xJnRfo6AwFRI0aKRF075jTnMkd0IvsBDGolPjEIqSyGYB0

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDkxNTYyMTg2MzY0NTQ5NzQ3Ng&google_push=ATf1kGMM3kXW7y3PT3PADDS3dNI-mTG2b4bkSbDv1xvQwhJXqqGc2oMjjGAhBgToV75sapAd5aaUSmzEOBTsitZSY9xJ4z0IKwx7gF_HFyHV1czH7xJnRfo6AwFRI0aKRF075jTnMkd0IvsBDGolPjEIqSyGYB0
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3691
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEKsdJCVaebqDY4nQYOG2Spg&google_cver=1&google_push=ATf1kGM7bdvexn0glpn9CgW_eFmVGrALDQnKAEQt_D0hvPhua5-GIzhoBaOQHH53Ah1K3ym09LIN8JYJP_Ce...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGM7bdvexn0glpn9CgW_eFmVGrALDQnKAEQt_D0hvPhua5-GIzhoBaOQHH53Ah1K3ym09LIN8JYJP_CeqekDlM5UknhCi6fEKWzZjk63SUL8t56qBIl1...

170 B
188 B

48ms
48ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGM7bdvexn0glpn9CgW_eFmVGrALDQnKAEQt_D0hvPhua5-GIzhoBaOQHH53Ah1K3ym09LIN8JYJP_CeqekDlM5UknhCi6fEKWzZjk63SUL8t56qBIl1NTxSqCTVmvPy5-SljkUWHSA6_bP8panleyAjFb0

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGM7bdvexn0glpn9CgW_eFmVGrALDQnKAEQt_D0hvPhua5-GIzhoBaOQHH53Ah1K3ym09LIN8JYJP_CeqekDlM5UknhCi6fEKWzZjk63SUL8t56qBIl1NTxSqCTVmvPy5-SljkUWHSA6_bP8panleyAjFb0
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3691
Redirect Chain

https://ius.ctnsnet.com/int/cm?exc=1&acc=crimtan_holdings_limited&google_gid=CAESEGCH6iKiG3fXEZ8JDv8FiAU&google_cver=1&google_push=ATf1kGPk-jrToJiXo_sfSahi2_gWJLS3KrvWQag5i2kc6ue0fsVqUoSMWnKwZLQIQd...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=ATf1kGPk-jrToJiXo_sfSahi2_gWJLS3KrvWQag5i2kc6ue0fsVqUoSMWnKwZLQIQdxxLjp3doKdhfgC3s1iDuG2HA2PHTvwHqsLn9U3Nb94VXSe0q...

170 B
188 B

48ms
47ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=ATf1kGPk-jrToJiXo_sfSahi2_gWJLS3KrvWQag5i2kc6ue0fsVqUoSMWnKwZLQIQdxxLjp3doKdhfgC3s1iDuG2HA2PHTvwHqsLn9U3Nb94VXSe0qlekeZVThLeRT0BEcSsk0srG78A25_kw75T7lIwWS10hFU&google_hm=-gMPAjn_SbKFCaqOwJxePpI

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:36 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=ATf1kGPk-jrToJiXo_sfSahi2_gWJLS3KrvWQag5i2kc6ue0fsVqUoSMWnKwZLQIQdxxLjp3doKdhfgC3s1iDuG2HA2PHTvwHqsLn9U3Nb94VXSe0qlekeZVThLeRT0BEcSsk0srG78A25_kw75T7lIwWS10hFU&google_hm=-gMPAjn_SbKFCaqOwJxePpI
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 3691 0
12 B 47ms
46ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LFVGYS82tj6KV5uiQSLf4s5Ro0yJZwK09o66ua2bcf9QSfD_aKb_nPr-ZCVsNEgmxhpZQe5Q

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:37 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 dt
dt.adsafeprotected.com/ Frame D56B 43 B
217 B 332ms
106ms Image
image/gif 2600:1f18:1aca:4282:9f3c:fb6f:594b:b7a8
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=990511&asId=542a5b0c-463f-8735-94fc-54bfb4d3dc77&tv=%7Bc:eiMbrn,pingTime:-3,time:284,type:v,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:44%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:284,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:44,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B274~0%5D,as:%5B274~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tFWCEmd+11%7C12%7C13%7C14%7C15%7C161%7C162%7C171%7C18%7C191%7C192%7C193%7C194%7C1a1%7C1a2%7C1a3%7C1a4%7C1b1%7C1b2%7C1c11%7C1c12%7C1c13%7C1d*.990511-61634100%7C1d1%7C1d2%7C1e1%7C1e2%7C1e3%7C1e4%7C1f1%7C1g%7C1h111%7C1h12%7C1i111%7C1i12%7C1j1%7C1j2%7C1j3%7C1k11%7C1l11,idMap:1d*,rmeas:1,rend:0,renddet:svg.us,siq:46%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=250&slotname=2097210043&adk=239546933&adf=744370384&pi=t.ma~as.2097210043&w=300&lmt=1685634514&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634514177&bpp=3&bdt=1740&idt=3&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D76ab65cad0aa0eff%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_Ma0_IwpMBOi7nj9-q6otQoNKDc7Aw&gpic=UID%3D00000c3a8e3515fd%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_MZpfKIRVVeVVB8cjAISCX5v7pmlrA&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=569&ady=3955&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=50&uci=a!1e&btvi=4&fsb=1&xpc=PCTYuyO1NN&p=https%3A//www.farfeshplus.online&dtd=7
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:9f3c:fb6f:594b:b7a8 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
server: nginx
x-server-name: dt09.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 styles.css
s0.2mdn.net/sadbundle/11934569601524222564/css/ Frame 2F82 5 KB
1 KB 45ms
44ms Stylesheet
text/css 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11934569601524222564/css/styles.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11934569601524222564/index.html?e=69&leftOffset=0&topOffset=0&c=b4mNOqcYSi&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

889f2bab730d916ae6b55451a2f2fcdb173b310e29306103ece5b4c545a38156

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11934569601524222564/index.html?e=69&leftOffset=0&topOffset=0&c=b4mNOqcYSi&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Fri, 26 May 2023 23:03:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 492308
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1412
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 10:59:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 25 May 2024 23:03:29 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 2F82 118 KB
40 KB 43ms
43ms Script
text/javascript 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11934569601524222564/index.html?e=69&leftOffset=0&topOffset=0&c=b4mNOqcYSi&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11934569601524222564/index.html?e=69&leftOffset=0&topOffset=0&c=b4mNOqcYSi&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 07:18:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30591
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 02 Jun 2023 07:18:46 GMT

GET
H3 200 logo.svg
s0.2mdn.net/sadbundle/11934569601524222564/img/ Frame 2F82 6 KB
3 KB 39ms
38ms Image
image/svg+xml 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11934569601524222564/img/logo.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11934569601524222564/index.html?e=69&leftOffset=0&topOffset=0&c=b4mNOqcYSi&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b1bfbac0178604f4dce665117d962743d2916a2a37968438f3d49d7e9c04445

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11934569601524222564/index.html?e=69&leftOffset=0&topOffset=0&c=b4mNOqcYSi&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 06:06:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 207731
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2563
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 10:59:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 May 2024 06:06:26 GMT

GET
H3 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 2F82 60 KB
24 KB 47ms
46ms Script
text/javascript 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11934569601524222564/index.html?e=69&leftOffset=0&topOffset=0&c=b4mNOqcYSi&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11934569601524222564/index.html?e=69&leftOffset=0&topOffset=0&c=b4mNOqcYSi&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 01 Jun 2023 15:48:37 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame D56B 43 B
216 B 287ms
112ms Image
image/gif 2600:1f18:1aca:4282:9f3c:fb6f:594b:b7a8
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=990511&asId=542a5b0c-463f-8735-94fc-54bfb4d3dc77&tv=%7Bc:eiMbrD,pingTime:-6,time:300,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:300,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:44,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B290~0%5D,as:%5B290~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tFWCEmd+11%7C12%7C13%7C14%7C15%7C161%7C162%7C171%7C18%7C191%7C192%7C193%7C194%7C1a1%7C1a2%7C1a3%7C1a4%7C1b1%7C1b2%7C1c11%7C1c12%7C1c13%7C1d*.990511-61634100%7C1d1%7C1d2%7C1e1%7C1e2%7C1e3%7C1e4%7C1f1%7C1g%7C1h111%7C1h12%7C1i111%7C1i12%7C1j1%7C1j2%7C1j3%7C1k11%7C1l11,idMap:1d*,rmeas:1,rend:0,renddet:svg.us,siq:46%7D&tpiLookup=ao:www.farfeshplus.online*&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=250&slotname=2097210043&adk=239546933&adf=744370384&pi=t.ma~as.2097210043&w=300&lmt=1685634514&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634514177&bpp=3&bdt=1740&idt=3&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D76ab65cad0aa0eff%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_Ma0_IwpMBOi7nj9-q6otQoNKDc7Aw&gpic=UID%3D00000c3a8e3515fd%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_MZpfKIRVVeVVB8cjAISCX5v7pmlrA&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=569&ady=3955&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=50&uci=a!1e&btvi=4&fsb=1&xpc=PCTYuyO1NN&p=https%3A//www.farfeshplus.online&dtd=7
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:9f3c:fb6f:594b:b7a8 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
server: nginx
x-server-name: dt14.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 9E03 43 B
216 B 282ms
108ms Image
image/gif 2600:1f18:1aca:4282:9f3c:fb6f:594b:b7a8
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=990511&asId=ab6dbb93-ecd5-ad61-1a5c-de594726c212&tv=%7Bc:eiMbsa,pingTime:-3,time:223,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:300,h:250,t:43%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:223,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:43,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B212~0%5D,as:%5B212~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tFWCEmd+11%7C12%7C13%7C14%7C15%7C161%7C162%7C171%7C18%7C191%7C192%7C193%7C194%7C1a1%7C1a2%7C1a3%7C1a4%7C1b1%7C1b2%7C1c11%7C1c12%7C1c13%7C1d.990511-61634100%7C1d1%7C1d2%7C1d3%7C1e*.990511-61634100%7C1e1%7C1e2%7C1e3%7C1e4%7C1f1%7C1g%7C1h111%7C1h12%7C1i111%7C1i12%7C1j1%7C1j2%7C1j3%7C1k11%7C1l11,idMap:1e*,rmeas:1,rend:0,renddet:na,siq:45%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=250&slotname=6076681977&adk=2278793534&adf=954853469&pi=t.ma~as.6076681977&w=300&lmt=1685634514&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634514187&bpp=2&bdt=1749&idt=2&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D76ab65cad0aa0eff%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_Ma0_IwpMBOi7nj9-q6otQoNKDc7Aw&gpic=UID%3D00000c3a8e3515fd%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_MZpfKIRVVeVVB8cjAISCX5v7pmlrA&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280%2C300x250&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=569&ady=4690&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=51&uci=a!1f&btvi=5&fsb=1&xpc=iUalWkZx01&p=https%3A//www.farfeshplus.online&dtd=5
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:9f3c:fb6f:594b:b7a8 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
server: nginx
x-server-name: dt11.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 9E03 43 B
216 B 282ms
109ms Image
image/gif 2600:1f18:1aca:4282:9f3c:fb6f:594b:b7a8
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=990511&asId=ab6dbb93-ecd5-ad61-1a5c-de594726c212&tv=%7Bc:eiMbsc,pingTime:-6,time:225,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:225,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:43,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B214~0%5D,as:%5B214~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tFWCEmd+11%7C12%7C13%7C14%7C15%7C161%7C162%7C171%7C18%7C191%7C192%7C193%7C194%7C1a1%7C1a2%7C1a3%7C1a4%7C1b1%7C1b2%7C1c11%7C1c12%7C1c13%7C1d.990511-61634100%7C1d1%7C1d2%7C1d3%7C1e*.990511-61634100%7C1e1%7C1e2%7C1e3%7C1e4%7C1f1%7C1g%7C1h111%7C1h12%7C1i111%7C1i12%7C1j1%7C1j2%7C1j3%7C1k11%7C1l11,idMap:1e*,rmeas:1,rend:0,renddet:na,siq:45%7D&tpiLookup=ao:www.farfeshplus.online*&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=250&slotname=6076681977&adk=2278793534&adf=954853469&pi=t.ma~as.6076681977&w=300&lmt=1685634514&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634514187&bpp=2&bdt=1749&idt=2&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D76ab65cad0aa0eff%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_Ma0_IwpMBOi7nj9-q6otQoNKDc7Aw&gpic=UID%3D00000c3a8e3515fd%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_MZpfKIRVVeVVB8cjAISCX5v7pmlrA&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280%2C300x250&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=569&ady=4690&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=51&uci=a!1f&btvi=5&fsb=1&xpc=iUalWkZx01&p=https%3A//www.farfeshplus.online&dtd=5
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:9f3c:fb6f:594b:b7a8 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
server: nginx
x-server-name: dt12.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js Show response
pagead2.googlesyndication.com/bg/ Frame 441F 37 KB
14 KB 35ms
35ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ae70268abe00d0f5f9a58ce23f5af80fd5f8d9e8b5a647855901f5321cbd23a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:09:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5938
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 31 May 2024 14:09:39 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 2BA3 22 KB
8 KB 38ms
38ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 151885
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 30 May 2023 21:37:12 GMT
expires: Wed, 29 May 2024 21:37:12 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html
s0.2mdn.net/sadbundle/8545329873006492075/ Frame 3692 142 KB
0 39ms
38ms Document
text/html 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/8545329873006492075/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 537436
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 22810
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 26 May 2023 10:31:21 GMT
expires: Sat, 25 May 2024 10:31:21 GMT
last-modified: Wed, 09 Feb 2022 10:36:00 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame D56B 0
0 91ms
90ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsucsMUWRx28Fv_RdCichOYXEM8dCDheOTlKjBmQuMcwKMwjUhYGgaLqgShLbS1BASllJGqighDvnZVZKa__zIWWZT7WgCOr9yF8M8yuvK7goZ79TLm_U77wre1oLw6oOheSrziNsSnDx5iS3Eg8sPMvUvCo9pi96aRLUOh0tkKCDaCRN0I1x-rPzJCAGxpeCOhgd75TLgt3yUfLROmDdMjupTaAk5FK16WAllDKi-FkjJBwQHZJrmjSF13U2L31-AFdU9FxDzCM_BiFAjBzFOq3uqRxyVlDRWPp1RjYYK7C91To0NPgdaRYcXkq89DAlNGlwauX4GwFOAhxA5fYHg8yAT8JtRbZWZcsGSljZ8h0NEj7TjP8AAS3Y-qUWOHfUKb4C-ESXxrrMZLScW9nWPtzOXLd7EU1-2U0uX9btixl1jg__7Xmw-N0hvEOeLgnJaVf3yHO_XXOCMdQTE-Dkz0X5OLVVMu8rK-WwMWC007lNHmeYElQCMSx8CAWCUEk9NZwIOp3X8n8I9ChaQoZWTTsnYF0GM_DUlDymFN569UFKLy4jQIHNOXfSEGFFav5nhqEhsrMFStHGzeOHtSgc73pBoHZ17xbzpntol0SJeJB3DJrj6kpivxK_gxWZpV88zo4jqoHpUNU0rWV4utAvV4Lzme88p9Gi7VvjI2sN9Yfx06mXXCo0JwRJydp2HAcv0PeUpiVGxANQFkO2-4-AS4lsG8rWwuidVUDoma5CwE7YhG1ToOKhLzKxgiR0jN9k_DIcOvYE-jGpS2Fi0jyhAfJkEPMQ2BzfYeM27hLYX2Rm7ooPro-EkEmdhBpC0LP0UlZjoD9598oX5oThVv80dJ1YSvF_bAYrNWIU3w7QLgx4MUAxks4J2ZetaE3Ixbjtfv6wngQ_k5KtdzqL7TknQ4KyrQSnl1MQDg8_U6BcPNFRuk14UTczNetGyCXekPt5rFDRCs6GMHZDbTNN_03yxRzpMeb5o4zegwksGroIqXayxB6kjMWGFPjlN76vJ17g6LkecNwic70ow4o-Bg5hy-aPkfAqVDLXwYmSB4vi0kad1nI9giGVG53Ky21dajHO_uk3XMh3cv3NU4K2Zw990rWL_pmyn1IgbvDajh-OOygIN-zUQ3kiTC6RlQK35emLqBUzTvEJOR5TCJlhILgUB0uAhZYWcEsdkK1UGxPRB12MwfCoaMFk6IgrpjcYPtqhQj0YXLd5y9VBsb9HawfGYajynelpXeBSW7YVGgAX1UOvQ-v1O1GGnWFWAejo3SrOr5s44e-Yk3jIVAp4zPKxJoMTkvRiJz6tp6PyOHGd0jg0h-9V_DWJ0-sHU_AfXwwjM0yv4ymISAmJa2G&sai=AMfl-YQ3tjmSaqLL4E686nJB2yIYQfTUut4NSCvn91inUz-kiDb2qadrnVO3VKaZWHTwLwl1KNYr2WW-6OrNxhdX0702oP_zkuLnf1re2a7587hyYTbcDmA3gEtFLi6F0uYWGqotg6ReyMSFRkaQOF5DutC1xEcGeSpm7DNy8R20CsneK91DaIc45Cl1CyUvwkCnvRyYUkGn5QObDFLnuOi07RTvdhjU8faycgZhKBP99F02lE5AYhJrO0F_eiP7VQpreA3k&sig=Cg0ArKJSzBIsDsC3JNPuEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1426&cbvp=1&cstd=1424&cisv=r20230530.43834&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 01 Jun 2023 15:48:37 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Thu, 01 Jun 2023 15:48:37 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame BA5D 22 KB
8 KB 40ms
39ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 151885
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 30 May 2023 21:37:12 GMT
expires: Wed, 29 May 2024 21:37:12 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dt
dt.adsafeprotected.com/ Frame D56B 43 B
216 B 231ms
110ms Image
image/gif 2600:1f18:1aca:4282:9f3c:fb6f:594b:b7a8
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=990511&asId=542a5b0c-463f-8735-94fc-54bfb4d3dc77&tv=%7Bc:eiMbt4,pingTime:-2,time:389,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:2953,beZ:2955,mfA:2957,cmA:2959,inA:2960,inZ:2965,prA:2965,prZ:2984,si:2998,poA:3000,poZ:3036,cmZ:3036,mfZ:3036,loA:3252,loZ:3263,ltA:3341,ltZ:3341%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:100.100,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:44%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:389,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:44,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B380~0%5D,as:%5B380~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tFWCEmd+11%7C12%7C13%7C14%7C15%7C161%7C162%7C171%7C18%7C191%7C192%7C193%7C194%7C1a1%7C1a2%7C1a3%7C1a4%7C1b1%7C1b2%7C1c11%7C1c12%7C1c13%7C1d*.990511-61634100%7C1d1%7C1d2%7C1e.990511-61634100%7C1e1%7C1e2%7C1e3%7C1e4%7C1f1%7C1g%7C1h111%7C1h12%7C1i111%7C1i12%7C1j1%7C1j2%7C1j3%7C1k11%7C1l11,idMap:1d*,pd:VEBo.mhjfbmdgcfjbbpaeojofohoefgiehjai,rmeas:1,rend:0,renddet:svg.us,siq:46,sinceFw:341,readyFired:true%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=250&slotname=2097210043&adk=239546933&adf=744370384&pi=t.ma~as.2097210043&w=300&lmt=1685634514&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634514177&bpp=3&bdt=1740&idt=3&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D76ab65cad0aa0eff%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_Ma0_IwpMBOi7nj9-q6otQoNKDc7Aw&gpic=UID%3D00000c3a8e3515fd%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_MZpfKIRVVeVVB8cjAISCX5v7pmlrA&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=569&ady=3955&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=50&uci=a!1e&btvi=4&fsb=1&xpc=PCTYuyO1NN&p=https%3A//www.farfeshplus.online&dtd=7
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:9f3c:fb6f:594b:b7a8 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
server: nginx
x-server-name: dt15.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame D79E 106 KB
37 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
Origin: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 09:27:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 22884
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 02 Jun 2023 09:27:13 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/ Frame D79E 11 KB
4 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BZJytK53Uo_bolTBtglvZC_FInSYkvsBnSpPZ1s85UY-WSoGdHhJk5OUt-y-FYKuWZ6oxhynYDghu2KE1uRKgXNMLKjXCRzagbhyzWUPmHjvfApNdPcOfQgrGSyMQubUSKPhyKFvgjahRqBLjpSQHWWIqf5CIA4fPoVUVKl2Zwz4HIx_w&cry=1&dbm_d=AKAmf-DCmvyP0GStFIan_T98guyYYLbfcjG4BAAwmMmXQZah9xnearA8QvSf-CvNMXit1h034oID5ytREbnBUlj7dixdptwXIdUTV2lf0LQlqjtCbCtpBsXbDX2mQpmsHk4v7RSRL77jLaHjfipmoiI_43zlhLoQ61B-5UTefwsUlKpSVZZrllsIJGH2zKFqdQ7qVTGeqVtvDcNGiuRDnu53b4vLxldj4fKG4Nt1CBTT5rimskVq58K2g0czIQ5BFtsaoCiDc6Hx-X0NRFp1p95lNGVCYxZ49Ijmhm856S5sd-T_-k1ih8U0m6zpN9NdIfgerXnZFFrejN_Ehe8LGAKpe8YW7UJAjnpOCgbEWRcTyIU5Y8q8VdG9W7VQD4SWSkXlC9Sw6ffGeVhxDTJO8a2d5eHSglotrNC2TguZZaM5BzWU7lsOwJc-LWjhsoY2MY5SfcEpM-vuFFmtRA-ktGKDivMCceZlrN1sQVGLBnPnTeUH2z6V4Ia4PDemrLBZSEefOHC1tcrIEh__dxAwr0gmy9EdCIh9jrFZrpty8GuMgA449lhnhSzxPJHhQZyUJbFbXtTwlCfenQyCNhCRD-Pw3FsdySqEmRX4Esp_lGOQvk8Vomc3P0uFYZsl_jpnZYAldUjo2M_YLHnKgH_yc7HgyF8qykzjb8h7ttOZ5xZV-bjSjnEBY0AJqUmCIIG7cN9YJ5ZeQUBU4dxlJ0KlhcpUOQ1Cbki2410Zl0y5OQXj-BB2V3AzKBI21dEo05L6C0il9u44wuGx8tLPlgnZQ4Z2XOAqRSsntsT0ZFJ3OGngjpu-fyEX6MOWYxEFHeZkqT42oNftgIzC52rhjCadl-lWkmXlfen0ayYwXBzNNmpJDiEuD_2U3SjNwV7juekIGJX33VRpuATIroNParRO1ucxYbxMaQHZ_Y81kiRQNE52LD_LFlG-sQiutlxJQwtggHocxhriMfaSOi117kANchN-3kASji6wYuEL-4HC-1cMw2gThfl1vtCIbiHclc4Z1h9BhzNFt1CnPnRgP04ZGbQERddiDOnKap15QedntUF7oru6KyndgMNGs_FBkejzX13siWX4l4tMuhg7ok208IZCQPPnMkejva9B5qZIAu1FU56XRn8L2sAVjSXJEnqtlO6YW83EvSzDuk1UpgTv6IBi-BuZ5hMRWXdb42PwJ1rcASdeIeAykWTkFsa8ULtf2tQJSNUEX0if627jJw2MTQZUJvu99EgiWv9-DJKs-Fk9UoZ5B5RPTRMsK3eAfI7iVUiN-XDDahWNp9AdYFQ-tsWbUVqmA8eVmYMxZnhnm1iD_JOA7rbEueD8Drg_8E6KDKvd9_pr9SM2sp5UENL8u_ZFJY8QMbAXAysP5WIcSLF0b6UJdiM2-mFjnP2lhjuG1PdV0SoMuTIGFWVbJvN4e0BLPpYJk3ciLz5zd6mp2PS8U2lIrDXv55M1ODSjU-rEIgBWtve3x-_Xp33gHz9vJp2SPn3ngJKW66NXTHFXkORADc0ZIFO0CxIbyEe8Zhv5uofFGKk_IgMDE9yITdu5FcifuktI9ZfeokiBD8TPRKpAmsABqfCwRsukEBSEJR3OvjMtvFOkt4RDjhgij2cQnoAgkWKGjyNHd4J3_K9_943DqIbdgfDvquW3V9_6kEcbCxfbPEMxNicrZnK0PFL82E3OOC_5t5dDrslWx_fWI_TMphSDFS0kP7dUvtb1AEVI_UWz2fUcgwMkg_M7FBx3QsDlb_B2BpbdkK51CpvUq1jJeLXPpEbNEKCxbCoLznb_SUYPKoNj0mLf8qp1GaD_TaXLqIyKSneyPUzfttPUq5l_ZpTo5ERVZv2n9YjYOiDuU9q92m8pYcWW8FXB_fcdH4jlX_WJW1cG55jesvYapeD6JqAlxdwqxMrqXb8V4B1SsOvW2bANq5j5LL9TrbsntpntKDNvU2GyYFTS2zV1gz-44zt_r-y28nQhMyKZqtjwD4_Zu-WXeo6aPV61_z1Itrb1yuKxziBvsNH9HYYiBNwYWafQZYnmCCrdqLonSbtYZcKcqm0mkU4eNbTlYGO-DIeXktnsHF5n6L4oeD6BP-b9-2Jd_hnT0oBjJGe4_YOKGqg89DOmpTamNoKxWkigVogH8PUP6oAbbP1LyLpX3wFl9wSSDGd6F1J6Yx3KhfM4Alm-SHkqTh5qGpIJyIo-AyHaHykyX8bEwtswRkaRKm_tuaSQg8wMiTqyHxZOFVjq88auV1RVSHkBjkhpzvQhn4dY7NPOyw8jaszLyG-85M01icMiAnaaYP6Z6kI30auXolvIddcx6X38xIijpW27qYUKUkm4JA-xjkbfouTg4XkHm_FZIsIGU2i_5Ys5_rUlsrarW7yhXkZkZjcrxs63_2tMFo31HYEEtSiY-L8ifJFd0TRa1jv9G5zbRd2ZvSbbLWCGmurFdWGXw9sfKNMFqyL1QcQDXr3eljM9rA1eAdxRjqG1eZODz4CZLn0JlvUKeJOPigq_FXPsLVi6eQwsGyCGSXzF1R9FSL6ntvjasbuyNOTMleAK4MyK2rAgmmUeXREMyobDHbC6T8w6I2fBYJbzHtvJoDgP9D_mIUzLaQW0y5Mc0bHAQik_pYQm7_FsUUIcD0t4orXYyoBi9bqj0tE-6_MhbLSufD4evF7pb9PdsbEL0m1RAU1tHiALI4GWvP2pyXS9hHYAJUuPavLQFXrAPdcwFb6YFCSOr5UXGdrQ7nnpTVYeSjdu3MBD5FecZ9MxGCGdzMPkez0mcvYTulZBajJHMtjKuMmKFZ9wSYAu--yp4cdvvrsHwUw4PSVTdgmF0zhk474yoKsUXeQ8enrGg2OAGVX_ouwO9KfUN37Sw68nuL1IENHDML9u-W94x2LF8d0zj0vTAq3l3n_RmGr8g1GLYWOXcUEWeBAJ-WifglApX-YR649U48b6AW0l3ik1aa-VXgUHHjxarezcUIC0lTTkJcLwEL1Kb4Uo1dtImcUFvjuVxfZBHjb0xViAhvfgOsVZuIeMFnUM7tg4VWUdTeIYODAysivSUMTUGqW1m0iY0fb8EYdAyv4zk56unrCAk2bMiQg4i8QQ26C2aH9zAUAXp8uKyQHkYdzLKW6YIXTD394i5xHwSwAuMza8y5C6kCQO6KhvBxkV098vnt67tXCMHH3sloALhnt5Fgfjc3gXNCiwdI1NYtwFFiJer3ZgA7jnN_vNa8XcQnYIR4YNUzgQUsaYcfTdQR0DZkOIEtUwF0Kk6WYg4f-Zal21z_bj6neGIk6YIBI1bx9LmQ-FZ50Q33X699qh7HLENgt2fClhi875RpjjrY9LAMekTqyyEyZVDCsykJXTMS1aH-2D7g-aKqVi6ES4sdBc_3IzJdQE0mVW0yMEJ1_H9bgg4msg-pbozGP-IjBhHp_dWzDQSVC8qHTPa3TuB1uacoDPEJE6UVGoVdvLXvQndOXWOMhGuBd5Cr8sm68XTNTjV_NBXaoIuyjVdFyFgrLuT3T7_0oaQkZSRaQVTRWf8LVJt5Ne_Us6JMZcCjLkkVrdrh-ITkTYo68ZBgyXl6xzsEk1h3PDJAoLCuVhojVAt2AMSsW6X-D_hl6tESBMHrcJDJa0ut_eDZy403BDT-xO8BXEqLbdqUld5wKu-5NDn1Jpfl9magq53K0ArakBjP_Aipnf_cR4QCnWK9dJMY0v7RLsM7wkcyFw-8lK53jj6DhVr9Whkplk42p6IbJC1kDX-XLve5U-35yZnw&cid=CAQSOwBygQiDqo4-yU8b6H7F6d_DKX04KBxXAT4w_8mOVBYVYjsBnPspyadEfWjV1KYOzrFuKkwxZcunVAfkGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=2436493295178628000&adk=388007313&idt=152&cac=0&dtd=43

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae8017866a6744d35f26aa9da389e9771d40bcae3ee65df4c1b5e16e57b09fda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:56:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6705
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 6053914914909336730
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:56:52 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/ Frame D79E 29 KB
11 KB 37ms
35ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a91fca903f7f2a3d051f657b5b25baed4e99b6c1e51bfee63737f73ff54f2b7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:56:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6702
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11027
x-xss-protection: 0
server: cafe
etag: 5492578185836041520
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:56:55 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame D79E 41 KB
15 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 07:39:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 202144
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 May 2024 07:39:33 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame EAD8 1 KB
643 B 36ms
35ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 77606
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 18:15:11 GMT
etag: 48472445140208031
expires: Thu, 01 Jun 2023 18:15:11 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame D79E 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 01541fb75b47d7100756dcb811ade847c433a4fc3a4824ac63a93fe06803a592

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 9E03 43 B
216 B 181ms
108ms Image
image/gif 2600:1f18:1aca:4282:9f3c:fb6f:594b:b7a8
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=990511&asId=ab6dbb93-ecd5-ad61-1a5c-de594726c212&tv=%7Bc:eiMbtR,pingTime:-2,time:328,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:3054,beZ:3056,mfA:3060,cmA:3062,inA:3062,inZ:3069,prA:3069,prZ:3090,si:3099,poA:3100,poZ:3130,cmZ:3130,mfZ:3130,loA:3279,loZ:3282,ltA:3381,ltZ:3381%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:300.250,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:300,h:250,t:43%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:328,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:43,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B317~0%5D,as:%5B317~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tFWCEmd+11%7C12%7C13%7C14%7C15%7C161%7C162%7C171%7C18%7C191%7C192%7C193%7C194%7C1a1%7C1a2%7C1a3%7C1a4%7C1b1%7C1b2%7C1c11%7C1c12%7C1c13%7C1d.990511-61634100%7C1d1%7C1d2%7C1d3%7C1e*.990511-61634100%7C1e1%7C1e2%7C1e3%7C1e4%7C1f1%7C1g%7C1h111%7C1h12%7C1i111%7C1i12%7C1j1%7C1j2%7C1j3%7C1k11%7C1l11,idMap:1e*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:0,renddet:na,siq:45,sinceFw:281,readyFired:true%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=250&slotname=6076681977&adk=2278793534&adf=954853469&pi=t.ma~as.6076681977&w=300&lmt=1685634514&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634514187&bpp=2&bdt=1749&idt=2&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D76ab65cad0aa0eff%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_Ma0_IwpMBOi7nj9-q6otQoNKDc7Aw&gpic=UID%3D00000c3a8e3515fd%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_MZpfKIRVVeVVB8cjAISCX5v7pmlrA&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280%2C300x250&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=569&ady=4690&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=51&uci=a!1f&btvi=5&fsb=1&xpc=iUalWkZx01&p=https%3A//www.farfeshplus.online&dtd=5
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:9f3c:fb6f:594b:b7a8 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
server: nginx
x-server-name: dt16.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js Show response
pagead2.googlesyndication.com/bg/ Frame 30AA 37 KB
14 KB 36ms
35ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ae70268abe00d0f5f9a58ce23f5af80fd5f8d9e8b5a647855901f5321cbd23a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:09:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5938
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 31 May 2024 14:09:39 GMT

GET
H3 200 WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js Show response
pagead2.googlesyndication.com/bg/ Frame A623 37 KB
14 KB 36ms
35ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ae70268abe00d0f5f9a58ce23f5af80fd5f8d9e8b5a647855901f5321cbd23a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:09:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5938
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 31 May 2024 14:09:39 GMT

GET
H3 200 WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js Show response
pagead2.googlesyndication.com/bg/ Frame 1A8C 37 KB
14 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ae70268abe00d0f5f9a58ce23f5af80fd5f8d9e8b5a647855901f5321cbd23a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:09:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5938
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 31 May 2024 14:09:39 GMT

GET
H3 200 logo.svg
s0.2mdn.net/sadbundle/9548364509937149214/ Frame 8854 3 KB
1 KB 39ms
39ms Image
image/svg+xml 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9548364509937149214/logo.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9548364509937149214/1676550659977.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f88ad1b185e443ce4a39c76c65fa4b6f199c1521398535cc5452b19304d5f17

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9548364509937149214/1676550659977.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Fri, 26 May 2023 15:05:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 521016
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1359
x-xss-protection: 0
last-modified: Thu, 16 Feb 2023 16:30:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 25 May 2024 15:05:01 GMT

GET
H3 200 DcmEnabler_01_247.js
s0.2mdn.net/879366/ Frame 3692 29 KB
0 38ms
38ms Script
text/javascript 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8545329873006492075/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8545329873006492075/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 03:05:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 45817
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10136
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 02 Jun 2023 03:05:00 GMT

GET
H3 200 logo.svg
s0.2mdn.net/sadbundle/9548364509937149214/ Frame D052 3 KB
1 KB 55ms
55ms Image
image/svg+xml 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9548364509937149214/logo.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9548364509937149214/1676550659977.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f88ad1b185e443ce4a39c76c65fa4b6f199c1521398535cc5452b19304d5f17

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9548364509937149214/1676550659977.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Fri, 26 May 2023 15:05:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 521016
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1359
x-xss-protection: 0
last-modified: Thu, 16 Feb 2023 16:30:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 25 May 2024 15:05:01 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 9E03 0
0 77ms
77ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss-JPnXDa1MtpZAFzY5rVyV5w5q9kO7EMUCgwNNeHhY0GQ-rCQ8369VlDU1KKAng1hOqklzVgWFm9ZkID95C_NMrLWqYAySMnQixUT1SYqmDTszwFy7y7MtsMZw3k0DAZo46sx5G_Fzxx0udJDU_1nsgl7YOXHCQfsIX8gdCW2XBCH-oVgUpl6-WujjMoTlkBR3aJqjp5EA8x1ESnQE7dTfGExqFxxKnTgm1LW5pmsX6aZst-6TBe8DYQOF3oUMjX_EfvI-UthM9THcpvcyY6RQ5ATJ6iY21lL1USxGDZbSZ_MJnt-efOPip0dx4W3M9xnwressy2Fq9pIZMni_63DIKW0Cy1MGmnMRHd4Wky9cKHtniqw6aRPRJG_lIpBoEe8TwzB70XxhwNNE5iVUwk0VbQV-WKrYI1I-8rjxNtf9QXXv12shDXT6CIn5HYB2avIposxjo4js1gVS4R_d-W_QxwCk6wl-N8HeYdBRHTsC7rczXQQ-Fl46SGucgHx5vC9RBRO6dNUMNobmW5zPqf9-vzp6L5zkIcQdeJtFPmBy5iKhpUjG_ucGfsFVc4Lq4agFZDlik016uhjDWx2Mn6uVOvcsjRquhWzc2XbEd7XOiwjEHPD8sl87s43LMDZ6aJ372Ha_nGXxDNhdfo3E4vlvOK_CHZ6T9NQGIvC8amNr_MSptyeTP9ESX38-MiQ4FQeemEQ0GyQvrfNLuGgbmTUDkf82DsEJI9y_FBBbbXX6uf811vPG30_sc1QiTn09U-Stt_Mis21J22dx8vkhDXSHp7hzhCYFy2vfu5VXTdOG5BFaqn4aoRWlYYCbBjJBhH2o5GKNtj5L7xdFD6meEE91islXT1Ed-tHtmIXYqWhU8HdnIMnzbIBu3vmKrLX8DbFOst4oELWLx3o2omEwW0swx2zhnxAWmpEoOgOQmDe9KmY7M8GZyPgEdc_24WY0Xab7tueh2miwoESumz7AXhp44dCuikOd35E9seEzfNuJRnTHYyG_yNYv9SUtKIuoPmV3Ib4ysPtkCbatHtUNTove-mCdnTlVB-YtEeu--5cPMoh9BzLFTIJ-xC5TU4zauCxjlfipInhcnDtweiW-atI8X2qQOrBS8ckXRWMifCD0P7EMFCEP45RyykjZ3eP-Yx3TFV0KXlAdNIaHT2Ih2zHJlW3yAQEA87KShxOqXO2jR2G9lt7zRppB4BhmNKV43u-zq75mGtoQYwjlar3Rq87roKAYcDpOud44dX7M7M_RvrzTXS33QsKXJFnvY2e7uz7TmTVgq2fTfk6cr3Tfwxeb_7Xp3hXCSvWND-tkwYQu5VII6o3Jj1_ZsnhoozfFADNaQv_5__LEKDAV&sai=AMfl-YR6JqAxU2E4RKcmUyrmE1LFIpSLzAeG0VZ-6RSxsCd0Lr5Xovo8IUqJKD2MBtISV-9oDpDOpCGhzGrrQP38-I7P56h23fGfnFOSSInBlNedmpeIiwiel1DI17u0kYWnohLmfckjlJlcp_GKul7DppdzZUnl78WwocLyCrC66MkAUVzN2KIjFCzYtaonvwitOdKCOVp5tfsVZQd_tc-yCefo6YXTQJsVhg4WZ_Gq0cboR7l8mU0er67Io_RSAht71F66&sig=Cg0ArKJSzLXFZOVtIY67EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2023&vt=11&dtpt=1114&dett=3&cstd=904&cisv=r20230530.07167&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:37 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 01 Jun 2023 15:48:37 GMT

GET
H3 200 WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js Show response
pagead2.googlesyndication.com/bg/ Frame D33C 37 KB
14 KB 36ms
35ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ae70268abe00d0f5f9a58ce23f5af80fd5f8d9e8b5a647855901f5321cbd23a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:09:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5938
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 31 May 2024 14:09:39 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame C902 0
0 77ms
77ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstAXMwVwYibUPAv67iUs36wZ-SBhHKOk8flpdmTFTLytwLL0MLi6cyRzGBxYKgYAh_BPQqcllNnHZEp_kf1s-AL21guXwXMgjCE60m-2BDiFE8fuXTbk407U2V3VQDfMWtqEP3YmIm3crVJHp2ZLB81-J3XmRODhaB8UR6j_bvInhB9jNZEwoXRCo9s3-NRp_hy-sN5C8Jdr5GNsCZ766BNtZsgVIKa2hossWPohhj46hdq2FEnO9SrGZd-booEmb55jCu22gqGj3BvdP6MPy6bvCjqX0Kp-QVP0490PelCOpqLNrjCmusqnFljkAEtDnY8iw1OgFrerdn5HaD3rTMgshrUu-MQb2xbJdYcY01lPVKm-aSE68RhHtYol9wRFVqfACMLGYnyRhkAyPm0_O0HK7SUPJHKs7tJyWKdFCiSCucVcdmOsol1QQDK0jIXnkQ9P9Nhd40FjSHts12UYJeVImlt6CG54T4knZCOWgv8eSOpM6sBnmDGAsGymw6KwtfaTcMR3w6F--9mIm-psSBIuvtCRFfU17U86ZRsLLfgw-gUiDlR3HrkU5aZJVQN8HOvCPpotgkyc7IpPX_F3VHW0UL_-USTuSeSp0XWkz19z2NLJnzEHNdh8VkGyrNvSYW61QSsCSxnUEXAVSjQTd3I_Q0WuA2QSNPspHjaNrjfj6GODplZnXiSKyR_U5TNXB5dlkTgrNFf7TLPN9UPwuiS4E7_5onjrVdvusCPtY24cckX_UvQFLuxhVamrevjVk_B4p4paVdMhJnomphxxPdjtqDKOwOs9gZi5s3m0pa9S5XgbbQXdTGYf56dkEEIQ8jAIenFOuOm8izDQm-CqWhV5KJihW-oMEMEOxZkLoe3-fTEaWn-119pR4-KQWsfl3Cz6vDid3cvNWvlKwYn0uV8ai4tYf7y4sdhF8Wv-5w4FL_G-uDMxS5W1_iK_Gt4c04ZAS-qKqQeK0hPKLN7k-C0z-U7xoqIHNQgWkxM_Bmrp-9oACLiEgXoIATWy4hzJ4hbfrXthe2gsHMtpKZg4oRY7KqtfW7qZ5ecmZwIbBEBbszl_qTOkhry3mdBbYgWkQqKqVHuRZ_l2BDahXQr7qCP3hwehsYneNJNHQf4MpOYZsSqSluqrgWNxS1QabN29nlw3WLeYgUZM6deekArZyB7Bgk4TOUQpkzulYtmaPWK9g_PUNyEv5diPK_2Sjv2DLTrUvsejvfyuxC6PjF5gJ4_xGG4sRQHXWJpqswoFO4bmNUpA0sMSNRSIpgdfRMVg2mBnsCOpYHaBDHHV-O2MiVIxxMQN5awbxxXEw&sai=AMfl-YREcv1BRR1qxTcRLTz2PGvcYk6rbfS02_-EyBS9Orh-1UHH1Ip3yAjYsbyzJbWfXLPQPEsokKGfOHnzDJc3mnpkZMc9Lzg_EFbBVMWSgQOhjlqNkRojC761ZEVXvTjKaS-nGpDQst649QQQmdVEhFR2SGfG6KeZCySpwnhnKPdetZT4fb48iIL-2getOaLWXeC5IliitylC&sig=Cg0ArKJSzKLxIs2Lqs-oEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2352&vt=11&dtpt=1428&dett=3&cstd=907&cisv=r20230530.32218&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:37 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 01 Jun 2023 15:48:37 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 04AB 0
0 77ms
76ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv997K21sqtxyrk92ZnQO6-p3Y-JjknrnewMsDDlGDD9c43-XZPdmdMuzJtUl3njVccWUxCMaQ-fec7UrQxerah9T0lwIx6vAMlv67FyxCfJViduc2EfPbtr6lDVbC-Sb4q8Mk56-_D1kzDmSkwVF7RzXJJNA1t-wBkxQcZZWa589zpF08bknecDYeiXJAuJKJslCphFMZHRMGZgxV09qTw09lT_OHxpi46Zaii1RzwqEjTN3PYTG-BSUiUngkICgRJzzy5Mb7OJbeEa3auu7MxjopU8CjxROK35ij6JTbEcN_gGCPP4wmC6J82y_uV-qCCqZKVtOjHC0TPanMih0TsZLMaWC9e_UmDZ7BuaG90uw9R7psLmIA8XIiOqiP12SXuJZENcP7A2TZKDxrpObjFJv89hiErxh7z3uBiHFKYHFQvXpTSCXa-8VN2coOKkrcz3BUefNzdReQCo4DngkRw_jlXG22-R83lpKlzLOBKE9-udp_0s7t1oAvVDv9GyZX1cIaRjmdvrjzQvhw25-3iJgexysmGlQzRp8ju2YCpCUveGfeKiFdeSCimk3bpSlgd09LAPUlpC1Vxhic06qEtlh5Gwh2V1YZ2V0CEQKKYpZY4KRThGeWPv7cGfmvBHBb7NI3KzgAMTBnjfKVJiCceeuO90aEl5bF_Nx0vAti4dUoOQW_GI29Iq9Y5xqK-wZE64T_uCiwtE4yRM0EaFvW8Lwihc-ldF1xYZEz6pHiRzZFHB0iR4qP3Fq9SGuqwfjWypfkQsSURyBbu0mIplxZotw4J2IHWmWP0a14ENx5Lc17GkPHr8UI3gun2AU_YNJyeHmef_ebloTmGWLSPirCJTy95aJL7UzYtkqn2kst6TGJ6elnUSEdVN-2rYqp7S4TtgNO53F3vnlZRoEoVvF1TEJJz66Gf7ctW97xCV621Rm-bNy4mfeIp-BL-t2UuBBHEYmHgLFFoqi_AJbIOSo52lTUF2pLBif9qzY_pHdFoKd0Vhluq7kkaM_iPeBnWvXlbMzw20TxQblLRyMdKBMEsIDI9V5q2n-2TUncxkmQbGS15dQzX_-qqkQ6Jdhsyx0LqoKcflSwX9kEeTLaooR4fpTwz6Yx1_are3OtB0m35cbBySTzC37eyxKfhai8f6JhRr0fCN9mOkOiJFr8tbxBQgiy85PSPN9KPVqwI4YBPKxv3TVR7qMqKWv3SKgmKxGm731BUPQvtoAWarn4DxSbdhb1w85pYCxT_fP8gKQlEpKouaBRINdeVUIR4aSsHfYHG78Q-b-IngWqVwfdKNkvMjhFHOXRP8TAZ&sai=AMfl-YTmAKN7Fuwqb23BE2M-KkKdZ2WT-8oQT9hmxy3R-oTUU_W3_rCazdVFh2InjmEvF1UkpOqwN2FP0FE2QMrXzJ3ifqiSC_L-uQLeo6u4-fQRv64Xthxw3MStm_Ljb8frw7nRH30iWMsPtV2AjOx58pS6kQXVj0tugqChL6cZbZu8-1RXctpD8joaMRZELKmI3ikJ0ROFaZIh&sig=Cg0ArKJSzAZTbZN6aR7LEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2145&vt=11&dtpt=1296&dett=3&cstd=825&cisv=r20230530.93095&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:37 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 01 Jun 2023 15:48:37 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame D56B 0
26 B 151ms
78ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstTSoyWszADLbWRhV2gDhJSzmRNrLGWmbAMYSzsVxJOUnx8HBjpKcctgWL8nXIf7p4OTKlu7jU0ORec8wM2NP-qk_Q7os43QEF_JXX4z6HEOlgmhzhrrb8JBKwl8IvB20mhnxKNnkFnUMLGMzwwiYuPg7FbnA1Mta6-ZicwCGrjb5A&sai=AMfl-YRiZRx-FW6icZRk5fL4gRwkKSVEqeYHINffuoVtktxRxOdmxSCD1VdkCVy4gcv28AorOQ6XriniQmi7TWbcgHp-PQhvgo8N8R8OJ3QfquY6qSGe7c8dVlqo4ZU19Q&sig=Cg0ArKJSzJU3K1tPx1BIEAE&uach_m=[UACH]&urlfix=1&vt=13&adurl=

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:37 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 9E03 0
26 B 147ms
77ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvdRXxC8w-mOUni2fNgfJln2cEo1w5Eia-rJIVSoN7jD75W5q7QnEGlYsNN_wgs9wxs4mjkjw_ZaI0e1oVb46TF70gbeEgk1KQbJQQlDkl0IWLbtw1QTpYzxO07eAgUpAmKyekSlED2C6dwwJuF_KHwJ_Xd1BeNk3XlmdLFo-3cRco&sai=AMfl-YSLoeitPlFjfO_WUHAWzG8N5BWQQTf9c11tM2WICQtP55mUiD2AiCrg0uOuHEy_ilJMkQdkbsxXwgDJfBOb9zlxH33yss4iHR0X4irO7qvZrwU0Lnc-FVpI1JgCbQ&sig=Cg0ArKJSzFHn0lwN4SOhEAE&uach_m=[UACH]&urlfix=1&vt=13&adurl=

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:37 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 webfont.js Show response
ajax.googleapis.com/ajax/libs/webfont/1/ Frame 8854 13 KB
5 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/webfont/1/webfont.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9548364509937149214/1676550659977.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 25 May 2023 20:00:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 589694
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5437
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 24 May 2024 20:00:23 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 8854 7 KB
6 KB 82ms
82ms XHR
application/json 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8188d878d332f4e34216093a572e6267823ef64be37d62b51f8db828bbc3721b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:37 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5770
x-xss-protection: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 8AD6 42 B
64 B 82ms
81ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuLd7HUdSvhgiC7btzj9lJ59Va4KOcTSz42-nCYc2cm9-MuZMPtPfpKuipXN_Qkc_M4gdVCMaFVx4Hei7UW1AGKOv6Ugus2auGp_RcGTTyzwQqPHhxly-Dwjh2veQuUT8RSAcEldw&sai=AMfl-YQwiW_Wd-6DD4P6Nu0WEQcTMv9pxG5Nbu0t-5rN9hB-17Pg-upQi5AFZfP_JE_ru39UdNARJCBS4dfySq0yebniqjm9R7jzwQbwaw93OkxGTdN3fI8r878Rnfk&sig=Cg0ArKJSzJe0aR7l2ejLEAE&cid=CAQSOwBygQiDIssFOIk4-Fuonty4sjxuFK0ZPNPvXTkR5QIacxNi7MEv16s2kzWYiTgPjvWqPDeavT6kFRHQGAE&id=lidar2&mcvt=1073&p=300,1440,900,1600&mtos=1073,1073,1073,1073,1073&tos=1073,0,0,0,0&v=20230531&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2645681282&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1685634514574&rpt=2141&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 FordAntennaCondMedium.subline.woff
s0.2mdn.net/sadbundle/11934569601524222564/fonts/ Frame 2F82 13 KB
13 KB 42ms
41ms Font
font/woff 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11934569601524222564/fonts/FordAntennaCondMedium.subline.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11934569601524222564/css/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9e83314d333416d003a14ff991793feefefe12184980a4f081c0465cda5dc8da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/11934569601524222564/css/styles.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 27 May 2023 02:26:41 GMT
x-content-type-options: nosniff
age: 480116
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13336
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 10:59:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 May 2024 02:26:41 GMT

GET
H3 200 FordAntennaBlack.headline.woff
s0.2mdn.net/sadbundle/11934569601524222564/fonts/ Frame 2F82 12 KB
12 KB 52ms
51ms Font
font/woff 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11934569601524222564/fonts/FordAntennaBlack.headline.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11934569601524222564/css/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d97d2f204c48ceadcc2f5b86ba6bf25987c6f7c43c8dd7fee7a2847e6a71f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/11934569601524222564/css/styles.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 27 May 2023 21:57:46 GMT
x-content-type-options: nosniff
age: 409851
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11876
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 10:59:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 May 2024 21:57:46 GMT

GET
H3 200 FordAntennaRegular.legal.woff
s0.2mdn.net/sadbundle/11934569601524222564/fonts/ Frame 2F82 14 KB
14 KB 47ms
47ms Font
font/woff 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11934569601524222564/fonts/FordAntennaRegular.legal.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11934569601524222564/css/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff1ea82759f4df729f7ee24dac62805f05a2fc79c7ca4cb518a072a11835e884

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/11934569601524222564/css/styles.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 27 May 2023 18:36:44 GMT
x-content-type-options: nosniff
age: 421913
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14468
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 10:59:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 May 2024 18:36:44 GMT

GET
H2 200 webfont.js Show response
ajax.googleapis.com/ajax/libs/webfont/1/ Frame D052 13 KB
5 KB 44ms
40ms Script
text/javascript 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/webfont/1/webfont.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9548364509937149214/1676550659977.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 25 May 2023 20:00:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 589694
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5437
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 24 May 2024 20:00:23 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame D052 7 KB
6 KB 83ms
79ms XHR
application/json 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38d1a77d651921fa1f903cb70afa71845d37ecfe9fd9e4574d6da56180b38e7f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:37 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5725
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/3719878330380519815/ Frame 4C2F 12 KB
4 KB 39ms
38ms Document
text/html 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/3719878330380519815/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1227c586cb83e93f912bcc2d8196554a7a58c6850d63ab13ede724d5a105eec9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 432438
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 3671
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sat, 27 May 2023 15:41:19 GMT
expires: Sun, 26 May 2024 15:41:19 GMT
last-modified: Fri, 02 Dec 2022 10:52:25 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame D79E 0
0 84ms
83ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstP5FmfL8i2YnCk4EecmGIrRL95AJ4y210Xx_-O89SybYc_1ao-Gk-E3RHDbS11fc-TPaMXfPPc7MYHiA3l39cuE5_Ftkj7gQTVCcubeX8Q2Nme7cpV8FqWJdn4FpoaFIkwv5nqYVNUItV26R33W_khjIFpR5MdDr3fcg3yM52NSNTYDUSyIBPUeHkETNTN0MZiT09DbEFmEWMjPuMh0wE0Ro3psQJmreskMMbtDO6NIfN3C05PMXvcx84T5LJPWOgiGrG3Ft4h7GRMbPh-_gCsL_VLsLCGVbE8hKO71NZ8IHEWsS_gKhFneRpZXvL9I5dryyvbRRKFyDLfl5C7cM5EryOLrP9XJtFDuTIfcfZdr889KV99_9E0DdRq1a-60cmAPi7DKpVDcrsCfEqXtmPA12b8irnjpIjD1kAcsCz-BipinhMvoDWvD8ZEjRKe7IJ9o3Oh7B0fNDMfzKmvDev1zrpSMQNKeM1Vv7hVqQmrHpwPjZ8dIjYMSzzMVkO5vmJQmygWh1Ee-eJIZmvrUHK2XjYe2qAkSQSIf66osWQHa1mrsYz6tASb1RDE5HuIiXiegkJrestKA8J40386s5YgkrEFP_sLmj49mN7KLzLaTrEVYnS7pc9GlVvGOQUhgEeXyI7mJKB8uIeYlq96iQJAk5xry2AYUZvnGlK6Q831Y13hUUFoYbqkdWZeFKzohS_-PRd6w3UPqznrYT6D-EBVOnRblsIBRhZFKBzCDucuuUEPxuw2GBWb2BbxDf6dPV3vNNg7lIKAxFrFUtKi9FZT7Z8u3TevAEU9WjlFaf3nOKOqOz3zMIZGOb0n2M5S6d2eYA7eSIflupm-8q9TQ0JJ7Y7xfIEoi74CtHt5gBSLveg8tNX26QMi1M6zdS7OrR4mxdMY6j2gDiq-bOOl0uPGTqEGlqmrNOOWxFRqsGjA7cyL8FpRNywiU8N8Ab-Qy70_entgCdY_mOnpvh--fFNY4cXu3mynWrMED6tH3wDvo0v0-pUys0dF0sVfQNIPVprBGCMhjThhOsl6FM6tUFYZORHfkticJ5hBZ1AzgOB75ww0WwT5Pq0kVhV3J9cHIySimDaaTYv-0aE3qIcMbIuTPDvT-Too8nqIqjP5yJbOJ3faMeFWyMg3_PMRURt_zLRf9KiUq7NEBdHI998qJKDcO9k_Du4si67QU28F5LiWKA2B0Z9UJt6gF3VmWQ1uA5NeeHA1v7kL8S7yOvWVJVYwXUKDilE4X5ql1mygDsW6t5XVNG8KTlo2OKhy82kydGezsc-ThZRII5b1TyyhCEcczzlYy2pzS-sfwRZrU8K3C_kp2PXOn0S6KlnXdxI8lA&sai=AMfl-YRYfuLdCnWbnHCpcnf_TnNlxMfs1OV3HFPEDS_am8a4IZyPsxabQbmcbL8SIyUdHBMFwpzAsHNduvBSAWM5gNHuBuJA-DfwfFsr6CCS4LpvxLDsrTZKF_bVUIIreChFtTsovsnaE7kedrP7D06ifPvP3aD_vaS6QD1DTJWVJYonZB51MPO0ymFG1slHM0s00ianJbmGGsiBPcG7CNNAWemSpI3C3qls-WcrOMvRiX58TBkTi4rM5zRrBbZ5Zm0x3lt9&sig=Cg0ArKJSzDrQt-lejMa5EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=395&cbvp=1&cstd=392&cisv=r20230530.55201&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 01 Jun 2023 15:48:37 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Thu, 01 Jun 2023 15:48:37 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EAD8
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEMCLCip_jv0V9NrygfJDDYU&google_cve...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=SnBkZXZFTHExUTRLeHU1&google_gid=CAESEMCLCip_jv0V9NrygfJDDYU&google_cver=1&google_push=ATf1kGP8LceF0rOhGzeehKDZt6S3Nt6vrKnEdv435VfPAH8...

170 B
188 B

50ms
48ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=SnBkZXZFTHExUTRLeHU1&google_gid=CAESEMCLCip_jv0V9NrygfJDDYU&google_cver=1&google_push=ATf1kGP8LceF0rOhGzeehKDZt6S3Nt6vrKnEdv435VfPAH88AdQkLvkrc7oqaauCatV4onLW81t5rzHJkY9verjTERXWs5ozLQ

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 01 Jun 2023 15:48:37 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-777-g304ac51#rel-ec2-master i-0a1a90ed6ac66fe36@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=SnBkZXZFTHExUTRLeHU1&google_gid=CAESEMCLCip_jv0V9NrygfJDDYU&google_cver=1&google_push=ATf1kGP8LceF0rOhGzeehKDZt6S3Nt6vrKnEdv435VfPAH88AdQkLvkrc7oqaauCatV4onLW81t5rzHJkY9verjTERXWs5ozLQ
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EAD8
Redirect Chain

https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEDNOF5xUGi6nTUFHemk8R7U&google_cver=1&google_push=ATf1kGMaQNCVxKE_WvP0FituvNANLdBUwkMGEqZZolsUESFSfSDQl8eyfUmtfxn3FDWhXIl5_U0zXOxrFbL8DY...
https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=ATf1kGMaQNCVxKE_WvP0FituvNANLdBUwkMGEqZZolsUESFSfSDQl8eyfUmtfxn3FDWhXIl5_U0zXOxrFbL8DYca68qw8dD3iQ&google_hm=hmR4vdPshkAx1t-mcA&...

170 B
188 B

49ms
48ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=ATf1kGMaQNCVxKE_WvP0FituvNANLdBUwkMGEqZZolsUESFSfSDQl8eyfUmtfxn3FDWhXIl5_U0zXOxrFbL8DYca68qw8dD3iQ&google_hm=hmR4vdPshkAx1t-mcA&google_redir=https%3A%2F%2Ftr.blismedia.com%2Fv1%2Fredirect%2FAdxPixel%3F%25%25GOOGLE_ERROR_PAIR%25%25%26partner_device_id%3D6478BDD3EC864031D6DFA670BLIS

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=ATf1kGMaQNCVxKE_WvP0FituvNANLdBUwkMGEqZZolsUESFSfSDQl8eyfUmtfxn3FDWhXIl5_U0zXOxrFbL8DYca68qw8dD3iQ&google_hm=hmR4vdPshkAx1t-mcA&google_redir=https%3A%2F%2Ftr.blismedia.com%2Fv1%2Fredirect%2FAdxPixel%3F%25%25GOOGLE_ERROR_PAIR%25%25%26partner_device_id%3D6478BDD3EC864031D6DFA670BLIS
date: Thu, 01 Jun 2023 15:48:37 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EAD8
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEBD0LufohaVgZt5yXmSy7k0&google_cver=1&google_push=ATf1kGOMVB1gLWO0_s6h54MtjU2Lm3QRb9Fd7lx6AGDr2_agfLWZGHX5NAOyl-a9lmjWuP_0Yzx1lRcztgyzy7...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzIzOTc0NTEyNzgyNjcxNjgxNg%3D%3D&google_push=ATf1kGOMVB1gLWO0_s6h54MtjU2Lm3QRb9Fd7lx6AGDr2_agfLWZGHX5NAOyl-a9lmjWuP_0Yzx1lRcztgyzy74qru...

170 B
188 B

51ms
50ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzIzOTc0NTEyNzgyNjcxNjgxNg%3D%3D&google_push=ATf1kGOMVB1gLWO0_s6h54MtjU2Lm3QRb9Fd7lx6AGDr2_agfLWZGHX5NAOyl-a9lmjWuP_0Yzx1lRcztgyzy74qrumXfWMQkA

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzIzOTc0NTEyNzgyNjcxNjgxNg%3D%3D&google_push=ATf1kGOMVB1gLWO0_s6h54MtjU2Lm3QRb9Fd7lx6AGDr2_agfLWZGHX5NAOyl-a9lmjWuP_0Yzx1lRcztgyzy74qrumXfWMQkA
Date: Thu, 01 Jun 2023 15:48:38 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EAD8
Redirect Chain

https://cs.media.net/cksync?type=g&google_gid=CAESENuPl4EYQwlcN2AY3IyErL4&google_cver=1&google_push=ATf1kGMSeJ4R15bwow2WB99i5AD8owryebKuJLXroNrL9JtDtjHxplGegfebKon75f7dJFYT81MuLKz1RLrmIp_qD0cERjL9Xg
https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MzI4NjM2MTE4ODM5NTQxODAwMFYxMA%3d%3d&mn_hm=MzI4NjM2MTE4ODM5NTQxODAwMFYxMA%3d%3d&google_sc=1&google_push=ATf1kGMSeJ4R15bwow2WB99i5AD8owr...

170 B
188 B

50ms
49ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MzI4NjM2MTE4ODM5NTQxODAwMFYxMA%3d%3d&mn_hm=MzI4NjM2MTE4ODM5NTQxODAwMFYxMA%3d%3d&google_sc=1&google_push=ATf1kGMSeJ4R15bwow2WB99i5AD8owryebKuJLXroNrL9JtDtjHxplGegfebKon75f7dJFYT81MuLKz1RLrmIp_qD0cERjL9Xg&gdpr=&gdpr_consent=

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 01 Jun 2023 15:48:38 GMT
Server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Location: https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MzI4NjM2MTE4ODM5NTQxODAwMFYxMA%3d%3d&mn_hm=MzI4NjM2MTE4ODM5NTQxODAwMFYxMA%3d%3d&google_sc=1&google_push=ATf1kGMSeJ4R15bwow2WB99i5AD8owryebKuJLXroNrL9JtDtjHxplGegfebKon75f7dJFYT81MuLKz1RLrmIp_qD0cERjL9Xg&gdpr=&gdpr_consent=
Content-Type: text/html
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 154
x-mnet-hl2: E
Expires: Thu, 01 Jun 2023 15:48:38 GMT

GET pub
cs.chocolateplatform.com/ Frame EAD8 0
0

GET
H/1.1

200

0.gif
id5-sync.com/i/495/ Frame EAD8
Redirect Chain

https://sync.inmobi.com/gob?google_gid=CAESEFsOZdkQp64g2cp3323Ys6M&google_cver=1&google_push=ATf1kGN8-NsPu3xajvEQIf_KEQ7l6HvqCWzWVK6x9n_o8-ybazW4aIMHQobpwOtKyKav0-V51B42nhsCGSaKfkQEK2Nj6ktSOSQ
https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DATf1kGN8-NsPu3xajvEQIf_KEQ7l6HvqCWzWVK6x9n_o8-yb...

43 B
1 KB

12ms
11ms

Image
image/gif

162.19.138.117
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DATf1kGN8-NsPu3xajvEQIf_KEQ7l6HvqCWzWVK6x9n_o8-ybazW4aIMHQobpwOtKyKav0-V51B42nhsCGSaKfkQEK2Nj6ktSOSQ

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Server

162.19.138.117 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-type: image/gif;charset=UTF-8
date: Thu, 01 Jun 2023 15:48:37 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
transfer-encoding: chunked
p3p: CP="CAO PSA OUR"

Redirect headers

date: Thu, 01 Jun 2023 15:48:38 GMT
content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
expect-ct: max-age=0
x-dns-prefetch-control: off
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=utf-8
location: https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DATf1kGN8-NsPu3xajvEQIf_KEQ7l6HvqCWzWVK6x9n_o8-ybazW4aIMHQobpwOtKyKav0-V51B42nhsCGSaKfkQEK2Nj6ktSOSQ
x-download-options: noopen
vary: Accept
content-length: 270
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EAD8
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25?google_gid=CAESEAUKy0T-E...
https://cm.g.doubleclick.net/pixel?google_nid=the_mediagrid_eb&google_hm=553d6ab1-d407-4937-b30a-9e2b7c356d1b&%%GOOGLE_PUSH_PAIR%%

170 B
188 B

52ms
50ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=the_mediagrid_eb&google_hm=553d6ab1-d407-4937-b30a-9e2b7c356d1b&%%GOOGLE_PUSH_PAIR%%

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=the_mediagrid_eb&google_hm=553d6ab1-d407-4937-b30a-9e2b7c356d1b&%%GOOGLE_PUSH_PAIR%%
date: Thu, 01 Jun 2023 15:48:37 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame EAD8 0
12 B 47ms
46ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IAq1jrwurHLfNw698IFtBSEeIx4H6OEiy6MPhW_LxHniJYtgUWVmrMClWCH5dpY1_LhCdd2VQ

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:37 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 passback_300x250.js Show response
static.adsafeprotected.com/ Frame B82C 3 KB
2 KB 7ms
7ms Script
application/javascript 2600:9000:223f:2a00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/passback_300x250.js
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:2a00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6005e56ab3043d83726d25b0d17458e35b72355a81ca3230cc9de9058ee8b1f0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

x-amz-version-id: vr1Fa3eAVtG7AGe6kPa1Y0WAZAHvQkII
content-encoding: gzip
via: 1.1 02d68f3a4f2a3f8967c5e021dcd7f96a.cloudfront.net (CloudFront)
date: Sat, 27 May 2023 15:02:38 GMT
x-amz-cf-pop: FRA56-P5
age: 434760
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Fri, 18 Feb 2022 23:29:42 GMT
server: AmazonS3
etag: W/"44f0ac540dc9c11f94344414c879b658"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: 7pFrbfgyHnxFcQom33YuOyrc3C_BT3qYjgEqiu7ms5dKWJGP4oITmw==

GET
H2 200 passback_300x250.js Show response
static.adsafeprotected.com/ Frame 3327 3 KB
2 KB 9ms
8ms Script
application/javascript 2600:9000:223f:2a00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/passback_300x250.js
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:2a00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6005e56ab3043d83726d25b0d17458e35b72355a81ca3230cc9de9058ee8b1f0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

x-amz-version-id: vr1Fa3eAVtG7AGe6kPa1Y0WAZAHvQkII
content-encoding: gzip
via: 1.1 02d68f3a4f2a3f8967c5e021dcd7f96a.cloudfront.net (CloudFront)
date: Sat, 27 May 2023 15:02:38 GMT
x-amz-cf-pop: FRA56-P5
age: 434760
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Fri, 18 Feb 2022 23:29:42 GMT
server: AmazonS3
etag: W/"44f0ac540dc9c11f94344414c879b658"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: LsI3aqkj9oSpBgopn_bUrHK7GFBb2Q6Zlx-HU_mo3TiYrQFQLh1g6w==

GET
H3 200 WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js Show response
pagead2.googlesyndication.com/bg/ Frame 2BA3 37 KB
14 KB 37ms
37ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ae70268abe00d0f5f9a58ce23f5af80fd5f8d9e8b5a647855901f5321cbd23a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:09:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5938
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 31 May 2024 14:09:39 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame FDCC 42 B
64 B 81ms
80ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv3SLSrPU7L7s2XrbNGfJw6rawcKScj9RksiTfjRkD1viuceGyJL913JeWsDV1ICp-CGiLncOYrPWbl0RP8i9a_RWbS_VWCxfIQLV8SakPkQv8BcLpU09B8ZpQeVC4m4YCEULGncw&sai=AMfl-YTzos4OIHFp_YXL2TubX3BJGQcs6XBR2tX2q4771gJ6RwGJmKz_10C7oTG0DDbTicMt8Kg0xX6Hsr1p&sig=Cg0ArKJSzNuJdRggrKZ6EAE&cid=CAQSGwBygQiD1fhfvfURPkZzAlGEZHezpvCdsquqPBgB&id=lidar2&mcvt=1107&p=0,0,280,760&mtos=1107,1107,1107,1107,1107&tos=1107,0,0,0,0&v=20230531&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1067503192&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1685634513581&rpt=3230&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js Show response
pagead2.googlesyndication.com/bg/ Frame BA5D 37 KB
14 KB 35ms
35ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ae70268abe00d0f5f9a58ce23f5af80fd5f8d9e8b5a647855901f5321cbd23a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:09:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5939
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 31 May 2024 14:09:39 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 68C4 0
0 76ms
76ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvUcow9UuYoaBc0TmPqBpMVxsjg2PbU-EFEh1sxJc7WaejilyjkuL44lWfyRE7QbA-yfYG_qrff7uawFM0jsCi_ALL26ZzVRw6zT_znH2VH-wgsZIry1696lbxeVp3CWGN4-9MQekL2aRGNeF00Enl9rLCE48vLgY0c5-OmEWHwnAGHqhkSuk2Uke_DasjWTvklvJ4Hj9I4-Vki0xPeETAsljZ6gN0QaXtDCsxxQk_ifqTQXCXfJ2knGcb-L3o8WrH6la13oxb6vozX7pPFH1YdYHro0p5TrTMIjnOhqokjjVX8h4mK6aoi41rDxD8cup-chdjfyjSjsfS5IYqjlc55NUOvv86F7HGOE5h16w9WwZoqHbvFG3OmarKQp9TGq1CME5Y9cuhog1Bkewe_4Pal03Q7fxF5yHa-LTMY2nSvbvehKKBSXmwv7L5DmAJ_fXyBe6a6jXBwgOdGjdVg6A8RzwopTXrH4d7CUvDwL9LesBcHl-nrLhai86RRjHPvTtcLNtEOiYI4oGIBpM6K_2gJ7qgETchzdpF2rtCF4HE-rD71rGzbdR7VzbM8L-5ZnjDErT1EG6RfECWbDaMomlJZbfyxpSWACKSTzIjAo7fzxAvCyGtOHhtrgTe6ivkjf-ivLhqIezjCD4uWzd713-AQo4qAXAeKyEPA2MhXETStOHyOm-PwZM3MQEeROQwTjaHCC3wRestquV0VXfOLdF8RjicCY06gQFwxbWinEnHT7QGsDqMNl4_pHhVKCk4-_-gzkbQYojfppuXG893viR6yCgAJXy7qLpipfTZwXeQ_W9Suz03-MQlXJZmht_fOjj3kRSGsVS1lTxT-69GwdNo-fqYjoEC4l-vaq7y0ZKfecitYcW51iyDAaZ9mPDqXa6cxOZJhD2u8UXhshNMLpYi-3lxq_38qLkHGR761vh1H2cO6NooN2FTDaGP1z4NtsqxMywPuYnOsRTf13rKgFK5O5JBfeE5Ys-445vCKGLcvcoEUbn82OEL64mjAbVfvFNs2j6cECFmF3v6UXFq9nWHcd9rr44DSUxmORC_n-g2hMn6Hdwe9zcIMO1A3XTfcl7WDTIMmh4jrWNkoMsfPEbO7b2Mtj2sPAmBI8kNYcIpYWpe_I1a2XUZcBlG_LMpPMYJ1HXa_NRpakDamxinYUSgf-WC3C3sjXpEiuO4xLSk8joJKndJKa7qnV3kSpq-zWrosHo4Vqdd64MuTbj0XZJgQZwkNND3dDl5rAbYQ05bwYQR-uujypiPKzXlKeKbNyZ5zoFAAjju0MSoNKTd8dHoa6RGE7s9rJi9Rivz7TVQ&sai=AMfl-YTuRolX7H7sihuPM8xAUdQRcgJCGfTIO5Ryv6puicrGoren41swt3vez1uWt42zplmru4Ch5MY05Bcbzu8C8ImyeRjhOjlmSEMIP7LcOc4Hd8NsVr_q3dlfMJq1AxIMaT2DpTa5ajtb8pqwIotkGuLWReCzf7IlArzVC2baegOPugE5C3PVifG11AjLxeQIW4YOrcfp8cw6iGnQgSLtg7o2bHXzdcw6ISK1Bg&sig=Cg0ArKJSzEOF_yPFH8nqEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1964&vt=11&dtpt=964&dett=3&cstd=987&cisv=r20230530.14505&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:38 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 01 Jun 2023 15:48:38 GMT

POST
H3 200 rs Show response
ad4m.at/ Frame 15E3 2 KB
2 KB 32ms
31ms XHR
text/plain 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/rs
Requested by: Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6a260fdbb6405281b014059ac437e8ac277e6be90b9c48dfc27a066434926586

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 01 Jun 2023 15:48:38 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=daHZkRlve6nzHDQHtHt9lwpMqGD3C5oybHmz4QrJ9wt4m000h2eYvgSPdf4snHGieHFQ5UccmzpACf6%2BmCjuPi%2Bmx8khtN5K2IS4sGiQmvrdxvkAOEB8A0PS1MeDa0KOajkFUI4%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain
access-control-allow-origin: https://as.ad4m.at
access-control-allow-credentials: true
cf-ray: 7d089a1c0ea2366f-FRA
x-backend-server: aa-reachservice-group-europe-west1-3zc0
alt-svc: h3=":443"; ma=86400

OPTIONS
H3 200 rs
ad4m.at/ Frame 0
0 340ms
27ms Preflight
text/plain 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/rs
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://as.ad4m.at
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET,PATCH,POST,OPTIONS,DELETE
access-control-allow-origin: https://as.ad4m.at
access-control-max-age: 1800
allow: HEAD,POST,GET,OPTIONS
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7d089a1bde60366f-FRA
content-length: 24
content-type: text/plain
date: Thu, 01 Jun 2023 15:48:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YTax%2FO0HMlGwOaccemlFC3g56z3BYXfem%2B7YfPS%2F%2BoNk5v6jmdtrtptQ00axZ6BmmixAOBXpusTAOdc54xJ%2Ba9FDzUFQC3DGHC0YGFzg7aKg9m8R40d0g5XUlhQdoWIO7jP%2Frf4%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
via: 1.1 google
x-backend-server: aa-reachservice-group-europe-west1-3zc0

POST
H3 200 rs Show response
ad4m.at/ Frame 5159 2 KB
2 KB 34ms
33ms XHR
text/plain 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/rs
Requested by: Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c9fa24d09b502ec6175411f638ba15168fee9b030fbc2595b20f99d2ee55101f

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 01 Jun 2023 15:48:38 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DgltJ5U25qPUSMgQJmDgVkPgl9Wd%2FhtcH92DU2vNMuvFIqHDqE2jwPHUgqo3DTqn5q4SbrDapCbFewg1Hvn0F8FvzYVYoAQwFJxom4ufTG4EW4VFHCEZ5uKX8ZQfEiAV6apenWk%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain
access-control-allow-origin: https://as.ad4m.at
access-control-allow-credentials: true
cf-ray: 7d089a1c0ea7366f-FRA
x-backend-server: aa-reachservice-group-europe-west1-nhd6
alt-svc: h3=":443"; ma=86400

OPTIONS
H3 200 rs
ad4m.at/ Frame 0
0 335ms
29ms Preflight
text/plain 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/rs
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://as.ad4m.at
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET,PATCH,POST,OPTIONS,DELETE
access-control-allow-origin: https://as.ad4m.at
access-control-max-age: 1800
allow: HEAD,POST,GET,OPTIONS
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7d089a1bde61366f-FRA
content-length: 24
content-type: text/plain
date: Thu, 01 Jun 2023 15:48:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kLgmNtM7qfMQ60uVKdlVwij95k06jB0JwgYhXSeS43Zyjwlh7hbwG%2Fosqa3rnNYyrCSgATdW4THWOxLeXIBzKqOnKBiJxCj0CptQ2p%2BNjVIfKGZXBGI8znKA4VYm7z7l6JHOUsM%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
via: 1.1 google
x-backend-server: aa-reachservice-group-europe-west1-3zc0

GET
H3 200 a6fc438daf2c8cc18f7294c60eb5597b.js Show response
s0.2mdn.net/sadbundle/3719878330380519815/ Frame 4C2F 57 KB
15 KB 39ms
39ms Script
application/x-javascript 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/3719878330380519815/a6fc438daf2c8cc18f7294c60eb5597b.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3719878330380519815/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4aecc48eb93fc11fa599dbf5ba5f0411c9a8dfdff8ea03764240c5d734d35665

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3719878330380519815/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 27 May 2023 23:10:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 405463
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15831
x-xss-protection: 0
last-modified: Fri, 02 Dec 2022 10:52:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 May 2024 23:10:55 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 95A8 22 KB
8 KB 38ms
38ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 151886
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 30 May 2023 21:37:12 GMT
expires: Wed, 29 May 2024 21:37:12 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 2F82 7 KB
6 KB 81ms
81ms XHR
application/json 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9dc1d97071526ddf7bb4870a17d9c821bcea1d57e736921533009d5c9ad0c97f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:38 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5735
x-xss-protection: 0

GET
H3 200 visual.jpg
s0.2mdn.net/sadbundle/11934569601524222564/img/ Frame 2F82 81 KB
81 KB 40ms
40ms Image
image/jpeg 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11934569601524222564/img/visual.jpg

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c07684aa8b5395431f3b243baad78a2ddac988833fed866fa18b7d9cb6e1fdce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11934569601524222564/index.html?e=69&leftOffset=0&topOffset=0&c=b4mNOqcYSi&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 27 May 2023 07:44:41 GMT
x-content-type-options: nosniff
age: 461037
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 82828
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 10:59:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 May 2024 07:44:41 GMT

GET
H3 200 overlay.png
s0.2mdn.net/sadbundle/11934569601524222564/img/ Frame 2F82 95 B
129 B 45ms
44ms Image
image/png 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11934569601524222564/img/overlay.png

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11934569601524222564/index.html?e=69&leftOffset=0&topOffset=0&c=b4mNOqcYSi&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 27 May 2023 08:27:34 GMT
x-content-type-options: nosniff
age: 458464
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 10:59:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 May 2024 08:27:34 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 8854 17 KB
6 KB 61ms
60ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 01 Jun 2023 15:48:38 GMT

GET
H2 200 IAS_PassbackAds_300x250.png
static.adsafeprotected.com/ Frame B82C 14 KB
14 KB 7ms
7ms Image
image/png 2600:9000:223f:2a00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/IAS_PassbackAds_300x250.png
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:2a00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f6adb794eda0e31a163ed517d8e63d388dbb762031a189349c72af2bc37bb4f2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

x-amz-version-id: 5gVOAFoF.BCvnrybv6D.a4lGJXzJNSyO
date: Mon, 29 May 2023 23:22:08 GMT
via: 1.1 02d68f3a4f2a3f8967c5e021dcd7f96a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 231991
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 14233
last-modified: Fri, 18 Feb 2022 23:28:59 GMT
server: AmazonS3
etag: "65a8b98b798ce416d94c2847aca40c71"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=604800
accept-ranges: bytes
x-amz-cf-id: rs7gcoTmIUKlTm5ekaMrlCcsoMojDIRroU-8HxhJ1P0dT0gN9w7qeg==

GET
H2 200 IAS_PassbackAds_300x250.png
static.adsafeprotected.com/ Frame 3327 14 KB
14 KB 8ms
7ms Image
image/png 2600:9000:223f:2a00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/IAS_PassbackAds_300x250.png
Requested by: Host: static.adsafeprotected.com
URL: https://static.adsafeprotected.com/passback_300x250.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:2a00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f6adb794eda0e31a163ed517d8e63d388dbb762031a189349c72af2bc37bb4f2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

x-amz-version-id: 5gVOAFoF.BCvnrybv6D.a4lGJXzJNSyO
date: Mon, 29 May 2023 23:22:08 GMT
via: 1.1 02d68f3a4f2a3f8967c5e021dcd7f96a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 231991
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 14233
last-modified: Fri, 18 Feb 2022 23:28:59 GMT
server: AmazonS3
etag: "65a8b98b798ce416d94c2847aca40c71"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=604800
accept-ranges: bytes
x-amz-cf-id: oe3GeHjAuHhS6iO9lXz3qYKrHoud7wa0eDb5uS5CrVgWeNYvebrKhQ==

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame D052 17 KB
6 KB 53ms
53ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 01 Jun 2023 15:48:38 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame D56B 43 B
216 B 108ms
106ms Image
image/gif 2600:1f18:1aca:4282:9f3c:fb6f:594b:b7a8
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=990511&asId=542a5b0c-463f-8735-94fc-54bfb4d3dc77&tv=%7Bc:eiMbFV,pingTime:-10,time:1186,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwwfHxNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTE0LjAuNTczNS45MCBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1685634518323%7C%7C18468e8f7cf8de0ec6e767cc8e2a2440%7C%7Ce2cb1dcbe7da8721e3ae9a3fd2b4449b%7C%7C02c99fc480b15338d3e70803ae07ac66%7C%7Cb52342ac5f4da239f736f65e806ee7ae%7C%7C28a0201375772bcf1e2c00b0febed926%7C%7C41ccb2da6f7dbf661cd3bbc45c1db421%7C%7Cf40bd9628cb8005903301d96be2266e3%7C%7C1663701684%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=250&slotname=2097210043&adk=239546933&adf=744370384&pi=t.ma~as.2097210043&w=300&lmt=1685634514&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685634514177&bpp=3&bdt=1740&idt=3&shv=r20230530&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D76ab65cad0aa0eff%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_Ma0_IwpMBOi7nj9-q6otQoNKDc7Aw&gpic=UID%3D00000c3a8e3515fd%3AT%3D1685634513%3ART%3D1685634513%3AS%3DALNI_MZpfKIRVVeVVB8cjAISCX5v7pmlrA&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280&nras=1&correlator=7472659638016&frm=20&pv=1&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=569&ady=3955&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31071756%2C31074966%2C42531705%2C44772269%2C44785293%2C44788442&oid=2&pvsid=2127257284742242&tmod=505944693&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=50&uci=a!1e&btvi=4&fsb=1&xpc=PCTYuyO1NN&p=https%3A//www.farfeshplus.online&dtd=7
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:9f3c:fb6f:594b:b7a8 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:38 GMT
server: nginx
x-server-name: dt04.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 congstarfont.woff2
s0.2mdn.net/creatives/assets/4234010/ Frame 8854 98 KB
98 KB 40ms
39ms Font
font/woff2 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4234010/congstarfont.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9548364509937149214/1676550659977.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d019867c120344469403527c7d958861b81d0fc873813c97ee135f707d74122

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/9548364509937149214/1676550659977.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:41:17 GMT
x-content-type-options: nosniff
age: 441
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100772
x-xss-protection: 0
last-modified: Thu, 05 Aug 2021 09:13:07 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 01 Jun 2023 15:56:17 GMT

GET
H3 200 86bef0b5-fa75-4ca3-8394-cb7b5a474a45-3.woff
s0.2mdn.net/creatives/assets/1881029/ Frame 8854 57 KB
57 KB 46ms
45ms Font
font/woff 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/1881029/86bef0b5-fa75-4ca3-8394-cb7b5a474a45-3.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9548364509937149214/1676550659977.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

853a8c7e34be5549a44fc541e13876f5c2838123142f527dab2265950feaeefb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/9548364509937149214/1676550659977.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:43:26 GMT
x-content-type-options: nosniff
age: 312
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58447
x-xss-protection: 0
last-modified: Wed, 15 Feb 2017 10:23:50 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 01 Jun 2023 15:58:26 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 2F82 17 KB
6 KB 50ms
50ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 01 Jun 2023 15:48:38 GMT

GET
H3 200 congstarfont.woff2
s0.2mdn.net/creatives/assets/4234010/ Frame D052 98 KB
98 KB 40ms
39ms Font
font/woff2 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4234010/congstarfont.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9548364509937149214/1676550659977.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d019867c120344469403527c7d958861b81d0fc873813c97ee135f707d74122

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/9548364509937149214/1676550659977.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:41:17 GMT
x-content-type-options: nosniff
age: 441
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100772
x-xss-protection: 0
last-modified: Thu, 05 Aug 2021 09:13:07 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 01 Jun 2023 15:56:17 GMT

GET
H3 200 86bef0b5-fa75-4ca3-8394-cb7b5a474a45-3.woff
s0.2mdn.net/creatives/assets/1881029/ Frame D052 57 KB
57 KB 45ms
44ms Font
font/woff 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/1881029/86bef0b5-fa75-4ca3-8394-cb7b5a474a45-3.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9548364509937149214/1676550659977.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

853a8c7e34be5549a44fc541e13876f5c2838123142f527dab2265950feaeefb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/9548364509937149214/1676550659977.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:43:26 GMT
x-content-type-options: nosniff
age: 312
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58447
x-xss-protection: 0
last-modified: Wed, 15 Feb 2017 10:23:50 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 01 Jun 2023 15:58:26 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 04AB 42 B
64 B 81ms
81ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsueSuuIe-xPVz4TLFVrLef6n6Q6D6TGcMPVnAhGMEjva6YGi3ZMKJrdIBWfykilQFY9nLGmv4OAxrmYWRZ_5EHU3tavnqztfkiXfADpke6cB-ByOGmJ0KHHod4L3NJl8RX2G3B8CQ&sai=AMfl-YT4lnXwEy5ctGiXJpqogWVz6-7w-k9cJSyn2mZpFW4UjsVWey5OmdTgLeHAfo5SrOV1JdXBC-B3qIFCb-IR1cE2nGJFrtUI37Y&sig=Cg0ArKJSzHX_hl8bKjInEAE&cid=CAQSKQBygQiD1eBBEsspmuVyIE65WOOfgo7E-pnyRRDVtJYA7i6rT2RbQiwfGAE&id=lidar2&mcvt=1102&p=0,0,90,728&mtos=1102,1102,1102,1102,1102&tos=1102,0,0,0,0&v=20230531&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2966895748&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1685634513717&rpt=3606&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 rar Show response
as.ad4m.at/ad/ Frame A309 10 KB
4 KB 29ms
29ms Document
text/html 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://as.ad4m.at/ad/rar?a=14019%2C23576%2C19491&b=V8Xuwfr7H1zMSVHbHAtRtE9bhkTzT46hQ%2CYX1Hrf15spBpHVH9HetQtRR8cAT1T6mHr%2C9M1SMfKMtxEpSKHBH2t7trrqswTmTxVcd&f=m8ruefe8CweqsmHZHZtQCJGjTDTwT6rHA%2CqDRUmfD7H757CZHgHDtRCXXxaPTgTVZF3%2C1YRCbf7QTqBbt9HdH9tpC22XcRTKTXEhA&c=728&d=90&e=&g=90b279cc21b091d7e9f27a888d15b526%2F15577666206258245879&i=21596%2C20774%2C20773&j=16%2C14%2C14&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach13_BlackFridayPush&r=1685634518395&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1gg6p9y9pynase92cgrvvmy6t36t49ktx8rd15cx7eeznb65aexpwjnfkesdb3pzf1h38jhtjy5ajxyt1jm04y7zjtv24b7afxsdwwa7t25pq0nfe7n0th6bb1q6w4f9ztezr2nxx28x5mygzs7jz5s8bhgek5dtmy411whjm0m8crpm5v816bnkbtr22vvmsxjh384gpck61zgwp9bv3z42zx3v8sy8hqtp8qqrq1gn14ndsnnz2fb2mj7wrhgv36kkwbcj7qjqsqh7vpdg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCCCyU0r14ZJfsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSAAk_Q8ZBoeXcmdFs3Ne4A0BVHUHpRZOO5PUF8yj21nYvXGukTSVcmJikWDTTdzUDA6tjuYC_T0lMUYcsxvmJNSTXR1k3ustgfuZjkC6gzl4cbT29hO_ApbYH3NUKYpksZBvgNwA8hvm7gcIHysBOKG1CyxwkMVn3_AznTZl1sh-cWEbMnK2kaeT7j1fwtgUh6a8nOjdoqKEMysTZzHC-GT285wF9nl5s-MsqMa7Mglc_e4SdtaF60jUbSkjg-IuO3YB2XMHX4PuHDh-LF2f2Z5BJf7wvqLIxpQxP71tlVo9vLLGMQC6xVaLfKssXaR3RZqKLEllauAfCiVAgbbOJ559rgBAGABoKGjrL8sNmW-gGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_2GfKMz1UzIkeSOzxonQ5Fzpyt4Nw%2526client%253Dca-pub-6266313190087173%2526adurl%253D&y=1&s=&z=0

Requested by

Host: ad4m.at
URL: https://ad4m.at/r62eglto.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

69f13ac6aaf94edb645e4b85c15afb6baefa7a950c0a3544898a5912567bcf41

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri ;child-src ;connect-src ;default-src 'self';font-src ;form-action 'none';frame-src ;img-src data:;manifest-src 'none';media-src 'none';object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
Strict-Transport-Security	max-age=86400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://as.ad4m.at/ad/dr?ed=1ka4wtq451qwgm2tsq44kt1smd54xphn92s7pd06j2mxcjyp5qbeb2k5s77gy8v8fwgw5mqf0qztb11j0qr2amrfptf1rp48tg17z095dsfadg167m78xyp05eh6w4zd2zqa6q44v4sh88vgjanqt7j5bkxyad8wtgq9wxz48b8p4qs7nz1pgnkmrww4zvntp0qjanyh2gypttzekawmenxf0dkettd2twyc4f52bdnh74ya27t3f5fzvqvpf3vap4tswe7sjkdbsr3ah1qt2sxt90ap2n7qemtnxm21twnptme90xqsnfn8t6v2bsasq53mg4p41rcy9d31sdm2vynrh3jk6y6vgvt100fgfar7ayf8thbrntwewzn86111zcfrvv1rj5e0cr3g6cnt9qvgbfy0f9knhpbvesjp7h46h55b3kk0&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCCCyU0r14ZJfsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSAAk_Q8ZBoeXcmdFs3Ne4A0BVHUHpRZOO5PUF8yj21nYvXGukTSVcmJikWDTTdzUDA6tjuYC_T0lMUYcsxvmJNSTXR1k3ustgfuZjkC6gzl4cbT29hO_ApbYH3NUKYpksZBvgNwA8hvm7gcIHysBOKG1CyxwkMVn3_AznTZl1sh-cWEbMnK2kaeT7j1fwtgUh6a8nOjdoqKEMysTZzHC-GT285wF9nl5s-MsqMa7Mglc_e4SdtaF60jUbSkjg-IuO3YB2XMHX4PuHDh-LF2f2Z5BJf7wvqLIxpQxP71tlVo9vLLGMQC6xVaLfKssXaR3RZqKLEllauAfCiVAgbbOJ559rgBAGABoKGjrL8sNmW-gGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2GfKMz1UzIkeSOzxonQ5Fzpyt4Nw%26client%3Dca-pub-6266313190087173%26adurl%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
cf-cache-status: DYNAMIC
cf-ray: 7d089a1ccf113a86-FRA
content-encoding: br
content-security-policy: block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-src *;img-src * data:;manifest-src 'none';media-src 'none';object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: unsafe-none
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
date: Thu, 01 Jun 2023 15:48:38 GMT
expires: 0
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
pragma: no-cache
referrer-policy: same-origin
report-to: {"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
server: cloudflare
strict-transport-security: max-age=86400; includeSubDomains; preload
surrogate-control: no-store
vary: accept-encoding
via: 1.1 google
x-content-type-options: nosniff
x-download-options: noopen
x-xss-protection: 1; mode=block

GET
H3 200 rar Show response
as.ad4m.at/ad/ Frame 170B 11 KB
4 KB 34ms
33ms Document
text/html 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://as.ad4m.at/ad/rar?a=197862%2C117569%2C19769&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb%2Ck7Vh5f3fD2kYa4HwHetBtxPrtZSjTm3baj7m6%2CppXa1fgfpAwfkH4HmtztQJjt9SRT8WwUAQkr&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW%2CzR7CRfYfk3KMFpHBHMtJC9dGtVSwTQ2GCrp6Y%2CJgKFzf5fqjZhBH6H7tqCpKbTxSgT4MetAmKM&c=120&d=600&e=&g=bf2746ad64922df92a36517ba080fc4b%2F8248446331798415938&i=71725%2C29981%2C21630&j=21%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1685634518397&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1gsk73xr5717r3wt02p6v5vnh8v4zfmeq2c3gje788bjbhnszfrpxvjm81g7cc2nz255te93ryjj3kkmb68f358f0fnb1mgsmydtmbybmfgwnvkgy444hkm6c0574f6d8dfa6d9axzb9bbhy2b4swp4frknkafrkn9n43an3y1z0yp9sptq7qtnz5cwwsz6tfxnq8g16xq2b4dvp3pcvd2cnmxj4tk8d289hvy768qxehyyfwmr12t16gvqveyvvqqhapqya6e14zk74a3cesw0qa4%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCCzdZ0r14ZJbsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSFAk_QkVhoMQF4FpBrIh4d_96t1lo09_NWbzPp7lG2tQI1aWW3_PxR-4R65_zMorz3LWfRQrcsCPUaIA2XX7K-G1udF6GXISECHtnW1HzPwS2P3v60f0rjsTuCL5MNBCGVDoIwH8AdY_4-d04CAkB5k6_Q_f3vLUHqmJL0Rq5dAkMg4dXI6Ij18GFU6IJCjm75kqw7xbXLWMT2m8_oZMYEAF_3aup20TBrcjEvR0_ralHmbmW96sJFKyotV20HZEGrcHgQv3Mz03HSQKCmdOGr7X_yZSNIHfh6xvZF77TbMSba4fT0wxgn49TyLTAymCgQnooOiMopABV8b9IH-4ihdaWhTf-WyeAEAYAGtoyOx-LazYXwAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_0GPRMhVzuVGjgwiOiV0pp-xeC9fg%2526client%253Dca-pub-6266313190087173%2526adurl%253D&y=1&s=&z=0

Requested by

Host: ad4m.at
URL: https://ad4m.at/r62eglto.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b170c796d4f3f23f3687801ea504a42a214cb28c14392232be106a592017ed21

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri ;child-src ;connect-src ;default-src 'self';font-src ;form-action 'none';frame-src ;img-src data:;manifest-src 'none';media-src 'none';object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
Strict-Transport-Security	max-age=86400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://as.ad4m.at/ad/dr?ed=1j4nxee5yn1y54qbtfgqartwnavzg4vaj04rbfh7dmb193kpmt74az5869kbe173jnxj81a41xjhe95zczqz4wdv11qtq2s0nv6w24z5c1mnbf81tvs4ret8ygnb6504x0efb20195c7a3g6w7a2308taxvwxq6xd7scq0gy92dewabf9zx04qp0wfp422wabr7nw77evefhp9g10vj1bbgyxdwm2egyy1kjzpwjztd0jzn1qfrt019339atqtkevvs8na6gtj9j08a7xyw14f4e1zs2aspd2tc38kfqef3x7bycggazz8ecfrj248vv9evmswdd3s4h9fefasjnagtqgxxf9p6s67f83qjjk6c1zpevpysxgch2xch51zkmg57bch2g0grdvy98tzzkwfvbp1ngqrkmpgcc1penx9db17vjvwy0tdrn3qmvv0gffsyxxhk40hhg&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCCzdZ0r14ZJbsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSFAk_QkVhoMQF4FpBrIh4d_96t1lo09_NWbzPp7lG2tQI1aWW3_PxR-4R65_zMorz3LWfRQrcsCPUaIA2XX7K-G1udF6GXISECHtnW1HzPwS2P3v60f0rjsTuCL5MNBCGVDoIwH8AdY_4-d04CAkB5k6_Q_f3vLUHqmJL0Rq5dAkMg4dXI6Ij18GFU6IJCjm75kqw7xbXLWMT2m8_oZMYEAF_3aup20TBrcjEvR0_ralHmbmW96sJFKyotV20HZEGrcHgQv3Mz03HSQKCmdOGr7X_yZSNIHfh6xvZF77TbMSba4fT0wxgn49TyLTAymCgQnooOiMopABV8b9IH-4ihdaWhTf-WyeAEAYAGtoyOx-LazYXwAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0GPRMhVzuVGjgwiOiV0pp-xeC9fg%26client%3Dca-pub-6266313190087173%26adurl%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
cf-cache-status: DYNAMIC
cf-ray: 7d089a1cdf313a86-FRA
content-encoding: br
content-security-policy: block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-src *;img-src * data:;manifest-src 'none';media-src 'none';object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: unsafe-none
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
date: Thu, 01 Jun 2023 15:48:38 GMT
expires: 0
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
pragma: no-cache
referrer-policy: same-origin
report-to: {"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
server: cloudflare
strict-transport-security: max-age=86400; includeSubDomains; preload
surrogate-control: no-store
vary: accept-encoding
via: 1.1 google
x-content-type-options: nosniff
x-download-options: noopen
x-xss-protection: 1; mode=block

GET
H3 200 9881d7df0b300d92200ebcbe31ea57a7.svg
s0.2mdn.net/sadbundle/3719878330380519815/media/ Frame 4C2F 2 KB
798 B 41ms
40ms Image
image/svg+xml 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3719878330380519815/media/9881d7df0b300d92200ebcbe31ea57a7.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3719878330380519815/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8537b6920d550414d47001cd97c0f4b41d76bdc02f0eaeffef3c1a213212fa78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3719878330380519815/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 18:56:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 161543
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 761
x-xss-protection: 0
last-modified: Fri, 02 Dec 2022 10:52:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 May 2024 18:56:15 GMT

GET
H3 200 9e367d9ca52b2883318fb1e1c39ab87d.svg
s0.2mdn.net/sadbundle/3719878330380519815/media/ Frame 4C2F 15 KB
5 KB 42ms
42ms Image
image/svg+xml 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3719878330380519815/media/9e367d9ca52b2883318fb1e1c39ab87d.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3719878330380519815/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4ea64495655ae219e4344811df78aea0b0dbc6314f9346c9b0b253645a1eaf69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3719878330380519815/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 27 May 2023 17:24:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 426230
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5107
x-xss-protection: 0
last-modified: Fri, 02 Dec 2022 10:52:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 May 2024 17:24:48 GMT

GET
H3 200 ac4848f5dbf9aff1f6f13ddd9583fb81.svg
s0.2mdn.net/sadbundle/3719878330380519815/media/ Frame 4C2F 13 KB
4 KB 41ms
41ms Image
image/svg+xml 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3719878330380519815/media/ac4848f5dbf9aff1f6f13ddd9583fb81.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3719878330380519815/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

63faa8b7384c37c4834b77615586404ad7d7591d5ab8ac0c50c2b10470b35b0b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3719878330380519815/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 27 May 2023 10:57:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 449445
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4549
x-xss-protection: 0
last-modified: Fri, 02 Dec 2022 10:52:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 May 2024 10:57:53 GMT

GET
H3 200 79f6af56d394a5779ddbeba9fddb96bf.svg
s0.2mdn.net/sadbundle/3719878330380519815/media/ Frame 4C2F 7 KB
2 KB 42ms
41ms Image
image/svg+xml 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3719878330380519815/media/79f6af56d394a5779ddbeba9fddb96bf.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3719878330380519815/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3a92255192d67c0139d64b7fe64aef88c46f48b2d1c3fbf9d6eb8aaae4adce24

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3719878330380519815/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 27 May 2023 16:06:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 430947
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1767
x-xss-protection: 0
last-modified: Fri, 02 Dec 2022 10:52:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 May 2024 16:06:11 GMT

GET
H3 200 WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js Show response
pagead2.googlesyndication.com/bg/ Frame 95A8 37 KB
14 KB 36ms
35ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ae70268abe00d0f5f9a58ce23f5af80fd5f8d9e8b5a647855901f5321cbd23a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:09:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5939
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 31 May 2024 14:09:39 GMT

POST
H3 204 collect
region1.google-analytics.com/g/ 0
17 B 24ms
24ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-DNX5KLEBSB&gtm=45je35v0&_p=222057478&cid=1858218578.1685634513&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AEA&_s=2&sid=1685634513&sct=1&seg=0&dl=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&dt=Farfeshplus.online%20%7C%20%D9%85%D9%88%D9%82%D8%B9%20%D9%81%D8%B1%D9%81%D8%B4%20-%20%D8%B4%D8%A7%D9%87%D8%AF%20%D9%85%D8%AC%D8%A7%D9%86%D9%8A%20%D8%A3%D8%AD%D8%AF%D8%AB%20%D9%85%D8%B3%D9%84%D8%B3%D9%84%D8%A7%D8%AA%20%D8%B1%D9%85%D8%B6%D8%A7%D9%86%202023&en=scroll&epn.percent_scrolled=90&_et=140
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-DNX5KLEBSB
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:38 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.farfeshplus.online
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js Show response
pagead2.googlesyndication.com/bg/ Frame 53B4 37 KB
14 KB 36ms
35ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ae70268abe00d0f5f9a58ce23f5af80fd5f8d9e8b5a647855901f5321cbd23a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:09:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5939
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 31 May 2024 14:09:39 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8AD6 0
22 B 68ms
68ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=9600816059473&version=m202301230201&ct=76&x=1&cor=10833528017972093000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js Show response
pagead2.googlesyndication.com/bg/ Frame F5BE 37 KB
14 KB 36ms
35ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ae70268abe00d0f5f9a58ce23f5af80fd5f8d9e8b5a647855901f5321cbd23a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:09:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5939
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 31 May 2024 14:09:39 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame D56B 0
0 82ms
81ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsucsMUWRx28Fv_RdCichOYXEM8dCDheOTlKjBmQuMcwKMwjUhYGgaLqgShLbS1BASllJGqighDvnZVZKa__zIWWZT7WgCOr9yF8M8yuvK7goZ79TLm_U77wre1oLw6oOheSrziNsSnDx5iS3Eg8sPMvUvCo9pi96aRLUOh0tkKCDaCRN0I1x-rPzJCAGxpeCOhgd75TLgt3yUfLROmDdMjupTaAk5FK16WAllDKi-FkjJBwQHZJrmjSF13U2L31-AFdU9FxDzCM_BiFAjBzFOq3uqRxyVlDRWPp1RjYYK7C91To0NPgdaRYcXkq89DAlNGlwauX4GwFOAhxA5fYHg8yAT8JtRbZWZcsGSljZ8h0NEj7TjP8AAS3Y-qUWOHfUKb4C-ESXxrrMZLScW9nWPtzOXLd7EU1-2U0uX9btixl1jg__7Xmw-N0hvEOeLgnJaVf3yHO_XXOCMdQTE-Dkz0X5OLVVMu8rK-WwMWC007lNHmeYElQCMSx8CAWCUEk9NZwIOp3X8n8I9ChaQoZWTTsnYF0GM_DUlDymFN569UFKLy4jQIHNOXfSEGFFav5nhqEhsrMFStHGzeOHtSgc73pBoHZ17xbzpntol0SJeJB3DJrj6kpivxK_gxWZpV88zo4jqoHpUNU0rWV4utAvV4Lzme88p9Gi7VvjI2sN9Yfx06mXXCo0JwRJydp2HAcv0PeUpiVGxANQFkO2-4-AS4lsG8rWwuidVUDoma5CwE7YhG1ToOKhLzKxgiR0jN9k_DIcOvYE-jGpS2Fi0jyhAfJkEPMQ2BzfYeM27hLYX2Rm7ooPro-EkEmdhBpC0LP0UlZjoD9598oX5oThVv80dJ1YSvF_bAYrNWIU3w7QLgx4MUAxks4J2ZetaE3Ixbjtfv6wngQ_k5KtdzqL7TknQ4KyrQSnl1MQDg8_U6BcPNFRuk14UTczNetGyCXekPt5rFDRCs6GMHZDbTNN_03yxRzpMeb5o4zegwksGroIqXayxB6kjMWGFPjlN76vJ17g6LkecNwic70ow4o-Bg5hy-aPkfAqVDLXwYmSB4vi0kad1nI9giGVG53Ky21dajHO_uk3XMh3cv3NU4K2Zw990rWL_pmyn1IgbvDajh-OOygIN-zUQ3kiTC6RlQK35emLqBUzTvEJOR5TCJlhILgUB0uAhZYWcEsdkK1UGxPRB12MwfCoaMFk6IgrpjcYPtqhQj0YXLd5y9VBsb9HawfGYajynelpXeBSW7YVGgAX1UOvQ-v1O1GGnWFWAejo3SrOr5s44e-Yk3jIVAp4zPKxJoMTkvRiJz6tp6PyOHGd0jg0h-9V_DWJ0-sHU_AfXwwjM0yv4ymISAmJa2G&sai=AMfl-YQ3tjmSaqLL4E686nJB2yIYQfTUut4NSCvn91inUz-kiDb2qadrnVO3VKaZWHTwLwl1KNYr2WW-6OrNxhdX0702oP_zkuLnf1re2a7587hyYTbcDmA3gEtFLi6F0uYWGqotg6ReyMSFRkaQOF5DutC1xEcGeSpm7DNy8R20CsneK91DaIc45Cl1CyUvwkCnvRyYUkGn5QObDFLnuOi07RTvdhjU8faycgZhKBP99F02lE5AYhJrO0F_eiP7VQpreA3k&sig=Cg0ArKJSzBIsDsC3JNPuEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2561&vt=11&dtpt=1135&dett=4&cstd=1424&cisv=r20230530.43834&vwbs=2&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a92-123-148-9.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:38 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 01 Jun 2023 15:48:38 GMT

GET
H3 200 04042023-000350227-1456_180_h_1050x2340_2210-anf-l85703e77-0538-46ec-8f60-0a9a3315aa4f.png
s0.2mdn.net/4528404/ Frame 8854 19 KB
19 KB 45ms
45ms Image
image/png 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/04042023-000350227-1456_180_h_1050x2340_2210-anf-l85703e77-0538-46ec-8f60-0a9a3315aa4f.png

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fd8f0d82a2ed1ddf739a0de26cf5e5b22cf04e448a111ab3f02821760f6a0669

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/9548364509937149214/index.html?e=69&leftOffset=0&topOffset=0&c=bnyTc2AwWf&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:27:06 GMT
x-content-type-options: nosniff
age: 4892
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19287
x-xss-protection: 0
last-modified: Tue, 04 Apr 2023 07:03:50 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 02 Jun 2023 14:27:06 GMT

GET
H3 200 03032023-031527201-1456_180_720x610_stoerer-gbplusdd45da6a-b9ac-4a7c-9506-d902c6e1e866.png
s0.2mdn.net/4528404/ Frame 8854 31 KB
31 KB 46ms
45ms Image
image/png 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/03032023-031527201-1456_180_720x610_stoerer-gbplusdd45da6a-b9ac-4a7c-9506-d902c6e1e866.png

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ebaa028e53ceb3896c63bfbdb52a422b2419be96e936f7416a4aea330e69010c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/9548364509937149214/index.html?e=69&leftOffset=0&topOffset=0&c=bnyTc2AwWf&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:46:53 GMT
x-content-type-options: nosniff
age: 3705
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32039
x-xss-protection: 0
last-modified: Fri, 03 Mar 2023 11:15:27 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 02 Jun 2023 14:46:53 GMT

GET
H3 200 default.css
as.ad4m.at/ad/style/0.1.40/one-ad/ Frame A309 103 KB
13 KB 29ms
29ms Stylesheet
text/css 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://as.ad4m.at/ad/style/0.1.40/one-ad/default.css
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=14019%2C23576%2C19491&b=V8Xuwfr7H1zMSVHbHAtRtE9bhkTzT46hQ%2CYX1Hrf15spBpHVH9HetQtRR8cAT1T6mHr%2C9M1SMfKMtxEpSKHBH2t7trrqswTmTxVcd&f=m8ruefe8CweqsmHZHZtQCJGjTDTwT6rHA%2CqDRUmfD7H757CZHgHDtRCXXxaPTgTVZF3%2C1YRCbf7QTqBbt9HdH9tpC22XcRTKTXEhA&c=728&d=90&e=&g=90b279cc21b091d7e9f27a888d15b526%2F15577666206258245879&i=21596%2C20774%2C20773&j=16%2C14%2C14&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach13_BlackFridayPush&r=1685634518395&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1gg6p9y9pynase92cgrvvmy6t36t49ktx8rd15cx7eeznb65aexpwjnfkesdb3pzf1h38jhtjy5ajxyt1jm04y7zjtv24b7afxsdwwa7t25pq0nfe7n0th6bb1q6w4f9ztezr2nxx28x5mygzs7jz5s8bhgek5dtmy411whjm0m8crpm5v816bnkbtr22vvmsxjh384gpck61zgwp9bv3z42zx3v8sy8hqtp8qqrq1gn14ndsnnz2fb2mj7wrhgv36kkwbcj7qjqsqh7vpdg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCCCyU0r14ZJfsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSAAk_Q8ZBoeXcmdFs3Ne4A0BVHUHpRZOO5PUF8yj21nYvXGukTSVcmJikWDTTdzUDA6tjuYC_T0lMUYcsxvmJNSTXR1k3ustgfuZjkC6gzl4cbT29hO_ApbYH3NUKYpksZBvgNwA8hvm7gcIHysBOKG1CyxwkMVn3_AznTZl1sh-cWEbMnK2kaeT7j1fwtgUh6a8nOjdoqKEMysTZzHC-GT285wF9nl5s-MsqMa7Mglc_e4SdtaF60jUbSkjg-IuO3YB2XMHX4PuHDh-LF2f2Z5BJf7wvqLIxpQxP71tlVo9vLLGMQC6xVaLfKssXaR3RZqKLEllauAfCiVAgbbOJ559rgBAGABoKGjrL8sNmW-gGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_2GfKMz1UzIkeSOzxonQ5Fzpyt4Nw%2526client%253Dca-pub-6266313190087173%2526adurl%253D&y=1&s=&z=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d77b5f2ca03eb8dab2acc515548b7b1ce7eeb4ca2189268552649e0391ee8c21

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.ad4m.at/ad/rar?a=14019%2C23576%2C19491&b=V8Xuwfr7H1zMSVHbHAtRtE9bhkTzT46hQ%2CYX1Hrf15spBpHVH9HetQtRR8cAT1T6mHr%2C9M1SMfKMtxEpSKHBH2t7trrqswTmTxVcd&f=m8ruefe8CweqsmHZHZtQCJGjTDTwT6rHA%2CqDRUmfD7H757CZHgHDtRCXXxaPTgTVZF3%2C1YRCbf7QTqBbt9HdH9tpC22XcRTKTXEhA&c=728&d=90&e=&g=90b279cc21b091d7e9f27a888d15b526%2F15577666206258245879&i=21596%2C20774%2C20773&j=16%2C14%2C14&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach13_BlackFridayPush&r=1685634518395&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1gg6p9y9pynase92cgrvvmy6t36t49ktx8rd15cx7eeznb65aexpwjnfkesdb3pzf1h38jhtjy5ajxyt1jm04y7zjtv24b7afxsdwwa7t25pq0nfe7n0th6bb1q6w4f9ztezr2nxx28x5mygzs7jz5s8bhgek5dtmy411whjm0m8crpm5v816bnkbtr22vvmsxjh384gpck61zgwp9bv3z42zx3v8sy8hqtp8qqrq1gn14ndsnnz2fb2mj7wrhgv36kkwbcj7qjqsqh7vpdg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCCCyU0r14ZJfsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSAAk_Q8ZBoeXcmdFs3Ne4A0BVHUHpRZOO5PUF8yj21nYvXGukTSVcmJikWDTTdzUDA6tjuYC_T0lMUYcsxvmJNSTXR1k3ustgfuZjkC6gzl4cbT29hO_ApbYH3NUKYpksZBvgNwA8hvm7gcIHysBOKG1CyxwkMVn3_AznTZl1sh-cWEbMnK2kaeT7j1fwtgUh6a8nOjdoqKEMysTZzHC-GT285wF9nl5s-MsqMa7Mglc_e4SdtaF60jUbSkjg-IuO3YB2XMHX4PuHDh-LF2f2Z5BJf7wvqLIxpQxP71tlVo9vLLGMQC6xVaLfKssXaR3RZqKLEllauAfCiVAgbbOJ559rgBAGABoKGjrL8sNmW-gGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_2GfKMz1UzIkeSOzxonQ5Fzpyt4Nw%2526client%253Dca-pub-6266313190087173%2526adurl%253D&y=1&s=&z=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:38 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-meta-goog-reserved-file-mtime: 1683559916
age: 598112
cf-polished: origSize=105839
x-guploader-uploadid: ADPycdv9IJsM9Nda_T-YCF8tGjLSR9_5GyrPWBCiXo7o_2KPFa29jeIDurPOQJdzBat54FnfGmUqvpjJPo5BCE2ydDX2ig
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Mon, 08 May 2023 15:32:28 GMT
server: cloudflare
etag: W/"44fa96b813e145cb8b915ae1fb6a3b7a"
vary: Accept-Encoding
x-goog-generation: 1683559948253618
content-type: text/css
x-goog-hash: crc32c=FELYSw==, md5=RPqWuBPhRcuLkVrh+2o7eg==
cache-control: public, max-age=3600
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y0F%2BUUp9aunjAwH5oXWp62xI6o8ivhN9WEzvtIDO0bKSskGs8aWXkQNde1l%2FiL7%2BvFjyMRH0Q4iCJRYfKqDig%2BjVqsApeoBrI0%2FS83F6SvKvcTs26JNzaYVIMZFasufoFWUWT87Oz6k%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 105839
cf-ray: 7d089a1d789b3a86-FRA
expires: Thu, 01 Jun 2023 16:48:38 GMT

GET
H2 200 762E992A001272DDC355514B76DC4960DDF6238B0F54854C0B29BE64A7E78BA5693E54C1A602322E523834805FE15471ECC3FEB06D9A02796A930A4085F71F84
assets.ad4m.at/logo/ Frame A309 44 KB
44 KB 33ms
15ms Image
image/webp 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/762E992A001272DDC355514B76DC4960DDF6238B0F54854C0B29BE64A7E78BA5693E54C1A602322E523834805FE15471ECC3FEB06D9A02796A930A4085F71F84
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=14019%2C23576%2C19491&b=V8Xuwfr7H1zMSVHbHAtRtE9bhkTzT46hQ%2CYX1Hrf15spBpHVH9HetQtRR8cAT1T6mHr%2C9M1SMfKMtxEpSKHBH2t7trrqswTmTxVcd&f=m8ruefe8CweqsmHZHZtQCJGjTDTwT6rHA%2CqDRUmfD7H757CZHgHDtRCXXxaPTgTVZF3%2C1YRCbf7QTqBbt9HdH9tpC22XcRTKTXEhA&c=728&d=90&e=&g=90b279cc21b091d7e9f27a888d15b526%2F15577666206258245879&i=21596%2C20774%2C20773&j=16%2C14%2C14&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach13_BlackFridayPush&r=1685634518395&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1gg6p9y9pynase92cgrvvmy6t36t49ktx8rd15cx7eeznb65aexpwjnfkesdb3pzf1h38jhtjy5ajxyt1jm04y7zjtv24b7afxsdwwa7t25pq0nfe7n0th6bb1q6w4f9ztezr2nxx28x5mygzs7jz5s8bhgek5dtmy411whjm0m8crpm5v816bnkbtr22vvmsxjh384gpck61zgwp9bv3z42zx3v8sy8hqtp8qqrq1gn14ndsnnz2fb2mj7wrhgv36kkwbcj7qjqsqh7vpdg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCCCyU0r14ZJfsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSAAk_Q8ZBoeXcmdFs3Ne4A0BVHUHpRZOO5PUF8yj21nYvXGukTSVcmJikWDTTdzUDA6tjuYC_T0lMUYcsxvmJNSTXR1k3ustgfuZjkC6gzl4cbT29hO_ApbYH3NUKYpksZBvgNwA8hvm7gcIHysBOKG1CyxwkMVn3_AznTZl1sh-cWEbMnK2kaeT7j1fwtgUh6a8nOjdoqKEMysTZzHC-GT285wF9nl5s-MsqMa7Mglc_e4SdtaF60jUbSkjg-IuO3YB2XMHX4PuHDh-LF2f2Z5BJf7wvqLIxpQxP71tlVo9vLLGMQC6xVaLfKssXaR3RZqKLEllauAfCiVAgbbOJ559rgBAGABoKGjrL8sNmW-gGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_2GfKMz1UzIkeSOzxonQ5Fzpyt4Nw%2526client%253Dca-pub-6266313190087173%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ffae8fb9199235cf70171d14a964159b4eda2da695a258c2586de98e3cb27bb2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:38 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1355812
cf-polished: origFmt=png, origSize=65187
alt-svc: h3=":443"; ma=86400
content-length: 44710
cf-bgj: imgq:85,h2pri
last-modified: Tue, 17 Jan 2023 14:45:52 GMT
server: cloudflare
etag: "99941d3864a6d6ef01023c96e0475815"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=o2xMOY9QCC%2BMpwnRpnjTY1A3WIy0mcQW76vDbqIOxD%2Fd8FyQWW%2B7QSZZe%2Boxy%2BB7Hu%2FI%2BRKoMKnEKzSYpx6iL6OTqOMJfk5rU%2Fj86uEBA6wHExdb3uX9bSVAqlu2xVkJ%2BPLRubs6SEb%2BKZ8c"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7d089a1d9993bb65-FRA
expires: Fri, 02 Jun 2023 15:48:38 GMT

GET
H3 200 EC9093D4AF3799CF781B1E590A25D192F3BFBB8EF4C33117758FB5ADF524B34A287AF80FDD08D80A46541DEAE1FFA692B6F4CA688E7C199182253AEB01A2863C
assets.ad4m.at/product_image/ Frame A309 222 KB
222 KB 20ms
19ms Image
image/webp 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/product_image/EC9093D4AF3799CF781B1E590A25D192F3BFBB8EF4C33117758FB5ADF524B34A287AF80FDD08D80A46541DEAE1FFA692B6F4CA688E7C199182253AEB01A2863C
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=14019%2C23576%2C19491&b=V8Xuwfr7H1zMSVHbHAtRtE9bhkTzT46hQ%2CYX1Hrf15spBpHVH9HetQtRR8cAT1T6mHr%2C9M1SMfKMtxEpSKHBH2t7trrqswTmTxVcd&f=m8ruefe8CweqsmHZHZtQCJGjTDTwT6rHA%2CqDRUmfD7H757CZHgHDtRCXXxaPTgTVZF3%2C1YRCbf7QTqBbt9HdH9tpC22XcRTKTXEhA&c=728&d=90&e=&g=90b279cc21b091d7e9f27a888d15b526%2F15577666206258245879&i=21596%2C20774%2C20773&j=16%2C14%2C14&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach13_BlackFridayPush&r=1685634518395&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1gg6p9y9pynase92cgrvvmy6t36t49ktx8rd15cx7eeznb65aexpwjnfkesdb3pzf1h38jhtjy5ajxyt1jm04y7zjtv24b7afxsdwwa7t25pq0nfe7n0th6bb1q6w4f9ztezr2nxx28x5mygzs7jz5s8bhgek5dtmy411whjm0m8crpm5v816bnkbtr22vvmsxjh384gpck61zgwp9bv3z42zx3v8sy8hqtp8qqrq1gn14ndsnnz2fb2mj7wrhgv36kkwbcj7qjqsqh7vpdg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCCCyU0r14ZJfsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSAAk_Q8ZBoeXcmdFs3Ne4A0BVHUHpRZOO5PUF8yj21nYvXGukTSVcmJikWDTTdzUDA6tjuYC_T0lMUYcsxvmJNSTXR1k3ustgfuZjkC6gzl4cbT29hO_ApbYH3NUKYpksZBvgNwA8hvm7gcIHysBOKG1CyxwkMVn3_AznTZl1sh-cWEbMnK2kaeT7j1fwtgUh6a8nOjdoqKEMysTZzHC-GT285wF9nl5s-MsqMa7Mglc_e4SdtaF60jUbSkjg-IuO3YB2XMHX4PuHDh-LF2f2Z5BJf7wvqLIxpQxP71tlVo9vLLGMQC6xVaLfKssXaR3RZqKLEllauAfCiVAgbbOJ559rgBAGABoKGjrL8sNmW-gGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_2GfKMz1UzIkeSOzxonQ5Fzpyt4Nw%2526client%253Dca-pub-6266313190087173%2526adurl%253D&y=1&s=&z=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 41b9b9d488e3a57902a671111dd089363c2f7d3a41ec3177f196abbb7cbac078

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:38 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 852116
cf-polished: origFmt=png, origSize=342797
alt-svc: h3=":443"; ma=86400
content-length: 226916
cf-bgj: imgq:85,h2pri
last-modified: Wed, 15 Jun 2022 14:01:11 GMT
server: cloudflare
etag: "82c7de0f42ff55fdd0acc07731664031"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MWOnTohYEUZVpMiMuI%2BA%2F5OBiTM9t5L5X%2F99gIEdsQpky22vylgfq7FdHqnoJG19IimMRIfKLVhpo1FUfVBP63ZqgEzplkPNKkUhvodSeszQ57TB3qI4AVpb4jnCMY4oGNFTxBrsSh9vO3wl"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7d089a1de97d3a86-FRA
expires: Fri, 02 Jun 2023 15:48:38 GMT

GET
H2

200

ztpv.php
www.conrad.de/ Frame A309
Redirect Chain

https://www.awin1.com/cshow.php?s=2470185&v=11354&q=377129&r=412871&pv=1&pref3=oneidV8Xuwfr7H1zMSVHbHAtRtE9bhkTzT46hQoneid__suite_Netmix_Reach13_BlackFridayPush&gdpr_consent=&gdpr=0&gdpr_pd=0
https://www.conrad.de/ztpv.php?awc=11354_412871_1685634518_c6a3cc40-0093-11ee-89a2-223974343f8d&insert=AW&&gdpr=0&gdpr_consent=

0
474 B

56ms
28ms

Image
text/plain

2606:4700::6812:7f05
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.conrad.de/ztpv.php?awc=11354_412871_1685634518_c6a3cc40-0093-11ee-89a2-223974343f8d&insert=AW&&gdpr=0&gdpr_consent=

Requested by

Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=14019%2C23576%2C19491&b=V8Xuwfr7H1zMSVHbHAtRtE9bhkTzT46hQ%2CYX1Hrf15spBpHVH9HetQtRR8cAT1T6mHr%2C9M1SMfKMtxEpSKHBH2t7trrqswTmTxVcd&f=m8ruefe8CweqsmHZHZtQCJGjTDTwT6rHA%2CqDRUmfD7H757CZHgHDtRCXXxaPTgTVZF3%2C1YRCbf7QTqBbt9HdH9tpC22XcRTKTXEhA&c=728&d=90&e=&g=90b279cc21b091d7e9f27a888d15b526%2F15577666206258245879&i=21596%2C20774%2C20773&j=16%2C14%2C14&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach13_BlackFridayPush&r=1685634518395&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1gg6p9y9pynase92cgrvvmy6t36t49ktx8rd15cx7eeznb65aexpwjnfkesdb3pzf1h38jhtjy5ajxyt1jm04y7zjtv24b7afxsdwwa7t25pq0nfe7n0th6bb1q6w4f9ztezr2nxx28x5mygzs7jz5s8bhgek5dtmy411whjm0m8crpm5v816bnkbtr22vvmsxjh384gpck61zgwp9bv3z42zx3v8sy8hqtp8qqrq1gn14ndsnnz2fb2mj7wrhgv36kkwbcj7qjqsqh7vpdg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCCCyU0r14ZJfsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSAAk_Q8ZBoeXcmdFs3Ne4A0BVHUHpRZOO5PUF8yj21nYvXGukTSVcmJikWDTTdzUDA6tjuYC_T0lMUYcsxvmJNSTXR1k3ustgfuZjkC6gzl4cbT29hO_ApbYH3NUKYpksZBvgNwA8hvm7gcIHysBOKG1CyxwkMVn3_AznTZl1sh-cWEbMnK2kaeT7j1fwtgUh6a8nOjdoqKEMysTZzHC-GT285wF9nl5s-MsqMa7Mglc_e4SdtaF60jUbSkjg-IuO3YB2XMHX4PuHDh-LF2f2Z5BJf7wvqLIxpQxP71tlVo9vLLGMQC6xVaLfKssXaR3RZqKLEllauAfCiVAgbbOJ559rgBAGABoKGjrL8sNmW-gGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_2GfKMz1UzIkeSOzxonQ5Fzpyt4Nw%2526client%253Dca-pub-6266313190087173%2526adurl%253D&y=1&s=&z=0

Protocol

Server

2606:4700::6812:7f05 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:38 GMT
strict-transport-security: max-age=15552000
cf-ccp-worker: HTLPHandler-v1
server: cloudflare
vary: Accept-Encoding
cache-control: no-cache
cf-ray: 7d089a1f5f359bb6-FRA
content-length: 0
expires: -1

Redirect headers

Date: Thu, 01 Jun 2023 15:48:38 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Location: https://www.conrad.de/ztpv.php?awc=11354_412871_1685634518_c6a3cc40-0093-11ee-89a2-223974343f8d&insert=AW&&gdpr=0&gdpr_consent=
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 0

GET
H3 200 D694B3AB12381C049B127B34DC11A792684BA8B6EE8B598D6E4045678591B7D0DC6B2CEF7528F06BB05FC11826A1D16CF24DA68FCFC2416343996FBFC05A3155
assets.ad4m.at/logo/ Frame A309 74 KB
74 KB 26ms
24ms Image
image/png 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/D694B3AB12381C049B127B34DC11A792684BA8B6EE8B598D6E4045678591B7D0DC6B2CEF7528F06BB05FC11826A1D16CF24DA68FCFC2416343996FBFC05A3155
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=14019%2C23576%2C19491&b=V8Xuwfr7H1zMSVHbHAtRtE9bhkTzT46hQ%2CYX1Hrf15spBpHVH9HetQtRR8cAT1T6mHr%2C9M1SMfKMtxEpSKHBH2t7trrqswTmTxVcd&f=m8ruefe8CweqsmHZHZtQCJGjTDTwT6rHA%2CqDRUmfD7H757CZHgHDtRCXXxaPTgTVZF3%2C1YRCbf7QTqBbt9HdH9tpC22XcRTKTXEhA&c=728&d=90&e=&g=90b279cc21b091d7e9f27a888d15b526%2F15577666206258245879&i=21596%2C20774%2C20773&j=16%2C14%2C14&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach13_BlackFridayPush&r=1685634518395&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1gg6p9y9pynase92cgrvvmy6t36t49ktx8rd15cx7eeznb65aexpwjnfkesdb3pzf1h38jhtjy5ajxyt1jm04y7zjtv24b7afxsdwwa7t25pq0nfe7n0th6bb1q6w4f9ztezr2nxx28x5mygzs7jz5s8bhgek5dtmy411whjm0m8crpm5v816bnkbtr22vvmsxjh384gpck61zgwp9bv3z42zx3v8sy8hqtp8qqrq1gn14ndsnnz2fb2mj7wrhgv36kkwbcj7qjqsqh7vpdg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCCCyU0r14ZJfsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSAAk_Q8ZBoeXcmdFs3Ne4A0BVHUHpRZOO5PUF8yj21nYvXGukTSVcmJikWDTTdzUDA6tjuYC_T0lMUYcsxvmJNSTXR1k3ustgfuZjkC6gzl4cbT29hO_ApbYH3NUKYpksZBvgNwA8hvm7gcIHysBOKG1CyxwkMVn3_AznTZl1sh-cWEbMnK2kaeT7j1fwtgUh6a8nOjdoqKEMysTZzHC-GT285wF9nl5s-MsqMa7Mglc_e4SdtaF60jUbSkjg-IuO3YB2XMHX4PuHDh-LF2f2Z5BJf7wvqLIxpQxP71tlVo9vLLGMQC6xVaLfKssXaR3RZqKLEllauAfCiVAgbbOJ559rgBAGABoKGjrL8sNmW-gGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_2GfKMz1UzIkeSOzxonQ5Fzpyt4Nw%2526client%253Dca-pub-6266313190087173%2526adurl%253D&y=1&s=&z=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2e949f7c00fb28395839347af2832e00b0b17fa659b9107b1fe97e033cffa957

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:38 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 355150
cf-polished: origSize=115129, status=vary_header_present
alt-svc: h3=":443"; ma=86400
content-length: 75430
cf-bgj: imgq:85,h2pri
last-modified: Tue, 09 Feb 2021 15:11:24 GMT
server: cloudflare
etag: "0a277d59efca0369a6983645e273659e"
vary: X-Goog-Allowed-Resources, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P%2FXrGFecZyMWxmoLlXmmi5oeer%2BGdWgX9HfQ44DZb8d%2Fl2%2F0mLLX27xV%2B5EY8CHIZ3UhuRbOrHZ7hKpHNwDXuBX%2B2QeFuMDNAY4IR1De57lyzNkbhpDIEqjdyi2g40eO4gY9v2diZR%2BjoKsx"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7d089a1de9803a86-FRA
expires: Fri, 02 Jun 2023 15:48:38 GMT

GET
H3 200 F62A1DE9558535D0FF655677BD09A3CC277ACE3637CF682E0D52C0F5BBA2668E34C6194AEF65CBBC1F6ECA33D1332A3C8BE1215EA4AB0FD0FBE5F5B485AF1875
assets.ad4m.at/product_image/ Frame A309 31 KB
32 KB 68ms
66ms Image
image/jpeg 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/product_image/F62A1DE9558535D0FF655677BD09A3CC277ACE3637CF682E0D52C0F5BBA2668E34C6194AEF65CBBC1F6ECA33D1332A3C8BE1215EA4AB0FD0FBE5F5B485AF1875
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=14019%2C23576%2C19491&b=V8Xuwfr7H1zMSVHbHAtRtE9bhkTzT46hQ%2CYX1Hrf15spBpHVH9HetQtRR8cAT1T6mHr%2C9M1SMfKMtxEpSKHBH2t7trrqswTmTxVcd&f=m8ruefe8CweqsmHZHZtQCJGjTDTwT6rHA%2CqDRUmfD7H757CZHgHDtRCXXxaPTgTVZF3%2C1YRCbf7QTqBbt9HdH9tpC22XcRTKTXEhA&c=728&d=90&e=&g=90b279cc21b091d7e9f27a888d15b526%2F15577666206258245879&i=21596%2C20774%2C20773&j=16%2C14%2C14&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach13_BlackFridayPush&r=1685634518395&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1gg6p9y9pynase92cgrvvmy6t36t49ktx8rd15cx7eeznb65aexpwjnfkesdb3pzf1h38jhtjy5ajxyt1jm04y7zjtv24b7afxsdwwa7t25pq0nfe7n0th6bb1q6w4f9ztezr2nxx28x5mygzs7jz5s8bhgek5dtmy411whjm0m8crpm5v816bnkbtr22vvmsxjh384gpck61zgwp9bv3z42zx3v8sy8hqtp8qqrq1gn14ndsnnz2fb2mj7wrhgv36kkwbcj7qjqsqh7vpdg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCCCyU0r14ZJfsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSAAk_Q8ZBoeXcmdFs3Ne4A0BVHUHpRZOO5PUF8yj21nYvXGukTSVcmJikWDTTdzUDA6tjuYC_T0lMUYcsxvmJNSTXR1k3ustgfuZjkC6gzl4cbT29hO_ApbYH3NUKYpksZBvgNwA8hvm7gcIHysBOKG1CyxwkMVn3_AznTZl1sh-cWEbMnK2kaeT7j1fwtgUh6a8nOjdoqKEMysTZzHC-GT285wF9nl5s-MsqMa7Mglc_e4SdtaF60jUbSkjg-IuO3YB2XMHX4PuHDh-LF2f2Z5BJf7wvqLIxpQxP71tlVo9vLLGMQC6xVaLfKssXaR3RZqKLEllauAfCiVAgbbOJ559rgBAGABoKGjrL8sNmW-gGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_2GfKMz1UzIkeSOzxonQ5Fzpyt4Nw%2526client%253Dca-pub-6266313190087173%2526adurl%253D&y=1&s=&z=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3e031ee2b6307161e852ef731954de0f13930fb0c43596f11ce825aa6a0019a9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:38 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2158221
cf-polished: degrade=85, origSize=132437, status=vary_header_present
alt-svc: h3=":443"; ma=86400
content-length: 31747
cf-bgj: imgq:85,h2pri
last-modified: Thu, 09 Dec 2021 17:51:23 GMT
server: cloudflare
etag: "c348b177953ac5720836c04e1a21673d"
vary: X-Goog-Allowed-Resources, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ocd0tBQzeD19zxFP3gipQgZWXGVNAbTldHwgSxrAmGIcK9JUlW%2BS%2B68j4uPoHeDzgumC5QeBuczdAJN03lq8%2Bt%2FmPYsk2rKc4PlxViZ3GjpdVGYyiT%2FPdTZOl%2BQh4ulCx3eN4li3wpZa5pe%2F"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7d089a1de9813a86-FRA
expires: Fri, 02 Jun 2023 15:48:38 GMT

GET
H/1.1

200
OK

/
partner.o2online.de/a/ Frame A309
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N773418.3417549O2_AFFILIATE/B25220131.345081615;dc_trk_aid=536683351;dc_trk_cid=176936761;ord=%7B%7Btimestamp%7D%7D;dc_lat=;dc_rdid=;tag_for_child_directed_t...
https://ad.doubleclick.net/ddm/trackimp/N773418.3417549O2_AFFILIATE/B25220131.345081615;dc_pre=CLr83PW1ov8CFdXZEQgdddcAUA;dc_trk_aid=536683351;dc_trk_cid=176936761;ord=%7B%7Btimestamp%7D%7D;dc_lat=...
https://www.telefonica-partner.de/tpv.php?t=120211V1226132702M&subid=viewoneidYX1Hrf15spBpHVH9HetQtRR8cAT1T6mHroneid__suite_Netmix_Reach13_BlackFridayPush&gdpr_consent=&gdpr=0&gdpr_pd=0
https://www.lead-alliance.net/tpv.php?t=120211V1226132702M&subid=viewoneidYX1Hrf15spBpHVH9HetQtRR8cAT1T6mHroneid__suite_Netmix_Reach13_BlackFridayPush&gdpr_consent=&gdpr=0&gdpr_pd=0
https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=120211&s_id=2023060117483985512145757X120211V1226132702MSviewoneidYX1Hrf15spBpHVH9HetQtRR8cAT1T6mHroneid__suite_Ne...

49 B
1 KB

311ms
32ms

Image
image/gif

167.233.13.224
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=120211&s_id=2023060117483985512145757X120211V1226132702MSviewoneidYX1Hrf15spBpHVH9HetQtRR8cAT1T6mHroneid__suite_Netmix_Reach13_BlackFridayPush&gdpr_consent=&gdpr=0&cons=0&spid=2023060117483985512145757X120211V1226132702MSviewoneidYX1Hrf15spBpHVH9HetQtRR8cAT1T6mHroneid__suite_Netmix_Reach13_BlackFridayPush&wfid=120211&partnerid=12218
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=14019%2C23576%2C19491&b=V8Xuwfr7H1zMSVHbHAtRtE9bhkTzT46hQ%2CYX1Hrf15spBpHVH9HetQtRR8cAT1T6mHr%2C9M1SMfKMtxEpSKHBH2t7trrqswTmTxVcd&f=m8ruefe8CweqsmHZHZtQCJGjTDTwT6rHA%2CqDRUmfD7H757CZHgHDtRCXXxaPTgTVZF3%2C1YRCbf7QTqBbt9HdH9tpC22XcRTKTXEhA&c=728&d=90&e=&g=90b279cc21b091d7e9f27a888d15b526%2F15577666206258245879&i=21596%2C20774%2C20773&j=16%2C14%2C14&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach13_BlackFridayPush&r=1685634518395&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1gg6p9y9pynase92cgrvvmy6t36t49ktx8rd15cx7eeznb65aexpwjnfkesdb3pzf1h38jhtjy5ajxyt1jm04y7zjtv24b7afxsdwwa7t25pq0nfe7n0th6bb1q6w4f9ztezr2nxx28x5mygzs7jz5s8bhgek5dtmy411whjm0m8crpm5v816bnkbtr22vvmsxjh384gpck61zgwp9bv3z42zx3v8sy8hqtp8qqrq1gn14ndsnnz2fb2mj7wrhgv36kkwbcj7qjqsqh7vpdg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCCCyU0r14ZJfsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSAAk_Q8ZBoeXcmdFs3Ne4A0BVHUHpRZOO5PUF8yj21nYvXGukTSVcmJikWDTTdzUDA6tjuYC_T0lMUYcsxvmJNSTXR1k3ustgfuZjkC6gzl4cbT29hO_ApbYH3NUKYpksZBvgNwA8hvm7gcIHysBOKG1CyxwkMVn3_AznTZl1sh-cWEbMnK2kaeT7j1fwtgUh6a8nOjdoqKEMysTZzHC-GT285wF9nl5s-MsqMa7Mglc_e4SdtaF60jUbSkjg-IuO3YB2XMHX4PuHDh-LF2f2Z5BJf7wvqLIxpQxP71tlVo9vLLGMQC6xVaLfKssXaR3RZqKLEllauAfCiVAgbbOJ559rgBAGABoKGjrL8sNmW-gGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_2GfKMz1UzIkeSOzxonQ5Fzpyt4Nw%2526client%253Dca-pub-6266313190087173%2526adurl%253D&y=1&s=&z=0
Protocol: HTTP/1.1
Server: 167.233.13.224 Hallbergmoos, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.224.13.233.167.clients.your-server.de
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Thu, 01 Jun 2023 15:48:39 GMT
X-NODEIP: 46.4.41.145
Server: nginx/1.14.0 (Ubuntu)
RM-PrivacyPolicy: https://www.nonstoppartner.net/
Content-Type: image/gif
P3P: policyref="https://a.nonstoppartner.net/w3c/p3p.a.xml", CP="NOI CUR OUR STP"
Connection: keep-alive
Keep-Alive: timeout=10
Content-Length: 49

Redirect headers

location: https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=120211&s_id=2023060117483985512145757X120211V1226132702MSviewoneidYX1Hrf15spBpHVH9HetQtRR8cAT1T6mHroneid__suite_Netmix_Reach13_BlackFridayPush&gdpr_consent=&gdpr=0&cons=0&spid=2023060117483985512145757X120211V1226132702MSviewoneidYX1Hrf15spBpHVH9HetQtRR8cAT1T6mHroneid__suite_Netmix_Reach13_BlackFridayPush&wfid=120211&partnerid=12218
date: Thu, 01 Jun 2023 15:48:39 GMT
x-content-type-options: nosniff
server: nginx
x-xss-protection: 1; mode=block
content-type: text/html; charset=UTF-8

GET
H3 200 DF9A32151D42BCC835EC0C9BE62CF0094313EE46FD4E5D3DC0F1217B7F8F1AD49F0F4DDF5D50AE1511A12D11F97A6BCA3DF8CE9D056CE7A3DC11AF6ED1255D71
assets.ad4m.at/logo/ Frame A309 13 KB
14 KB 72ms
70ms Image
image/png 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/DF9A32151D42BCC835EC0C9BE62CF0094313EE46FD4E5D3DC0F1217B7F8F1AD49F0F4DDF5D50AE1511A12D11F97A6BCA3DF8CE9D056CE7A3DC11AF6ED1255D71
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=14019%2C23576%2C19491&b=V8Xuwfr7H1zMSVHbHAtRtE9bhkTzT46hQ%2CYX1Hrf15spBpHVH9HetQtRR8cAT1T6mHr%2C9M1SMfKMtxEpSKHBH2t7trrqswTmTxVcd&f=m8ruefe8CweqsmHZHZtQCJGjTDTwT6rHA%2CqDRUmfD7H757CZHgHDtRCXXxaPTgTVZF3%2C1YRCbf7QTqBbt9HdH9tpC22XcRTKTXEhA&c=728&d=90&e=&g=90b279cc21b091d7e9f27a888d15b526%2F15577666206258245879&i=21596%2C20774%2C20773&j=16%2C14%2C14&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach13_BlackFridayPush&r=1685634518395&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1gg6p9y9pynase92cgrvvmy6t36t49ktx8rd15cx7eeznb65aexpwjnfkesdb3pzf1h38jhtjy5ajxyt1jm04y7zjtv24b7afxsdwwa7t25pq0nfe7n0th6bb1q6w4f9ztezr2nxx28x5mygzs7jz5s8bhgek5dtmy411whjm0m8crpm5v816bnkbtr22vvmsxjh384gpck61zgwp9bv3z42zx3v8sy8hqtp8qqrq1gn14ndsnnz2fb2mj7wrhgv36kkwbcj7qjqsqh7vpdg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCCCyU0r14ZJfsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSAAk_Q8ZBoeXcmdFs3Ne4A0BVHUHpRZOO5PUF8yj21nYvXGukTSVcmJikWDTTdzUDA6tjuYC_T0lMUYcsxvmJNSTXR1k3ustgfuZjkC6gzl4cbT29hO_ApbYH3NUKYpksZBvgNwA8hvm7gcIHysBOKG1CyxwkMVn3_AznTZl1sh-cWEbMnK2kaeT7j1fwtgUh6a8nOjdoqKEMysTZzHC-GT285wF9nl5s-MsqMa7Mglc_e4SdtaF60jUbSkjg-IuO3YB2XMHX4PuHDh-LF2f2Z5BJf7wvqLIxpQxP71tlVo9vLLGMQC6xVaLfKssXaR3RZqKLEllauAfCiVAgbbOJ559rgBAGABoKGjrL8sNmW-gGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_2GfKMz1UzIkeSOzxonQ5Fzpyt4Nw%2526client%253Dca-pub-6266313190087173%2526adurl%253D&y=1&s=&z=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 229e5a0cf38692aadb68fe1ab6ea1e26a0a3b26fbb4e731f33ad807a50ef1227

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:38 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1633152
cf-polished: origSize=24833, status=vary_header_present
alt-svc: h3=":443"; ma=86400
content-length: 13494
cf-bgj: imgq:85,h2pri
last-modified: Tue, 09 Feb 2021 15:11:57 GMT
server: cloudflare
etag: "174bb0dc35647e204b09aa120965604a"
vary: X-Goog-Allowed-Resources, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2HxYkn1WQwQylgC9nghgUiWkIEaIn2iy%2B8%2FwmIu8KdKRnENAF4lh%2BGPPNjyCmZdRr%2FyOBewAawt3gLr63O2DGUNZScbmm1qm2WEThgIZ52fsNtSJKnDE7GehBpAuPKiHDf%2FPPykL5q2es7RW"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7d089a1de9833a86-FRA
expires: Fri, 02 Jun 2023 15:48:38 GMT

GET
H3 200 A82D4E4655959EE65957B3D54C38767F8640A6BF49B28578F60A440F3EB1DCA10D535C0D8D7DE5ABFECB7F47C2F92CA23C7E0F97D343D7CCCB0A93B9F181397B
assets.ad4m.at/ Frame A309 13 KB
13 KB 72ms
71ms Image
image/webp 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/A82D4E4655959EE65957B3D54C38767F8640A6BF49B28578F60A440F3EB1DCA10D535C0D8D7DE5ABFECB7F47C2F92CA23C7E0F97D343D7CCCB0A93B9F181397B
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=14019%2C23576%2C19491&b=V8Xuwfr7H1zMSVHbHAtRtE9bhkTzT46hQ%2CYX1Hrf15spBpHVH9HetQtRR8cAT1T6mHr%2C9M1SMfKMtxEpSKHBH2t7trrqswTmTxVcd&f=m8ruefe8CweqsmHZHZtQCJGjTDTwT6rHA%2CqDRUmfD7H757CZHgHDtRCXXxaPTgTVZF3%2C1YRCbf7QTqBbt9HdH9tpC22XcRTKTXEhA&c=728&d=90&e=&g=90b279cc21b091d7e9f27a888d15b526%2F15577666206258245879&i=21596%2C20774%2C20773&j=16%2C14%2C14&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach13_BlackFridayPush&r=1685634518395&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1gg6p9y9pynase92cgrvvmy6t36t49ktx8rd15cx7eeznb65aexpwjnfkesdb3pzf1h38jhtjy5ajxyt1jm04y7zjtv24b7afxsdwwa7t25pq0nfe7n0th6bb1q6w4f9ztezr2nxx28x5mygzs7jz5s8bhgek5dtmy411whjm0m8crpm5v816bnkbtr22vvmsxjh384gpck61zgwp9bv3z42zx3v8sy8hqtp8qqrq1gn14ndsnnz2fb2mj7wrhgv36kkwbcj7qjqsqh7vpdg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCCCyU0r14ZJfsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSAAk_Q8ZBoeXcmdFs3Ne4A0BVHUHpRZOO5PUF8yj21nYvXGukTSVcmJikWDTTdzUDA6tjuYC_T0lMUYcsxvmJNSTXR1k3ustgfuZjkC6gzl4cbT29hO_ApbYH3NUKYpksZBvgNwA8hvm7gcIHysBOKG1CyxwkMVn3_AznTZl1sh-cWEbMnK2kaeT7j1fwtgUh6a8nOjdoqKEMysTZzHC-GT285wF9nl5s-MsqMa7Mglc_e4SdtaF60jUbSkjg-IuO3YB2XMHX4PuHDh-LF2f2Z5BJf7wvqLIxpQxP71tlVo9vLLGMQC6xVaLfKssXaR3RZqKLEllauAfCiVAgbbOJ559rgBAGABoKGjrL8sNmW-gGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_2GfKMz1UzIkeSOzxonQ5Fzpyt4Nw%2526client%253Dca-pub-6266313190087173%2526adurl%253D&y=1&s=&z=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9d3fbf7c17c5c355ffc2c599b7040bdaf254129b19dbd66e946f035465d2aa64

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:38 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 353119
cf-polished: qual=85, origFmt=jpeg, origSize=40544
alt-svc: h3=":443"; ma=86400
content-length: 13188
cf-bgj: imgq:85,h2pri
last-modified: Wed, 05 Apr 2023 21:35:19 GMT
server: cloudflare
etag: "3d8410e459f8881b4ef917d426938b2f"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BJo6Zo5huWa3sK6uMb0MjqH63sXo8iNEBCr3as5236x1NRzVEHs%2Fgb0tqZn%2BrIsSF7Oi8v223Scg%2FPfvtdMWpChTfUE%2Bjq2yDuAVx4ln7NMCUOzcEW8XMaV3JdFR1OmDWFAyxPGNAxgl0C2v"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7d089a1de9843a86-FRA
expires: Fri, 02 Jun 2023 15:48:38 GMT

GET
H/1.1

200
OK

/
partner.blau.de/a/ Frame A309
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N773418.3163536BLAU_AFFILIATE/B25532621.345088000;dc_trk_aid=536454876;dc_trk_cid=177082088;ord=%7B%7Btimestamp%7D%7D;dc_lat=;dc_rdid=;tag_for_child_directed...
https://ad.doubleclick.net/ddm/trackimp/N773418.3163536BLAU_AFFILIATE/B25532621.345088000;dc_pre=CMr_3PW1ov8CFarxEQgdhXEP-Q;dc_trk_aid=536454876;dc_trk_cid=177082088;ord=%7B%7Btimestamp%7D%7D;dc_la...
https://www.telefonica-partner.de/tpv.php?t=113752V1225131106M&subid=viewoneid9M1SMfKMtxEpSKHBH2t7trrqswTmTxVcdoneid__suite_Netmix_Reach13_BlackFridayPush&gdpr_consent=&gdpr=0&gdpr_pd=0
https://www.lead-alliance.net/tpv.php?t=113752V1225131106M&subid=viewoneid9M1SMfKMtxEpSKHBH2t7trrqswTmTxVcdoneid__suite_Netmix_Reach13_BlackFridayPush&gdpr_consent=&gdpr=0&gdpr_pd=0
https://partner.blau.de/a/?i=pview&client=blau&camp=pview&l=de&nw=lea1&affiliate=113752&s_id=2023060117483985512145759X113752V1225131106MSviewoneid9M1SMfKMtxEpSKHBH2t7trrqswTmTxVcdoneid__suite_Netm...

49 B
1 KB

67ms
22ms

Image
image/gif

167.233.13.224
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partner.blau.de/a/?i=pview&client=blau&camp=pview&l=de&nw=lea1&affiliate=113752&s_id=2023060117483985512145759X113752V1225131106MSviewoneid9M1SMfKMtxEpSKHBH2t7trrqswTmTxVcdoneid__suite_Netmix_Reach13_BlackFridayPush&gdpr_consent=&gdpr=0&cons=0
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=14019%2C23576%2C19491&b=V8Xuwfr7H1zMSVHbHAtRtE9bhkTzT46hQ%2CYX1Hrf15spBpHVH9HetQtRR8cAT1T6mHr%2C9M1SMfKMtxEpSKHBH2t7trrqswTmTxVcd&f=m8ruefe8CweqsmHZHZtQCJGjTDTwT6rHA%2CqDRUmfD7H757CZHgHDtRCXXxaPTgTVZF3%2C1YRCbf7QTqBbt9HdH9tpC22XcRTKTXEhA&c=728&d=90&e=&g=90b279cc21b091d7e9f27a888d15b526%2F15577666206258245879&i=21596%2C20774%2C20773&j=16%2C14%2C14&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach13_BlackFridayPush&r=1685634518395&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1gg6p9y9pynase92cgrvvmy6t36t49ktx8rd15cx7eeznb65aexpwjnfkesdb3pzf1h38jhtjy5ajxyt1jm04y7zjtv24b7afxsdwwa7t25pq0nfe7n0th6bb1q6w4f9ztezr2nxx28x5mygzs7jz5s8bhgek5dtmy411whjm0m8crpm5v816bnkbtr22vvmsxjh384gpck61zgwp9bv3z42zx3v8sy8hqtp8qqrq1gn14ndsnnz2fb2mj7wrhgv36kkwbcj7qjqsqh7vpdg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCCCyU0r14ZJfsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSAAk_Q8ZBoeXcmdFs3Ne4A0BVHUHpRZOO5PUF8yj21nYvXGukTSVcmJikWDTTdzUDA6tjuYC_T0lMUYcsxvmJNSTXR1k3ustgfuZjkC6gzl4cbT29hO_ApbYH3NUKYpksZBvgNwA8hvm7gcIHysBOKG1CyxwkMVn3_AznTZl1sh-cWEbMnK2kaeT7j1fwtgUh6a8nOjdoqKEMysTZzHC-GT285wF9nl5s-MsqMa7Mglc_e4SdtaF60jUbSkjg-IuO3YB2XMHX4PuHDh-LF2f2Z5BJf7wvqLIxpQxP71tlVo9vLLGMQC6xVaLfKssXaR3RZqKLEllauAfCiVAgbbOJ559rgBAGABoKGjrL8sNmW-gGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_2GfKMz1UzIkeSOzxonQ5Fzpyt4Nw%2526client%253Dca-pub-6266313190087173%2526adurl%253D&y=1&s=&z=0
Protocol: HTTP/1.1
Server: 167.233.13.224 Hallbergmoos, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.224.13.233.167.clients.your-server.de
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Thu, 01 Jun 2023 15:48:39 GMT
X-NODEIP: 46.4.41.145
Server: nginx/1.14.0 (Ubuntu)
RM-PrivacyPolicy: https://www.nonstoppartner.net/
Content-Type: image/gif
P3P: policyref="https://a.nonstoppartner.net/w3c/p3p.a.xml", CP="NOI CUR OUR STP"
Connection: keep-alive
Keep-Alive: timeout=10
Content-Length: 49

Redirect headers

location: https://partner.blau.de/a/?i=pview&client=blau&camp=pview&l=de&nw=lea1&affiliate=113752&s_id=2023060117483985512145759X113752V1225131106MSviewoneid9M1SMfKMtxEpSKHBH2t7trrqswTmTxVcdoneid__suite_Netmix_Reach13_BlackFridayPush&gdpr_consent=&gdpr=0&cons=0
date: Thu, 01 Jun 2023 15:48:39 GMT
x-content-type-options: nosniff
server: nginx
x-xss-protection: 1; mode=block
content-type: text/html; charset=UTF-8

GET
H3 200 default.css
as.ad4m.at/ad/style/0.1.40/one-ad/ Frame 170B 103 KB
13 KB 29ms
29ms Stylesheet
text/css 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://as.ad4m.at/ad/style/0.1.40/one-ad/default.css
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197862%2C117569%2C19769&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb%2Ck7Vh5f3fD2kYa4HwHetBtxPrtZSjTm3baj7m6%2CppXa1fgfpAwfkH4HmtztQJjt9SRT8WwUAQkr&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW%2CzR7CRfYfk3KMFpHBHMtJC9dGtVSwTQ2GCrp6Y%2CJgKFzf5fqjZhBH6H7tqCpKbTxSgT4MetAmKM&c=120&d=600&e=&g=bf2746ad64922df92a36517ba080fc4b%2F8248446331798415938&i=71725%2C29981%2C21630&j=21%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1685634518397&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1gsk73xr5717r3wt02p6v5vnh8v4zfmeq2c3gje788bjbhnszfrpxvjm81g7cc2nz255te93ryjj3kkmb68f358f0fnb1mgsmydtmbybmfgwnvkgy444hkm6c0574f6d8dfa6d9axzb9bbhy2b4swp4frknkafrkn9n43an3y1z0yp9sptq7qtnz5cwwsz6tfxnq8g16xq2b4dvp3pcvd2cnmxj4tk8d289hvy768qxehyyfwmr12t16gvqveyvvqqhapqya6e14zk74a3cesw0qa4%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCCzdZ0r14ZJbsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSFAk_QkVhoMQF4FpBrIh4d_96t1lo09_NWbzPp7lG2tQI1aWW3_PxR-4R65_zMorz3LWfRQrcsCPUaIA2XX7K-G1udF6GXISECHtnW1HzPwS2P3v60f0rjsTuCL5MNBCGVDoIwH8AdY_4-d04CAkB5k6_Q_f3vLUHqmJL0Rq5dAkMg4dXI6Ij18GFU6IJCjm75kqw7xbXLWMT2m8_oZMYEAF_3aup20TBrcjEvR0_ralHmbmW96sJFKyotV20HZEGrcHgQv3Mz03HSQKCmdOGr7X_yZSNIHfh6xvZF77TbMSba4fT0wxgn49TyLTAymCgQnooOiMopABV8b9IH-4ihdaWhTf-WyeAEAYAGtoyOx-LazYXwAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_0GPRMhVzuVGjgwiOiV0pp-xeC9fg%2526client%253Dca-pub-6266313190087173%2526adurl%253D&y=1&s=&z=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d77b5f2ca03eb8dab2acc515548b7b1ce7eeb4ca2189268552649e0391ee8c21

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.ad4m.at/ad/rar?a=197862%2C117569%2C19769&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb%2Ck7Vh5f3fD2kYa4HwHetBtxPrtZSjTm3baj7m6%2CppXa1fgfpAwfkH4HmtztQJjt9SRT8WwUAQkr&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW%2CzR7CRfYfk3KMFpHBHMtJC9dGtVSwTQ2GCrp6Y%2CJgKFzf5fqjZhBH6H7tqCpKbTxSgT4MetAmKM&c=120&d=600&e=&g=bf2746ad64922df92a36517ba080fc4b%2F8248446331798415938&i=71725%2C29981%2C21630&j=21%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1685634518397&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1gsk73xr5717r3wt02p6v5vnh8v4zfmeq2c3gje788bjbhnszfrpxvjm81g7cc2nz255te93ryjj3kkmb68f358f0fnb1mgsmydtmbybmfgwnvkgy444hkm6c0574f6d8dfa6d9axzb9bbhy2b4swp4frknkafrkn9n43an3y1z0yp9sptq7qtnz5cwwsz6tfxnq8g16xq2b4dvp3pcvd2cnmxj4tk8d289hvy768qxehyyfwmr12t16gvqveyvvqqhapqya6e14zk74a3cesw0qa4%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCCzdZ0r14ZJbsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSFAk_QkVhoMQF4FpBrIh4d_96t1lo09_NWbzPp7lG2tQI1aWW3_PxR-4R65_zMorz3LWfRQrcsCPUaIA2XX7K-G1udF6GXISECHtnW1HzPwS2P3v60f0rjsTuCL5MNBCGVDoIwH8AdY_4-d04CAkB5k6_Q_f3vLUHqmJL0Rq5dAkMg4dXI6Ij18GFU6IJCjm75kqw7xbXLWMT2m8_oZMYEAF_3aup20TBrcjEvR0_ralHmbmW96sJFKyotV20HZEGrcHgQv3Mz03HSQKCmdOGr7X_yZSNIHfh6xvZF77TbMSba4fT0wxgn49TyLTAymCgQnooOiMopABV8b9IH-4ihdaWhTf-WyeAEAYAGtoyOx-LazYXwAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_0GPRMhVzuVGjgwiOiV0pp-xeC9fg%2526client%253Dca-pub-6266313190087173%2526adurl%253D&y=1&s=&z=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:38 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-meta-goog-reserved-file-mtime: 1683559916
age: 598112
cf-polished: origSize=105839
x-guploader-uploadid: ADPycdv9IJsM9Nda_T-YCF8tGjLSR9_5GyrPWBCiXo7o_2KPFa29jeIDurPOQJdzBat54FnfGmUqvpjJPo5BCE2ydDX2ig
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Mon, 08 May 2023 15:32:28 GMT
server: cloudflare
etag: W/"44fa96b813e145cb8b915ae1fb6a3b7a"
vary: Accept-Encoding
x-goog-generation: 1683559948253618
content-type: text/css
x-goog-hash: crc32c=FELYSw==, md5=RPqWuBPhRcuLkVrh+2o7eg==
cache-control: public, max-age=3600
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DLk9OWAQ77kSY4n0iwUG6yDPdxCvwpkJdkGktBkZ1BT%2BiHwsXeZ5TwdKcDoUrsFd7J%2BmpNy%2FzeAy0bwwCXX3zq%2FDacreUvfwIFgZIehLcE09ZL3si%2Fetk%2FpY3ks6e3LUWNktCtXY%2B%2Bs%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 105839
cf-ray: 7d089a1d99043a86-FRA
expires: Thu, 01 Jun 2023 16:48:38 GMT

GET
H2 200 C3FCB3AB04505A8F1D79D1D5953F5207FE6F49EF4C517E920A79B423A52F9E2DCCD658FDD21E3D8209A640CEE47D02AAD52D272924710EAE6BAB80FD9B483022
assets.ad4m.at/logo/ Frame 170B 5 KB
5 KB 27ms
23ms Image
image/webp 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/C3FCB3AB04505A8F1D79D1D5953F5207FE6F49EF4C517E920A79B423A52F9E2DCCD658FDD21E3D8209A640CEE47D02AAD52D272924710EAE6BAB80FD9B483022
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197862%2C117569%2C19769&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb%2Ck7Vh5f3fD2kYa4HwHetBtxPrtZSjTm3baj7m6%2CppXa1fgfpAwfkH4HmtztQJjt9SRT8WwUAQkr&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW%2CzR7CRfYfk3KMFpHBHMtJC9dGtVSwTQ2GCrp6Y%2CJgKFzf5fqjZhBH6H7tqCpKbTxSgT4MetAmKM&c=120&d=600&e=&g=bf2746ad64922df92a36517ba080fc4b%2F8248446331798415938&i=71725%2C29981%2C21630&j=21%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1685634518397&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1gsk73xr5717r3wt02p6v5vnh8v4zfmeq2c3gje788bjbhnszfrpxvjm81g7cc2nz255te93ryjj3kkmb68f358f0fnb1mgsmydtmbybmfgwnvkgy444hkm6c0574f6d8dfa6d9axzb9bbhy2b4swp4frknkafrkn9n43an3y1z0yp9sptq7qtnz5cwwsz6tfxnq8g16xq2b4dvp3pcvd2cnmxj4tk8d289hvy768qxehyyfwmr12t16gvqveyvvqqhapqya6e14zk74a3cesw0qa4%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCCzdZ0r14ZJbsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSFAk_QkVhoMQF4FpBrIh4d_96t1lo09_NWbzPp7lG2tQI1aWW3_PxR-4R65_zMorz3LWfRQrcsCPUaIA2XX7K-G1udF6GXISECHtnW1HzPwS2P3v60f0rjsTuCL5MNBCGVDoIwH8AdY_4-d04CAkB5k6_Q_f3vLUHqmJL0Rq5dAkMg4dXI6Ij18GFU6IJCjm75kqw7xbXLWMT2m8_oZMYEAF_3aup20TBrcjEvR0_ralHmbmW96sJFKyotV20HZEGrcHgQv3Mz03HSQKCmdOGr7X_yZSNIHfh6xvZF77TbMSba4fT0wxgn49TyLTAymCgQnooOiMopABV8b9IH-4ihdaWhTf-WyeAEAYAGtoyOx-LazYXwAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_0GPRMhVzuVGjgwiOiV0pp-xeC9fg%2526client%253Dca-pub-6266313190087173%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9c63890b7f3f2e513fa085cd7b198f9ab91721a9e8aa7180806ff4aa7b4089a4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:38 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1629134
cf-polished: origFmt=png, origSize=10283
alt-svc: h3=":443"; ma=86400
content-length: 4736
cf-bgj: imgq:85,h2pri
last-modified: Thu, 06 Apr 2023 12:21:02 GMT
server: cloudflare
etag: "b90d04a587c2a1ab6749e51d8bb195d1"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0w8A2c4s%2F1jEwWEtXjrqlvCfHpMWlbfL1s8lGtosmvrPPEdXHRwkSlCC50SaOV6G25KHbVquGqtUWAf4XOHdWLa3C5uYaufuLVR0o5t1bPbFfEH3Ev5w2PJNoedg0XxdUCXQ9RxvNasy%2BfL8"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7d089a1d9994bb65-FRA
expires: Fri, 02 Jun 2023 15:48:38 GMT

GET
H3 200 A36DAD0D440985CF6ABFA23492945CE5BC6D94350A66B19418CB771AFE823AD9B48ADE8E2F007546F0A50A710172EEFC2CAC1468E38852CE2028C22592AAFB75
assets.ad4m.at/product_image/ Frame 170B 54 KB
55 KB 62ms
61ms Image
image/webp 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/product_image/A36DAD0D440985CF6ABFA23492945CE5BC6D94350A66B19418CB771AFE823AD9B48ADE8E2F007546F0A50A710172EEFC2CAC1468E38852CE2028C22592AAFB75
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197862%2C117569%2C19769&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb%2Ck7Vh5f3fD2kYa4HwHetBtxPrtZSjTm3baj7m6%2CppXa1fgfpAwfkH4HmtztQJjt9SRT8WwUAQkr&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW%2CzR7CRfYfk3KMFpHBHMtJC9dGtVSwTQ2GCrp6Y%2CJgKFzf5fqjZhBH6H7tqCpKbTxSgT4MetAmKM&c=120&d=600&e=&g=bf2746ad64922df92a36517ba080fc4b%2F8248446331798415938&i=71725%2C29981%2C21630&j=21%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1685634518397&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1gsk73xr5717r3wt02p6v5vnh8v4zfmeq2c3gje788bjbhnszfrpxvjm81g7cc2nz255te93ryjj3kkmb68f358f0fnb1mgsmydtmbybmfgwnvkgy444hkm6c0574f6d8dfa6d9axzb9bbhy2b4swp4frknkafrkn9n43an3y1z0yp9sptq7qtnz5cwwsz6tfxnq8g16xq2b4dvp3pcvd2cnmxj4tk8d289hvy768qxehyyfwmr12t16gvqveyvvqqhapqya6e14zk74a3cesw0qa4%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCCzdZ0r14ZJbsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSFAk_QkVhoMQF4FpBrIh4d_96t1lo09_NWbzPp7lG2tQI1aWW3_PxR-4R65_zMorz3LWfRQrcsCPUaIA2XX7K-G1udF6GXISECHtnW1HzPwS2P3v60f0rjsTuCL5MNBCGVDoIwH8AdY_4-d04CAkB5k6_Q_f3vLUHqmJL0Rq5dAkMg4dXI6Ij18GFU6IJCjm75kqw7xbXLWMT2m8_oZMYEAF_3aup20TBrcjEvR0_ralHmbmW96sJFKyotV20HZEGrcHgQv3Mz03HSQKCmdOGr7X_yZSNIHfh6xvZF77TbMSba4fT0wxgn49TyLTAymCgQnooOiMopABV8b9IH-4ihdaWhTf-WyeAEAYAGtoyOx-LazYXwAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_0GPRMhVzuVGjgwiOiV0pp-xeC9fg%2526client%253Dca-pub-6266313190087173%2526adurl%253D&y=1&s=&z=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 861e4cd27539274eedfdd65212a140a4c7ccea88e004d23f5234e4db48bc73ae

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:38 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2377332
cf-polished: origFmt=png, origSize=105738
alt-svc: h3=":443"; ma=86400
content-length: 55786
cf-bgj: imgq:85,h2pri
last-modified: Mon, 04 Jul 2022 08:55:40 GMT
server: cloudflare
etag: "147be38db57f89c69c9e65b05983ff0e"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Fp%2BnZkU6luym0eEQ6DCASY43h8zyWMrmGhzPyKr6QPGVsiKg7A2eH4jV3eYmEe%2BUsQg%2F0jvd7Ho94QUpC%2FvGmOa5CNLIR4KSG5BTBZPro3NCBwe%2BKHakRBd%2BURTmk4ET6vSt0X5HdlX6Cf2Y"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7d089a1df9983a86-FRA
expires: Fri, 02 Jun 2023 15:48:38 GMT

GET
H3 200 A0843E9156C9D7335C02FDBAB8781B4AFFEEE9E59ABD085E1EDF62037D970710A817E95DBBFD727CE4E28B26524C9A8F4A33EB1E826BD3A7B2541F094E39D266
assets.ad4m.at/logo/ Frame 170B 4 KB
5 KB 63ms
61ms Image
image/png 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/A0843E9156C9D7335C02FDBAB8781B4AFFEEE9E59ABD085E1EDF62037D970710A817E95DBBFD727CE4E28B26524C9A8F4A33EB1E826BD3A7B2541F094E39D266
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197862%2C117569%2C19769&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb%2Ck7Vh5f3fD2kYa4HwHetBtxPrtZSjTm3baj7m6%2CppXa1fgfpAwfkH4HmtztQJjt9SRT8WwUAQkr&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW%2CzR7CRfYfk3KMFpHBHMtJC9dGtVSwTQ2GCrp6Y%2CJgKFzf5fqjZhBH6H7tqCpKbTxSgT4MetAmKM&c=120&d=600&e=&g=bf2746ad64922df92a36517ba080fc4b%2F8248446331798415938&i=71725%2C29981%2C21630&j=21%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1685634518397&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1gsk73xr5717r3wt02p6v5vnh8v4zfmeq2c3gje788bjbhnszfrpxvjm81g7cc2nz255te93ryjj3kkmb68f358f0fnb1mgsmydtmbybmfgwnvkgy444hkm6c0574f6d8dfa6d9axzb9bbhy2b4swp4frknkafrkn9n43an3y1z0yp9sptq7qtnz5cwwsz6tfxnq8g16xq2b4dvp3pcvd2cnmxj4tk8d289hvy768qxehyyfwmr12t16gvqveyvvqqhapqya6e14zk74a3cesw0qa4%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCCzdZ0r14ZJbsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSFAk_QkVhoMQF4FpBrIh4d_96t1lo09_NWbzPp7lG2tQI1aWW3_PxR-4R65_zMorz3LWfRQrcsCPUaIA2XX7K-G1udF6GXISECHtnW1HzPwS2P3v60f0rjsTuCL5MNBCGVDoIwH8AdY_4-d04CAkB5k6_Q_f3vLUHqmJL0Rq5dAkMg4dXI6Ij18GFU6IJCjm75kqw7xbXLWMT2m8_oZMYEAF_3aup20TBrcjEvR0_ralHmbmW96sJFKyotV20HZEGrcHgQv3Mz03HSQKCmdOGr7X_yZSNIHfh6xvZF77TbMSba4fT0wxgn49TyLTAymCgQnooOiMopABV8b9IH-4ihdaWhTf-WyeAEAYAGtoyOx-LazYXwAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_0GPRMhVzuVGjgwiOiV0pp-xeC9fg%2526client%253Dca-pub-6266313190087173%2526adurl%253D&y=1&s=&z=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 55fc10baa9c6fa8d98acac31beba1be0e8f688344f243dea838b5b03e8566a3c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:38 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 318477
cf-polished: origSize=9357, status=vary_header_present
alt-svc: h3=":443"; ma=86400
content-length: 4429
cf-bgj: imgq:85,h2pri
last-modified: Thu, 08 Apr 2021 14:26:03 GMT
server: cloudflare
etag: "8cc161b392f5744da5319a4da549b763"
vary: X-Goog-Allowed-Resources, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7B6LiS%2Fs1KuPguoD6%2Bn%2FC7xgfPyyePr05DCaA23tQdh6M7oCX4uhArygDTwwl8NXlkTPJWgCP0Hcn%2FDjyPn8ps%2F5nwu21j1dZHMGmWfdCncP4aMjveNEafqcaLZ0ObIrmXhL7TCAT%2BDEV%2BB7"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7d089a1e099d3a86-FRA
expires: Fri, 02 Jun 2023 15:48:38 GMT

GET
H3 200 B0EFBB0208E9EF8D30A7C89B72C086F1DD36F5D7A5F0A9551729DDFC67E85BCDECDB196EB4EAB3FEC6BC55A4A1442682559F8312D8959CED1C6B0F52B22CF45C
assets.ad4m.at/product_image/ Frame 170B 339 KB
340 KB 63ms
61ms Image
image/webp 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/product_image/B0EFBB0208E9EF8D30A7C89B72C086F1DD36F5D7A5F0A9551729DDFC67E85BCDECDB196EB4EAB3FEC6BC55A4A1442682559F8312D8959CED1C6B0F52B22CF45C
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197862%2C117569%2C19769&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb%2Ck7Vh5f3fD2kYa4HwHetBtxPrtZSjTm3baj7m6%2CppXa1fgfpAwfkH4HmtztQJjt9SRT8WwUAQkr&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW%2CzR7CRfYfk3KMFpHBHMtJC9dGtVSwTQ2GCrp6Y%2CJgKFzf5fqjZhBH6H7tqCpKbTxSgT4MetAmKM&c=120&d=600&e=&g=bf2746ad64922df92a36517ba080fc4b%2F8248446331798415938&i=71725%2C29981%2C21630&j=21%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1685634518397&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1gsk73xr5717r3wt02p6v5vnh8v4zfmeq2c3gje788bjbhnszfrpxvjm81g7cc2nz255te93ryjj3kkmb68f358f0fnb1mgsmydtmbybmfgwnvkgy444hkm6c0574f6d8dfa6d9axzb9bbhy2b4swp4frknkafrkn9n43an3y1z0yp9sptq7qtnz5cwwsz6tfxnq8g16xq2b4dvp3pcvd2cnmxj4tk8d289hvy768qxehyyfwmr12t16gvqveyvvqqhapqya6e14zk74a3cesw0qa4%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCCzdZ0r14ZJbsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSFAk_QkVhoMQF4FpBrIh4d_96t1lo09_NWbzPp7lG2tQI1aWW3_PxR-4R65_zMorz3LWfRQrcsCPUaIA2XX7K-G1udF6GXISECHtnW1HzPwS2P3v60f0rjsTuCL5MNBCGVDoIwH8AdY_4-d04CAkB5k6_Q_f3vLUHqmJL0Rq5dAkMg4dXI6Ij18GFU6IJCjm75kqw7xbXLWMT2m8_oZMYEAF_3aup20TBrcjEvR0_ralHmbmW96sJFKyotV20HZEGrcHgQv3Mz03HSQKCmdOGr7X_yZSNIHfh6xvZF77TbMSba4fT0wxgn49TyLTAymCgQnooOiMopABV8b9IH-4ihdaWhTf-WyeAEAYAGtoyOx-LazYXwAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_0GPRMhVzuVGjgwiOiV0pp-xeC9fg%2526client%253Dca-pub-6266313190087173%2526adurl%253D&y=1&s=&z=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 42e8de9192dee3b3ee8a7529c5883dac20b868000168362d9f287125c95e18a8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:38 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 319153
cf-polished: origFmt=png, origSize=563367
alt-svc: h3=":443"; ma=86400
content-length: 347098
cf-bgj: imgq:85,h2pri
last-modified: Fri, 09 Apr 2021 07:22:09 GMT
server: cloudflare
etag: "ff5ac113643d20bec15acfffe32cb75e"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vvc%2FmY%2BeqURwIGzzW2os42TZC7vaZX7jkd23Y9%2F1V1N79ZzxxqiRP3LG%2Fa7OcVVbjems3B6ycs%2FxyQd6ItG7AIGNdoERMxON%2BgxOvy5awbWWkaNMheyZoRHoWc5w84ilVRyf5K7b5B%2BYPs8i"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7d089a1e099f3a86-FRA
expires: Fri, 02 Jun 2023 15:48:38 GMT

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 170B 43 B
704 B 138ms
46ms Image
image/gif 92.123.148.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2904924&v=20044&q=415363&r=412871&pv=1&pref3=oneidk7Vh5f3fD2kYa4HwHetBtxPrtZSjTm3baj7m6oneid__suite_Netmix_Reach128_WEBGAINSMOSTLY&gdpr_consent=&gdpr=0&gdpr_pd=0

Requested by

Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197862%2C117569%2C19769&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb%2Ck7Vh5f3fD2kYa4HwHetBtxPrtZSjTm3baj7m6%2CppXa1fgfpAwfkH4HmtztQJjt9SRT8WwUAQkr&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW%2CzR7CRfYfk3KMFpHBHMtJC9dGtVSwTQ2GCrp6Y%2CJgKFzf5fqjZhBH6H7tqCpKbTxSgT4MetAmKM&c=120&d=600&e=&g=bf2746ad64922df92a36517ba080fc4b%2F8248446331798415938&i=71725%2C29981%2C21630&j=21%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1685634518397&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1gsk73xr5717r3wt02p6v5vnh8v4zfmeq2c3gje788bjbhnszfrpxvjm81g7cc2nz255te93ryjj3kkmb68f358f0fnb1mgsmydtmbybmfgwnvkgy444hkm6c0574f6d8dfa6d9axzb9bbhy2b4swp4frknkafrkn9n43an3y1z0yp9sptq7qtnz5cwwsz6tfxnq8g16xq2b4dvp3pcvd2cnmxj4tk8d289hvy768qxehyyfwmr12t16gvqveyvvqqhapqya6e14zk74a3cesw0qa4%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCCzdZ0r14ZJbsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSFAk_QkVhoMQF4FpBrIh4d_96t1lo09_NWbzPp7lG2tQI1aWW3_PxR-4R65_zMorz3LWfRQrcsCPUaIA2XX7K-G1udF6GXISECHtnW1HzPwS2P3v60f0rjsTuCL5MNBCGVDoIwH8AdY_4-d04CAkB5k6_Q_f3vLUHqmJL0Rq5dAkMg4dXI6Ij18GFU6IJCjm75kqw7xbXLWMT2m8_oZMYEAF_3aup20TBrcjEvR0_ralHmbmW96sJFKyotV20HZEGrcHgQv3Mz03HSQKCmdOGr7X_yZSNIHfh6xvZF77TbMSba4fT0wxgn49TyLTAymCgQnooOiMopABV8b9IH-4ihdaWhTf-WyeAEAYAGtoyOx-LazYXwAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_0GPRMhVzuVGjgwiOiV0pp-xeC9fg%2526client%253Dca-pub-6266313190087173%2526adurl%253D&y=1&s=&z=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.148.9 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 01 Jun 2023 15:48:38 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H3 200 90E11D2E4CFB32857DB7C2E1317DD53401EA4F6F6F9CD68E6E871CA9D0C876402E8B3C561F20D09E5FFCF6D6F6634B28F60F47276020F60158747BE09B58F826
assets.ad4m.at/logo/ Frame 170B 36 KB
36 KB 71ms
69ms Image
image/webp 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/90E11D2E4CFB32857DB7C2E1317DD53401EA4F6F6F9CD68E6E871CA9D0C876402E8B3C561F20D09E5FFCF6D6F6634B28F60F47276020F60158747BE09B58F826
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197862%2C117569%2C19769&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb%2Ck7Vh5f3fD2kYa4HwHetBtxPrtZSjTm3baj7m6%2CppXa1fgfpAwfkH4HmtztQJjt9SRT8WwUAQkr&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW%2CzR7CRfYfk3KMFpHBHMtJC9dGtVSwTQ2GCrp6Y%2CJgKFzf5fqjZhBH6H7tqCpKbTxSgT4MetAmKM&c=120&d=600&e=&g=bf2746ad64922df92a36517ba080fc4b%2F8248446331798415938&i=71725%2C29981%2C21630&j=21%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1685634518397&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1gsk73xr5717r3wt02p6v5vnh8v4zfmeq2c3gje788bjbhnszfrpxvjm81g7cc2nz255te93ryjj3kkmb68f358f0fnb1mgsmydtmbybmfgwnvkgy444hkm6c0574f6d8dfa6d9axzb9bbhy2b4swp4frknkafrkn9n43an3y1z0yp9sptq7qtnz5cwwsz6tfxnq8g16xq2b4dvp3pcvd2cnmxj4tk8d289hvy768qxehyyfwmr12t16gvqveyvvqqhapqya6e14zk74a3cesw0qa4%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCCzdZ0r14ZJbsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSFAk_QkVhoMQF4FpBrIh4d_96t1lo09_NWbzPp7lG2tQI1aWW3_PxR-4R65_zMorz3LWfRQrcsCPUaIA2XX7K-G1udF6GXISECHtnW1HzPwS2P3v60f0rjsTuCL5MNBCGVDoIwH8AdY_4-d04CAkB5k6_Q_f3vLUHqmJL0Rq5dAkMg4dXI6Ij18GFU6IJCjm75kqw7xbXLWMT2m8_oZMYEAF_3aup20TBrcjEvR0_ralHmbmW96sJFKyotV20HZEGrcHgQv3Mz03HSQKCmdOGr7X_yZSNIHfh6xvZF77TbMSba4fT0wxgn49TyLTAymCgQnooOiMopABV8b9IH-4ihdaWhTf-WyeAEAYAGtoyOx-LazYXwAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_0GPRMhVzuVGjgwiOiV0pp-xeC9fg%2526client%253Dca-pub-6266313190087173%2526adurl%253D&y=1&s=&z=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a2b9eefee68fa18c6be3c3bbe11d769b5affc01b84ea94c7ec68ae4ffacd858a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:38 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2162673
cf-polished: origFmt=png, origSize=62828
alt-svc: h3=":443"; ma=86400
content-length: 36446
cf-bgj: imgq:85,h2pri
last-modified: Tue, 18 Oct 2022 15:02:47 GMT
server: cloudflare
etag: "e12c1a9f1887c09d377658838eaaa06d"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rD%2BvlqpJc8Ai91Ksc8Gu%2BV%2FKaN9D4MNYWN%2BlxxV2VK7LwQNbrFMW50JiiyrDSX7zjnhWxI7Gbe1mbEJ%2FYufga6WxwPI1OtoMupbA5FvbpRBbgSIz7YFBe7SlOXottbLYcCFIGw%2FwjbJkTBMx"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7d089a1e09a03a86-FRA
expires: Fri, 02 Jun 2023 15:48:38 GMT

GET
H3 200 287435BEDBEF5210566F91ED2E6D57494D1CBA241E887A111712FB8ADF6747B3B44CBC7EE390AD74BB6985CDD69339A9B2EDEE7334ACD70F503D0812F8C7EBF1
assets.ad4m.at/ Frame 170B 28 KB
29 KB 77ms
75ms Image
image/webp 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/287435BEDBEF5210566F91ED2E6D57494D1CBA241E887A111712FB8ADF6747B3B44CBC7EE390AD74BB6985CDD69339A9B2EDEE7334ACD70F503D0812F8C7EBF1
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197862%2C117569%2C19769&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb%2Ck7Vh5f3fD2kYa4HwHetBtxPrtZSjTm3baj7m6%2CppXa1fgfpAwfkH4HmtztQJjt9SRT8WwUAQkr&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW%2CzR7CRfYfk3KMFpHBHMtJC9dGtVSwTQ2GCrp6Y%2CJgKFzf5fqjZhBH6H7tqCpKbTxSgT4MetAmKM&c=120&d=600&e=&g=bf2746ad64922df92a36517ba080fc4b%2F8248446331798415938&i=71725%2C29981%2C21630&j=21%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1685634518397&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1gsk73xr5717r3wt02p6v5vnh8v4zfmeq2c3gje788bjbhnszfrpxvjm81g7cc2nz255te93ryjj3kkmb68f358f0fnb1mgsmydtmbybmfgwnvkgy444hkm6c0574f6d8dfa6d9axzb9bbhy2b4swp4frknkafrkn9n43an3y1z0yp9sptq7qtnz5cwwsz6tfxnq8g16xq2b4dvp3pcvd2cnmxj4tk8d289hvy768qxehyyfwmr12t16gvqveyvvqqhapqya6e14zk74a3cesw0qa4%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCCzdZ0r14ZJbsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSFAk_QkVhoMQF4FpBrIh4d_96t1lo09_NWbzPp7lG2tQI1aWW3_PxR-4R65_zMorz3LWfRQrcsCPUaIA2XX7K-G1udF6GXISECHtnW1HzPwS2P3v60f0rjsTuCL5MNBCGVDoIwH8AdY_4-d04CAkB5k6_Q_f3vLUHqmJL0Rq5dAkMg4dXI6Ij18GFU6IJCjm75kqw7xbXLWMT2m8_oZMYEAF_3aup20TBrcjEvR0_ralHmbmW96sJFKyotV20HZEGrcHgQv3Mz03HSQKCmdOGr7X_yZSNIHfh6xvZF77TbMSba4fT0wxgn49TyLTAymCgQnooOiMopABV8b9IH-4ihdaWhTf-WyeAEAYAGtoyOx-LazYXwAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_0GPRMhVzuVGjgwiOiV0pp-xeC9fg%2526client%253Dca-pub-6266313190087173%2526adurl%253D&y=1&s=&z=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e944aa2add7d89134400d6d51b9b0954ad0e988edd934eccff8907ab90e1c853

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:38 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 757528
cf-polished: qual=85, origFmt=jpeg, origSize=133780
alt-svc: h3=":443"; ma=86400
content-length: 28740
cf-bgj: imgq:85,h2pri
last-modified: Tue, 18 Feb 2020 10:22:01 GMT
server: cloudflare
etag: "d061ca155f758f490340e147604dc3ee"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=15wXZHDy3LUCe0bKw2u8iQirExtjSycsFg2RIEmRTY%2FOAHVoX1D9FTK3q03HBm91cfkJJZ0Hr9Q3PCu78%2FyhzX%2FeFPH7T4Olsjf5m01SRTnOT7M%2F8gPWRkO8UcMiE3%2Blg%2B%2F4Pw9hdGQv7tad"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7d089a1e09a23a86-FRA
expires: Fri, 02 Jun 2023 15:48:38 GMT

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 170B 43 B
704 B 194ms
56ms Image
image/gif 92.123.148.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2531885&v=14702&q=365825&r=412871&pv=1&pref3=oneidppXa1fgfpAwfkH4HmtztQJjt9SRT8WwUAQkroneid__suite_Netmix_Reach128_WEBGAINSMOSTLY&gdpr_consent=&gdpr=0&gdpr_pd=0

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.148.9 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-148-9.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 01 Jun 2023 15:48:38 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H3 200 04042023-000350227-1456_180_h_1050x2340_2210-anf-l85703e77-0538-46ec-8f60-0a9a3315aa4f.png
s0.2mdn.net/4528404/ Frame D052 19 KB
19 KB 40ms
39ms Image
image/png 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/04042023-000350227-1456_180_h_1050x2340_2210-anf-l85703e77-0538-46ec-8f60-0a9a3315aa4f.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9548364509937149214/1676550659977.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fd8f0d82a2ed1ddf739a0de26cf5e5b22cf04e448a111ab3f02821760f6a0669

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/9548364509937149214/index.html?e=69&leftOffset=0&topOffset=0&c=UBPaKZQ8tN&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:27:06 GMT
x-content-type-options: nosniff
age: 4892
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19287
x-xss-protection: 0
last-modified: Tue, 04 Apr 2023 07:03:50 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 02 Jun 2023 14:27:06 GMT

GET
H3 200 03032023-031527201-1456_180_720x610_stoerer-gbplusdd45da6a-b9ac-4a7c-9506-d902c6e1e866.png
s0.2mdn.net/4528404/ Frame D052 31 KB
31 KB 40ms
40ms Image
image/png 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/03032023-031527201-1456_180_720x610_stoerer-gbplusdd45da6a-b9ac-4a7c-9506-d902c6e1e866.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9548364509937149214/1676550659977.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ebaa028e53ceb3896c63bfbdb52a422b2419be96e936f7416a4aea330e69010c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/9548364509937149214/index.html?e=69&leftOffset=0&topOffset=0&c=UBPaKZQ8tN&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:46:53 GMT
x-content-type-options: nosniff
age: 3705
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32039
x-xss-protection: 0
last-modified: Fri, 03 Mar 2023 11:15:27 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 02 Jun 2023 14:46:53 GMT

GET
H3 200 WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js Show response
pagead2.googlesyndication.com/bg/ Frame AC96 37 KB
14 KB 43ms
43ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ae70268abe00d0f5f9a58ce23f5af80fd5f8d9e8b5a647855901f5321cbd23a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:09:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5939
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 31 May 2024 14:09:39 GMT

GET
H2 502 dt
dt.adsafeprotected.com/ Frame 9E03 0
0 106ms
105ms Image
text/html 2600:1f18:1aca:4282:9f3c:fb6f:594b:b7a8
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=990511&asId=ab6dbb93-ecd5-ad61-1a5c-de594726c212&tv=%7Bc:eiMbMJ,time:1498,type:e,im:%7Bpci:%7Btdr:422%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:1498,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:43,wc:0.0.1600.1200,ac:NaN.NaN.300.0,am:sp,cc:0.0.300.254,piv:0,obst:0,th:0,reas:l.h,bkn:%7Bpiv:%5B1487~0%5D,as:%5B1293~300.250,194~300.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:475,fm:tFWCEmd+11%7C12%7C13%7C14%7C15%7C161%7C162%7C171%7C18%7C191%7C192%7C193%7C194%7C1a1%7C1a2%7C1a3%7C1a4%7C1b1%7C1b2%7C1c11%7C1c12%7C1c13%7C1d.990511-61634100%7C1d1%7C1d2%7C1d3%7C1e*.990511-61634100%7C1e1%7C1e2%7C1e3%7C1e4%7C1f1%7C1g%7C1h111%7C1h12%7C1i111%7C1i12%7C1j1%7C1j2%7C1j3%7C1k11%7C1l11,idMap:1e*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:45,sis:585%7D&br=c
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:9f3c:fb6f:594b:b7a8 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame D79E 0
0 79ms
78ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstP5FmfL8i2YnCk4EecmGIrRL95AJ4y210Xx_-O89SybYc_1ao-Gk-E3RHDbS11fc-TPaMXfPPc7MYHiA3l39cuE5_Ftkj7gQTVCcubeX8Q2Nme7cpV8FqWJdn4FpoaFIkwv5nqYVNUItV26R33W_khjIFpR5MdDr3fcg3yM52NSNTYDUSyIBPUeHkETNTN0MZiT09DbEFmEWMjPuMh0wE0Ro3psQJmreskMMbtDO6NIfN3C05PMXvcx84T5LJPWOgiGrG3Ft4h7GRMbPh-_gCsL_VLsLCGVbE8hKO71NZ8IHEWsS_gKhFneRpZXvL9I5dryyvbRRKFyDLfl5C7cM5EryOLrP9XJtFDuTIfcfZdr889KV99_9E0DdRq1a-60cmAPi7DKpVDcrsCfEqXtmPA12b8irnjpIjD1kAcsCz-BipinhMvoDWvD8ZEjRKe7IJ9o3Oh7B0fNDMfzKmvDev1zrpSMQNKeM1Vv7hVqQmrHpwPjZ8dIjYMSzzMVkO5vmJQmygWh1Ee-eJIZmvrUHK2XjYe2qAkSQSIf66osWQHa1mrsYz6tASb1RDE5HuIiXiegkJrestKA8J40386s5YgkrEFP_sLmj49mN7KLzLaTrEVYnS7pc9GlVvGOQUhgEeXyI7mJKB8uIeYlq96iQJAk5xry2AYUZvnGlK6Q831Y13hUUFoYbqkdWZeFKzohS_-PRd6w3UPqznrYT6D-EBVOnRblsIBRhZFKBzCDucuuUEPxuw2GBWb2BbxDf6dPV3vNNg7lIKAxFrFUtKi9FZT7Z8u3TevAEU9WjlFaf3nOKOqOz3zMIZGOb0n2M5S6d2eYA7eSIflupm-8q9TQ0JJ7Y7xfIEoi74CtHt5gBSLveg8tNX26QMi1M6zdS7OrR4mxdMY6j2gDiq-bOOl0uPGTqEGlqmrNOOWxFRqsGjA7cyL8FpRNywiU8N8Ab-Qy70_entgCdY_mOnpvh--fFNY4cXu3mynWrMED6tH3wDvo0v0-pUys0dF0sVfQNIPVprBGCMhjThhOsl6FM6tUFYZORHfkticJ5hBZ1AzgOB75ww0WwT5Pq0kVhV3J9cHIySimDaaTYv-0aE3qIcMbIuTPDvT-Too8nqIqjP5yJbOJ3faMeFWyMg3_PMRURt_zLRf9KiUq7NEBdHI998qJKDcO9k_Du4si67QU28F5LiWKA2B0Z9UJt6gF3VmWQ1uA5NeeHA1v7kL8S7yOvWVJVYwXUKDilE4X5ql1mygDsW6t5XVNG8KTlo2OKhy82kydGezsc-ThZRII5b1TyyhCEcczzlYy2pzS-sfwRZrU8K3C_kp2PXOn0S6KlnXdxI8lA&sai=AMfl-YRYfuLdCnWbnHCpcnf_TnNlxMfs1OV3HFPEDS_am8a4IZyPsxabQbmcbL8SIyUdHBMFwpzAsHNduvBSAWM5gNHuBuJA-DfwfFsr6CCS4LpvxLDsrTZKF_bVUIIreChFtTsovsnaE7kedrP7D06ifPvP3aD_vaS6QD1DTJWVJYonZB51MPO0ymFG1slHM0s00ianJbmGGsiBPcG7CNNAWemSpI3C3qls-WcrOMvRiX58TBkTi4rM5zRrBbZ5Zm0x3lt9&sig=Cg0ArKJSzDrQt-lejMa5EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1305&vt=11&dtpt=910&dett=3&cstd=392&cisv=r20230530.55201&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

edge-star-mini-shv-01-fra5.facebook.com

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:38 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 01 Jun 2023 15:48:38 GMT

POST
H3 204 collect
region1.google-analytics.com/g/ 0
17 B 20ms
19ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-9NTBGJYJES&gtm=45je35v0&_p=222057478&cid=1858218578.1685634513&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AEA&ngs=1&_s=2&sid=1685634513&sct=1&seg=0&dl=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&dt=Farfeshplus.online%20%7C%20%D9%85%D9%88%D9%82%D8%B9%20%D9%81%D8%B1%D9%81%D8%B4%20-%20%D8%B4%D8%A7%D9%87%D8%AF%20%D9%85%D8%AC%D8%A7%D9%86%D9%8A%20%D8%A3%D8%AD%D8%AF%D8%AB%20%D9%85%D8%B3%D9%84%D8%B3%D9%84%D8%A7%D8%AA%20%D8%B1%D9%85%D8%B6%D8%A7%D9%86%202023&en=scroll&epn.percent_scrolled=90&_et=58
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-9NTBGJYJES&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:38 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.farfeshplus.online
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 link.html Show response
track.webgains.com/ Frame 170B 2 KB
2 KB 138ms
73ms Script
text/html 35.179.1.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=3641431&wgcampaignid=1384975&js=1&nw=1&wgtarget=https%3A%2F%2Fas.ad4m.at%2Fad%2Frct%3Fed%3D1jxp47y2avtvkdy63cj3j3z41y81mm0wgcrpnam2a914zdsz96ccf9mfg70x8pr22bks03ysfyq39051906z8xzm47hdfxqkw9s5jr4jmn85zxbbkp87mg7xw3afacxd2ajy1831knp3vc1ec6tw8fkyd066ed3mer2k8rs5ff7ej9n71mmpahz0k06a1jksvmd2w6g523wfpc9pdfqdretmwxzg4wfr6egytfewx8bbatdcgh2hsb0992kqbz86n0v0%26a%3Dhttps%253A%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1gsk73xr5717r3wt02p6v5vnh8v4zfmeq2c3gje788bjbhnszfrpxvjm81g7cc2nz255te93ryjj3kkmb68f358f0fnb1mgsmydtmbybmfgwnvkgy444hkm6c0574f6d8dfa6d9axzb9bbhy2b4swp4frknkafrkn9n43an3y1z0yp9sptq7qtnz5cwwsz6tfxnq8g16xq2b4dvp3pcvd2cnmxj4tk8d289hvy768qxehyyfwmr12t16gvqveyvvqqhapqya6e14zk74a3cesw0qa4%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCCzdZ0r14ZJbsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSFAk_QkVhoMQF4FpBrIh4d_96t1lo09_NWbzPp7lG2tQI1aWW3_PxR-4R65_zMorz3LWfRQrcsCPUaIA2XX7K-G1udF6GXISECHtnW1HzPwS2P3v60f0rjsTuCL5MNBCGVDoIwH8AdY_4-d04CAkB5k6_Q_f3vLUHqmJL0Rq5dAkMg4dXI6Ij18GFU6IJCjm75kqw7xbXLWMT2m8_oZMYEAF_3aup20TBrcjEvR0_ralHmbmW96sJFKyotV20HZEGrcHgQv3Mz03HSQKCmdOGr7X_yZSNIHfh6xvZF77TbMSba4fT0wxgn49TyLTAymCgQnooOiMopABV8b9IH-4ihdaWhTf-WyeAEAYAGtoyOx-LazYXwAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_0GPRMhVzuVGjgwiOiV0pp-xeC9fg%252526client%25253Dca-pub-6266313190087173%252526adurl%25253D&clickref=oneidDXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjWoneid__suite_Netmix_Reach128_WEBGAINSMOSTLY&viewref=oneideYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpboneid__suite_Netmix_Reach128_WEBGAINSMOSTLY
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197862%2C117569%2C19769&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb%2Ck7Vh5f3fD2kYa4HwHetBtxPrtZSjTm3baj7m6%2CppXa1fgfpAwfkH4HmtztQJjt9SRT8WwUAQkr&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW%2CzR7CRfYfk3KMFpHBHMtJC9dGtVSwTQ2GCrp6Y%2CJgKFzf5fqjZhBH6H7tqCpKbTxSgT4MetAmKM&c=120&d=600&e=&g=bf2746ad64922df92a36517ba080fc4b%2F8248446331798415938&i=71725%2C29981%2C21630&j=21%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1685634518397&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1gsk73xr5717r3wt02p6v5vnh8v4zfmeq2c3gje788bjbhnszfrpxvjm81g7cc2nz255te93ryjj3kkmb68f358f0fnb1mgsmydtmbybmfgwnvkgy444hkm6c0574f6d8dfa6d9axzb9bbhy2b4swp4frknkafrkn9n43an3y1z0yp9sptq7qtnz5cwwsz6tfxnq8g16xq2b4dvp3pcvd2cnmxj4tk8d289hvy768qxehyyfwmr12t16gvqveyvvqqhapqya6e14zk74a3cesw0qa4%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCCzdZ0r14ZJbsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSFAk_QkVhoMQF4FpBrIh4d_96t1lo09_NWbzPp7lG2tQI1aWW3_PxR-4R65_zMorz3LWfRQrcsCPUaIA2XX7K-G1udF6GXISECHtnW1HzPwS2P3v60f0rjsTuCL5MNBCGVDoIwH8AdY_4-d04CAkB5k6_Q_f3vLUHqmJL0Rq5dAkMg4dXI6Ij18GFU6IJCjm75kqw7xbXLWMT2m8_oZMYEAF_3aup20TBrcjEvR0_ralHmbmW96sJFKyotV20HZEGrcHgQv3Mz03HSQKCmdOGr7X_yZSNIHfh6xvZF77TbMSba4fT0wxgn49TyLTAymCgQnooOiMopABV8b9IH-4ihdaWhTf-WyeAEAYAGtoyOx-LazYXwAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_0GPRMhVzuVGjgwiOiV0pp-xeC9fg%2526client%253Dca-pub-6266313190087173%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.179.1.61 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-179-1-61.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: b0696ae4b4b6b19d56f50e7b15a3a76c0a640f4ff5b70d9a9b0b6717ad2d5eed

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:39 GMT
last-modified: Thu, 01 Jun 2023 15:48:38 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Thu, 01 Jun 2023 15:49:38 GMT

GET
H3 200 04042023-000350227-1456_180_h_1050x2340_2210-anf-l85703e77-0538-46ec-8f60-0a9a3315aa4f.png
s0.2mdn.net/4528404/ Frame 8854 19 KB
19 KB 38ms
38ms Image
image/png 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/04042023-000350227-1456_180_h_1050x2340_2210-anf-l85703e77-0538-46ec-8f60-0a9a3315aa4f.png

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fd8f0d82a2ed1ddf739a0de26cf5e5b22cf04e448a111ab3f02821760f6a0669

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9548364509937149214/index.html?e=69&leftOffset=0&topOffset=0&c=bnyTc2AwWf&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:27:06 GMT
x-content-type-options: nosniff
age: 4892
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19287
x-xss-protection: 0
last-modified: Tue, 04 Apr 2023 07:03:50 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 02 Jun 2023 14:27:06 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C902 0
22 B 70ms
68ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=1569644147340&version=m202301230201&ct=76&x=1&cor=3952829422269839400

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 04AB 0
22 B 69ms
69ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=6169885290492&version=m202301230201&ct=76&x=1&cor=16339457621137353000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 04042023-000350227-1456_180_h_1050x2340_2210-anf-l85703e77-0538-46ec-8f60-0a9a3315aa4f.png
s0.2mdn.net/4528404/ Frame D052 19 KB
19 KB 39ms
38ms Image
image/png 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/04042023-000350227-1456_180_h_1050x2340_2210-anf-l85703e77-0538-46ec-8f60-0a9a3315aa4f.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9548364509937149214/1676550659977.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fd8f0d82a2ed1ddf739a0de26cf5e5b22cf04e448a111ab3f02821760f6a0669

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9548364509937149214/index.html?e=69&leftOffset=0&topOffset=0&c=UBPaKZQ8tN&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:27:06 GMT
x-content-type-options: nosniff
age: 4892
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19287
x-xss-protection: 0
last-modified: Tue, 04 Apr 2023 07:03:50 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 02 Jun 2023 14:27:06 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 68C4 0
22 B 70ms
70ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=403480182807&version=m202301230201&ct=76&x=1&cor=5982605649199138000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 441F 0
22 B 73ms
72ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bz-Vu0714ZPGhB8_jx_AP0JOk2AoAAAAAOAHgBAI&bg=!d3SldCDNAAZu7ficTu07ADkAdvg8WgZnnB7pcrVhvIUClbf3938TLMRZYVDY67txI721mmzKHva8M1-3WTcoTY2u2ns6VBkjhm0CAAAEhFIAAAAFaAEHmQL7UCL2Sbhy08vUuTWeiXAGppPqJAu-CVkh0QnrQ6lkXiAzvAJSujGsblNu4PXTsORkbP0iOkKcj-2Z67CYf9e3c8VmgUMiTCz9wZps7u6YCTTNBtMiyyitRwQARZXG9fOaDytIDccV4lAVbeCAa6Zm7T2Kv5oa-7jT2ZQn3Fwq4ppUHmlVM_cbOFYiAu2YPmEHYKTpf8f8fX23vN_zEb0THLfhyatkQiNBgG-r0HI6xNrdcFhyY8bE8ThC20WQpQkJAt9VXDXzqyeSKvLkJtNPakEZAV4XZqwEnW3uxQJ1ErnU0NLTFfCLpKkXvnd9LvIuropN5D11K4gkZMDJ1gDquplO8r3m27U2n7YmA_re_6z_audIsWTtVKgUIC8rjsZRYpyyKxPLtrEPirQost4uV-jSShSfP6oM-5w6zR9aO3lI1ojfnMG4wt-bKhWiVjZfNWbUEmOF68RLJGwpd6EYWRFs7Z548hP6hKMvHavGIRl3txHF0cKdjR-L5l3Ck54Ls33KRB5CSilAs-MzSQZakv4ZPvs7IcyAxf6ObK9tC32rWYWST2Ah-Y9CNMR1k4xC8LPBQQTdwGLn8-HK3zJo9RwKOCIv6FcuWKoE4kbcGZ2MKfP7_7frHY0M_pY0UKCVPv3re4bYidBohpyJkMMK0VnzyMwFUTyhS5RnHaJcsXwi1vfHQBlKF6nltbEfq06_4A_iXxXCVt_8SQTOcWAlLU8P1ic9qmpnFzlro0hbZZIm5Gjx956kM0FHw2TW9SdijVjiUdMFFRlutgImSH69hwkc52woooykt2-7ajyoaQWPpNpdBdR8inftjYcNm-aWiYDYRAQj7mT9TN1cau05vDSaExlnd0FsLKyPEiZv3Si7UpJS2Mdrg3GQZ1rE5G-nJwL_GWBPx4Ep91bp55Hck6OnymneAYqtONL0P7SH8IweCBRgp3qpxSQOrdta_kvI22HDR7odGTJud2IIOgfwcGqcz_qcE64xBsG-LuyCeo8fgvdp8bhTL8yhrg

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 30AA 0
22 B 74ms
73ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B47It0714ZNOUFqnbx_AP9sK74AMAAAAAOAHgBAI&bg=!QUKlQhbNAAZu7ficTu07ADkAdvg8Wn7QwMDqNR9AJrlSbM5b73sCxpz3oz5gJM9b1gRTLfVoH6NOk3Y4DU_wpG4XdFoddCnhgqsCAAAEHFIAAAADaAEHmQL4Ivj-_VRGTWUtIqCTEizXlF7gGPsVcc6qHFvBvmfnbwqRmB0A2OFWHALtl5s90pV-rxSbY-R-Kz1TXHW__IaX4EAZPbmdeczHtzDAiWFhJNr3fcBMWbo3iykl-rhHLofWyGpGMmzrue3RodrfwATTQhLLS5NVBanVUC0U1y8sHKH4kj74MFd01g2jfXnjBQP-haWbb5GRJMGHniB83OBOcipBvy0yPYFqfH2AyLvQWQmlWsM_u4M0t07_ZGJHx4MAPVHzpDtAyBMJX0UGmo3J3xKEPj9nto4pJBw_dXAAKT5pee6fkD1eJ0ZVuow-seO7ACYHmCJlAT_wYtxWfiaklILhC-eY7Ny3es2PNijUZrERTc-R8vO8dyGx2ecQOrasVecW_a6Zlazy6XuHuIlvUl5rGwAO9UCnnjndcA-XjeoxcXLKPVCp3XEgIr18tESiPoamhUkvGCCpeNYI3DWE--VwbuTi8aflfkQt4ST25naS2-FX8YBMdsFoWfo9O_6GrBJaINmlYAGKiKlwxvJoiLi0idU5MeccrUxm8W5LZ4-Hp5OevBsHyVVxUCrIu_XIJgBQUSYe6oUrY5ItEWi2EsdAMxkjWI8klnMAKiVGCJ6tKDAQYxP8ysKO6sVodzRbyP3z72YnnTl6SodBLDgYbtrDU9ZyvmyaJ3Uim-4b6OudP_uYB2bgOM7-7PZOrIr6iIxrq0DxFZz3n1EMtzOKEwyjk0Kb_oQdTaZomJS3VVYUyEvvlw_Wt-W6KBstPuGi3eK8azPcsRYHnGxZcSdnCJG7VGbY3BetwFveWzI3SLDX-hGH_FIg5ch4SvIY1FIjT_lyToycInqF6nzlpxiZhdnVnTEQyNs1Peu3vZKralgN4HVOwtsrPASigppUyjOI_fIxc0bCgkEJObrAg8tdOp8ySnKokzhZ0NdpmMPTLkHgkr_DRsZO61d4r7sIi9CB-Fu1SFf-Zyv9DG1bCUhAxlKq7rW6aGW6g2Ztni5dn1CyrZm9lPRrQQ

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 170B 85 KB
31 KB 64ms
8ms Script
text/javascript 18.66.147.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=3641431&wgcampaignid=1384975&js=1&nw=1&wgtarget=https%3A%2F%2Fas.ad4m.at%2Fad%2Frct%3Fed%3D1jxp47y2avtvkdy63cj3j3z41y81mm0wgcrpnam2a914zdsz96ccf9mfg70x8pr22bks03ysfyq39051906z8xzm47hdfxqkw9s5jr4jmn85zxbbkp87mg7xw3afacxd2ajy1831knp3vc1ec6tw8fkyd066ed3mer2k8rs5ff7ej9n71mmpahz0k06a1jksvmd2w6g523wfpc9pdfqdretmwxzg4wfr6egytfewx8bbatdcgh2hsb0992kqbz86n0v0%26a%3Dhttps%253A%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1gsk73xr5717r3wt02p6v5vnh8v4zfmeq2c3gje788bjbhnszfrpxvjm81g7cc2nz255te93ryjj3kkmb68f358f0fnb1mgsmydtmbybmfgwnvkgy444hkm6c0574f6d8dfa6d9axzb9bbhy2b4swp4frknkafrkn9n43an3y1z0yp9sptq7qtnz5cwwsz6tfxnq8g16xq2b4dvp3pcvd2cnmxj4tk8d289hvy768qxehyyfwmr12t16gvqveyvvqqhapqya6e14zk74a3cesw0qa4%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCCzdZ0r14ZJbsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSFAk_QkVhoMQF4FpBrIh4d_96t1lo09_NWbzPp7lG2tQI1aWW3_PxR-4R65_zMorz3LWfRQrcsCPUaIA2XX7K-G1udF6GXISECHtnW1HzPwS2P3v60f0rjsTuCL5MNBCGVDoIwH8AdY_4-d04CAkB5k6_Q_f3vLUHqmJL0Rq5dAkMg4dXI6Ij18GFU6IJCjm75kqw7xbXLWMT2m8_oZMYEAF_3aup20TBrcjEvR0_ralHmbmW96sJFKyotV20HZEGrcHgQv3Mz03HSQKCmdOGr7X_yZSNIHfh6xvZF77TbMSba4fT0wxgn49TyLTAymCgQnooOiMopABV8b9IH-4ihdaWhTf-WyeAEAYAGtoyOx-LazYXwAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_0GPRMhVzuVGjgwiOiV0pp-xeC9fg%252526client%25253Dca-pub-6266313190087173%252526adurl%25253D&clickref=oneidDXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjWoneid__suite_Netmix_Reach128_WEBGAINSMOSTLY&viewref=oneideYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpboneid__suite_Netmix_Reach128_WEBGAINSMOSTLY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-120.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 00c5621a3f56c052959f8f0591b65e893f132b49b1447fde20767966cacbfbfe

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:20:04 GMT
content-encoding: gzip
via: 1.1 24fc4e03b1de2a14f79be2422e46a318.cloudfront.net (CloudFront)
last-modified: Wed, 15 Mar 2023 17:26:29 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P4
age: 1716
etag: W/"876c293e6c37046ecb0c11ce2e276942"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
x-amz-cf-id: qhIVKJ-rv2Lj--HUseT1PJrnYd9Q3mgbKtYDJgngHk4isOM3avDWFw==

GET
H2 200 1619604937_fPkEZHu3MNy3GC7XuV3lA1s9E5XlSAcF.png
cdn.track.production.webgains.team/286305/ Frame 170B 15 KB
15 KB 48ms
8ms Image
image/png 99.86.4.36
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/286305/1619604937_fPkEZHu3MNy3GC7XuV3lA1s9E5XlSAcF.png?Expires=1685634819&Signature=DymCIq~IZ~7vu57gZ44J5udM6Pd8j9VzKmQzEuGOQeqT-1JGduQnJUrGhBe0Foa5HSC5gBqRBMlPlUMLYt3wARboU099AEeY6UPRUBb4XiJ~v2Nf2GAIFXT4jtlw-oXwnkXSvT8A5e9IVqGvrkBWeCVU8GVJCsANlABxxnHe8Y9Pv4NhGypserfAHCL9~0TxfJkLyFQjcb37NjoS6ndKQvaK02mxR5OefW79gkJJEOP2-8I-KjD-s5076mYW~T6tunSt7B9Qx5AiXh2Nws1Az6ygK16wFEawxdyne-K~KhOFn5T-5myBy4GimwiHYjkCjXWk71bxVTTfTxMa4PiU7w__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197862%2C117569%2C19769&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb%2Ck7Vh5f3fD2kYa4HwHetBtxPrtZSjTm3baj7m6%2CppXa1fgfpAwfkH4HmtztQJjt9SRT8WwUAQkr&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW%2CzR7CRfYfk3KMFpHBHMtJC9dGtVSwTQ2GCrp6Y%2CJgKFzf5fqjZhBH6H7tqCpKbTxSgT4MetAmKM&c=120&d=600&e=&g=bf2746ad64922df92a36517ba080fc4b%2F8248446331798415938&i=71725%2C29981%2C21630&j=21%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1685634518397&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1gsk73xr5717r3wt02p6v5vnh8v4zfmeq2c3gje788bjbhnszfrpxvjm81g7cc2nz255te93ryjj3kkmb68f358f0fnb1mgsmydtmbybmfgwnvkgy444hkm6c0574f6d8dfa6d9axzb9bbhy2b4swp4frknkafrkn9n43an3y1z0yp9sptq7qtnz5cwwsz6tfxnq8g16xq2b4dvp3pcvd2cnmxj4tk8d289hvy768qxehyyfwmr12t16gvqveyvvqqhapqya6e14zk74a3cesw0qa4%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCCzdZ0r14ZJbsCM-Xtwe2upSoApDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTYyNjYzMTMxOTAwODcxNzPIAQmpAiqsz0j59bE-4AIAqAMBqgSFAk_QkVhoMQF4FpBrIh4d_96t1lo09_NWbzPp7lG2tQI1aWW3_PxR-4R65_zMorz3LWfRQrcsCPUaIA2XX7K-G1udF6GXISECHtnW1HzPwS2P3v60f0rjsTuCL5MNBCGVDoIwH8AdY_4-d04CAkB5k6_Q_f3vLUHqmJL0Rq5dAkMg4dXI6Ij18GFU6IJCjm75kqw7xbXLWMT2m8_oZMYEAF_3aup20TBrcjEvR0_ralHmbmW96sJFKyotV20HZEGrcHgQv3Mz03HSQKCmdOGr7X_yZSNIHfh6xvZF77TbMSba4fT0wxgn49TyLTAymCgQnooOiMopABV8b9IH-4ihdaWhTf-WyeAEAYAGtoyOx-LazYXwAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_0GPRMhVzuVGjgwiOiV0pp-xeC9fg%2526client%253Dca-pub-6266313190087173%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-36.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 60bf02832688d14251ec1c7b8acfda233a91f927f26c7202bdaba781a1f0fcdf

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

x-amz-version-id: null
date: Wed, 31 May 2023 17:37:35 GMT
via: 1.1 a56d6b55603697d6c44b19d4f907baaa.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 10:41:35 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
age: 79865
etag: "d4e8f970f24f6d19b53aa92b1907c1ef"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 15054
x-amz-cf-id: Ncc_xvrE-mcZh0Fmwwwv3iVznrf1XNSxTV2dQ-QoPeyTcSnXjkEnog==

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A623 0
22 B 72ms
72ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BGvC10714ZJPRFuPRx_APj-evuAwAAAAAOAHgBAI&bg=!1tWl1YHNAAZu7ficTu07ADkAdvg8WhlYarDqp3BlfMe3_V5xq_nHelNgOhK52fICcTFNon_znDY1jBd0s0qUeMgPD3pz7ETIMTICAAAE_lIAAAAEaAEHmQMmr_LVPy0x7EuGFFqQ93Y9AvjGzC8nve48kUdqhwad9Pn8eFbG9U9JONcyHw2VWLsF3ITOYd1iNWmFgtPhYkpwL85ykggymJmjdnTGJnQRV2tFLxOGDUpDEImlR3aZTJpeh2ubR0b4yTXG3v349DjkHL3_T20LfrroPCMyf1SGpcKxwheFU08T8ZCjReYh0zN19mVRuMrvrF0B02Z9TgowfDlXGZxbGKZP1HPj7W5dco0gKyaJIQL8bdMiYPYxc_nycDyiwRoIz5IYck9pJNC09H1-eM9SLk0auyvp7cIeY3qyY99CJeSe-d-3bMmH_G0b8tP1HiisLQMY-cfAYgW1ZcXnt7khhPcrkjg6pBHorG8AHwZLtTXplVYn56kADhMw7HYbd6NWThxW_AlHMophWq5hzrmSJCu1BZYHqQNX0z377UZmY96hc9ntAavZYnmqAf-dsAC8vR9s9PWaY8LWBr9RPI0NCDDRjN7OFInKpTfNBNjrLkGwI_a7ERWkLZ66Gcu2PfDQSXjAqQkhwUm0RcW2-8H006aAeNhQ4LOkSUuw-ZZ2BuwlJMYB6_uK7PnXipvbSrzGbpBujjwcE3LMgp4jmc5-2fPaRNlcffl9Ka5mzk-oWB12Q_BNez4xrnHxFKPyV36Zc8erHzhNo6bfZeIVdMEDY0EhrmaCdrKbHpe6W4E3O0A4NI_tasQicODk45QgTqDVs3Au9HjTvSPaRfUtLDDmj4Bpj5IqM_XUZcQb4DxGYfdIW8MKSSJsRWmw3YIS6-oyf9C5N2MAuosKTLFcSwn2UxIGCZogK92YcUL4B5s_ctSQtHw1xSzRnuol7e0RpQ6RFMNlhtN0I31YEFSWy3-N0mQWG7IGZI1TQMp__17M9r1sqgi70wyUqBX_OGHRui00Tqn2_SP-94BlsUcuW6f4WvZRL1i7VtzvHgsqC32xXppU-c9adz5cAdLHaNB7u3adQFgP7sAcrMRw8n1-alfPD3Tdr4hBVdwozfQk32J2Pg9drhzJZ2H0zaqRVmCWeww5I82bagFj-StxvudZti2YeCNAC2dt5u2Jhn6D4YLzKMs

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1A8C 0
22 B 72ms
71ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BQk_00714ZJW3FpPfx_APp56s6AoAAAAAOAHgBAI&bg=!ammlaT3NAAZu7ficTu07ADkAdvg8Wk9drm6YNkS7j15_1KXISxr4vsnoSJ1JSJsyMMIcjZqd0H8-W0ig6iA5rJe-H6Mk19H58b4CAAAE9VIAAAADaAEHmQLzM3rbD1Tsb6ZtG6ma6AACoEH65n8PCuO2nzQ3VwliXutGCvFl9jGyQbTmhfP8HlXCC6W-hVmPXbMAXhIR0k9aqzHI565YcjQFpjHXwwqxoTm0EE1IiqltUSmQJ1Duvt-Qc3-RDWMBX8kYkGH0oiqQYlINYtDQkAxoDsPCZUhyoblRRMYUMAInuD7uH6u1qgjbEHntCiRCPHSDuatcOWmfhwoSMhxNgId0Tj0iEz0Yj6EujBy8v5YstZOA0qPFwRaRP1YUNb1pgYz9Pha-ceyD5NsrH5Ns_i_yyc40YndDlF1R12JANJQisE0zublqrWYfdPCFshMK5qEFw5cdB-regbSOFYZCzCHqCeeUA3weDALk39ytVToZyY0LOSBF6rEGtQd8oOxqqOCzFB1CvhAt3wcMqQM1TCx3KOaKQ5kFytFEhupwTxS57wD_0AenNFvN9EQyftbf0sv8KDU8rd0OX4VZT82gLGOXGG9qwH0Gw0CaM38SmoeTVYW9FTmAzFpy0ArbGYBP2F7AwOTktR6dnwsg7a479WrQGPEElXlk94QLXUxODXIX4zlo_uz08qiK_vmR8v0HTitTABIizpD52D89TjRe_CUGmx6SSRXfuHShVA96h5cl4uySSAYioTRqhjHqvl7U3Lm-0Pe03gdgo8XACG_KgTnF1-QpffNL_UqE7s0WNPbHSWaO-1kAGw2SWzeF7E_rcj48DVe4U1sazOuH3fePX3K8vbfACPDPGrk_Mhy0r2lZmvuiTON4uTjtH_jO81C-vPXNB79wiGcro_F04zDXSUif6I5DkSgOromANa_P31pnjVwHbY5yv_As79H_lKoxPQC7A7inlccv6Ms4PHA7RP5Ea6iLOtTRakxlafLT5bioXd_ZjF5955MPi3RmaMnMyYFPR3K3FD9N_qU-jb4UDRAMGsWBQH10lyfOx-hyUKfToT3TQBLV1CGhFRtOgBX8hQV8pA_ny3adLifBlxPSKBQcU6zhl4z2ao6ayM0

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 9E03 43 B
216 B 105ms
105ms Image
image/gif 2600:1f18:1aca:4282:9f3c:fb6f:594b:b7a8
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=990511&asId=ab6dbb93-ecd5-ad61-1a5c-de594726c212&tv=%7Bc:eiMbYk,pingTime:-10,time:2217,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwwfHxNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTE0LjAuNTczNS45MCBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1685634518323%7C%7C18468e8f7cf8de0ec6e767cc8e2a2440%7C%7Ce2cb1dcbe7da8721e3ae9a3fd2b4449b%7C%7C02c99fc480b15338d3e70803ae07ac66%7C%7Cb52342ac5f4da239f736f65e806ee7ae%7C%7C28a0201375772bcf1e2c00b0febed926%7C%7C41ccb2da6f7dbf661cd3bbc45c1db421%7C%7Cf40bd9628cb8005903301d96be2266e3%7C%7C1663701684,sca:%7Bspg:542a5b0c-463f-8735-94fc-54bfb4d3dc77%7D%7D
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:9f3c:fb6f:594b:b7a8 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:39 GMT
server: nginx
x-server-name: dt11.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9E03 0
22 B 71ms
70ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=4898934514022&version=m202301230201&ct=76&x=1&cor=6941547220702214000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2BA3 0
22 B 72ms
72ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B1yBy0714ZK3nLNvjx_AP-a2b-A0AAAAAOAHgBAI&bg=!ExClEETNAAZu7ficTu07ADkAdvg8WizP08U0uTVTEJ9i38Qe3V_sZtaIt4aReyboA7HpbuKRkxS_sdpw9yKrhpKg9czZiTO8_MACAAAD1lIAAAAMaAEHCgAXmezq6W5zsl4tHKvd-nlr9YaqpVmJR2mZAzT2k8kwq0EGqzw54jOgGmnIG-PPRx9IGIjr9FhEngBNqybNwK2-FP2GMbSA7-zFi-_fsl7LmepnxCy8YBaKM5qDueO9Zou8Hvmr8w23lkLoF-pFLub2l8eyY-Tj4lnRzqd7M9mUApiQmSEc7xzzNYSeuJZNK7pJ8xAZMkua66IZUhdObJtyqHN8IlqIvgWxkC3y3lVlmWgrP3KroyuE6Om_wFrlth1aHq_yRwA99J6wuD-FSE8OZFZoj6KsTW58EhUTxIaUQ-4pftEOa6diIEbSKe6aJrqLpGa13aK3p_6ywL47JlHWxE6ltbRuJ0AsAQHhk8q1HDsei19QwDMPp75ZuIv0eEyZjBH1jhTFJZ-YcwTouYbnIQ_Yrvep4QacXgyHyF7rHfhrx5k2Iac68KaWKn2ZEsj9nKG00Bo6AnWszcpLTMSAciiju4j-B3MEz0Qy86pmYN721mENQXn4N-Rjyau9NqhHkw_HFMQwEPsya43EeZ1KuXru7aW7QpBAffYkmZQ7O_3Y38r9q1gaSFQcH6JxmfbYtNwsZcKdXGwuosANIaH2j68sJTCOK8oIryYATC_d6QqaiN8-TvKHZu80QTzpmK3aowuzOYpRimns2bMJNCJ6IDdzTE5xaPG39syAMMh7mmIsaFavr1o1Y-mKtaZudcuHkOczACHY5nvvcjyKBRZl_NLIbGAWKj7NVGITuBxmL84gap82V_V3WQHNF0n2iIb4uT4Ff-eVc9JAb1ZTV4eAHHO_TbpK0Ir3-g3MLDt9DXMj2mTc0IrTG0BT_NQhnraiaun4YclRIWB4DnIPDVJW2_U_nw0tl0430I-h7PpSAEjdt56JW5UBLwkdD-3jI3USM6yqBJNwfGIA4DcZtO6WUSuVmfrC4GNaL4GP5s9gArO8Wp_UHjEQgzoTwc4q-qDBVMvlcZXERSbIYCDNjprxuaXIAakog-zkUMcr5xlGKRLjF698iptwHKgTCI0SeQsMcVg7TQmI-0PbYtEAKDaKX78uZ9HEnpGGIQeWl4opNvmsioPQpy-fNdfX0d8jcsZUAlokuELHmu6IUPmuM3JPo9TTt8pvjLXQiTs66vfd

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame D56B 43 B
216 B 106ms
106ms Image
image/gif 2600:1f18:1aca:4282:9f3c:fb6f:594b:b7a8
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=990511&asId=542a5b0c-463f-8735-94fc-54bfb4d3dc77&tv=%7Bc:eiMbZG,time:2411,type:e,im:%7Bpci:%7Btdr:1461%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:2411,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:44,wc:0.0.1600.1200,ac:NaN.NaN.300.0,am:sp,cc:0.0.300.254,piv:0,obst:0,th:0,reas:l.h,bkn:%7Bpiv:%5B2401~0%5D,as:%5B1359~0.0,1042~300.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:304,fm:tFWCEmd+11%7C12%7C13%7C14%7C15%7C161%7C162%7C171%7C18%7C191%7C192%7C193%7C194%7C1a1%7C1a2%7C1a3%7C1a4%7C1b1%7C1b2%7C1c11%7C1c12%7C1c13%7C1d*.990511-61634100%7C1d1%7C1d2%7C1e.990511-61634100%7C1e1%7C1e2%7C1e3%7C1e4%7C1f1%7C1g%7C1h111%7C1h12%7C1i111%7C1i12%7C1j1%7C1j2%7C1j3%7C1k11%7C1l11,idMap:1d*,rmeas:1,rend:1,renddet:XIFRAME.us.dr,siq:46,sis:691%7D&br=c
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:9f3c:fb6f:594b:b7a8 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:39 GMT
server: nginx
x-server-name: dt01.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BA5D 0
22 B 74ms
73ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BgMid0714ZIKOLZfIx_APt-mGkAwAAAAAOAHgBAI&bg=!aWqlaj7NAAZu7ficTu07ADkAdvg8WuMri_zdmsKQMr1m7x4aPCI75rewgakQU4kHxUNmoyeb4BVatC-kwM2WVW71XOcuiVsPHpUCAAAD0lIAAAAEaAEHmQLsD-s86tqMyliZJ9-mg9vo_ppB4-HBVPA-MvaO6s_o5RwOf4tyKQChJ7NbfD4VUBdqxBJ2SqNlVzzP7cyz3w4rJifEL8NgRwnFyEuVr45wAOIgBC2kMGen3V_Nfo85iSUMn9v7nycUQJie830LFbspszHgdI9PP643qZeYsUSbRheriYC1rGUIwzVrlEfSgI22SRSFhLFFwkgAaS7Fa82zJFM4RGOayBzOcomZPF8tYyYCu7xK7mpTM0rV84iiZ6vacU4gg-FnnquV6KfsYxSA5_RhR30_yUSQTX1rflt6kxQOy8zrEeWXFCJez2Rdtmz88lkCgmjZtvM5WLJX9iu9sLGyBBfjdUUPBJHooGeAM_JUKYhxb1zKnisVeJfq-KgFPIFv-gfkCiGxfxd7RjISy0rlgvIbVIn-moBRJrYoRxLRnx_tDCospptPu6m6nwSbOExWxfyGN8fYDdVP9raFigQt9NW_l5COwIv-ZwbV6EnyGwWTPm6rsL7BW1fft1ls7Vlq_n46oBwlIy67qT0bwvRiQf5vpTB1vTwW8-9pAb0MRjvG3ahUPo2YEWlEkhFCuucJfwCG-WnO81EBS30ACecQhwMAjVe5ii3OIVWhcIEVsr418nqkjDY0NJcfZ0ScIYHMhr5LCJ-o-8vxApOj8uPAH62YjfDOHvCMdHwlkA0akwQsqWwqHFg7K-RJy2ZpG02QnM3KEE7VnkegKux2GHdcZheejF30_eucB3CbaZrTvz2CRtTm0daBez1hBkx5kkaVAaYJ1QG6EMNij9-CwB16ntz7khVKKu9uxghljvrF26Dqe7COx-gRCC31wlZLR7gBl3DbRmkzD5fiWi9AMFgYbuuSxYcpAff9U4p1G5jNGu2TVO9YtyE6DvVIdJBGOm9KgnmDMEypWJe9o_oVMXNLLi88P83dD5n7gZ_bvtr3dDC7lLkL7SJAvipaYQ8Ib7YyU-2SqKzSG7UJVo4HaKoOTe46lJ3yKf8rtg

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D56B 0
22 B 69ms
69ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=9751046546206&version=m202301230201&ct=76&x=1&cor=2198531392341991200

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 95A8 0
22 B 72ms
72ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BPl5v1b14ZL3rB4313wPu6KKQAgAAAAA4AeAEAg&bg=!XV6lXgrNAAZu7ficTu07ADkAdvg8WiSp0qq9Speij3Xvfk9eveDLjft_qalo6CTb1gubFTBXb9sTz2tvRT8hsK8i9UjhqR7ULc4CAAADklIAAAAEaAEHmQNsFksXA91ACv2oZHWXZb177cl4DoZT0h4IAWoMQ3keVt6j9vWb0HwXuyQXuZ1YybB9iyAFc61lDl3H9l1lkjxB7Vtu9V32cU8o91kb7FsTtBVcSXhfXtlxx0A8VSMIkpnP2vc828oZueBedItal3LmmZsPzcQ0S1AB-vSU3ODuV4bQQhYFasUxe5Xav1XLXrWB9oamhOOVgUIbfkfbM9yoho3okkM5wxKgqZpSoNB-lobiF-cRapE5iPbyNmoZhpUPWyqiHPODdcumTw0fIEMJAk5CfunDzC1JDK1wf8EeKmYasvUsauFOKd88hQLGGmr0Yihr-_iDvrpdTkSaxm7ApIKWYWT3fGJKMQDxTALouAvHNNZQD4al5e_WmXDOptkprHOtdRGLekDB7z6Uc4sJm4qS43THtp9u67SFX6gr6IbBYUXo4Z7ZQ_jxLjxTYrUosErIDxSzRWoBgphXP2XxQ6UTaAk3ROC-46PnDa4MtXVzZ0blCnV7LY-_QpX0g14-e56SsBZNRtxUJdTSw0Sk1a1JkQttcYJzp7wtWx3EMf4DAVlFzcU_zi4T5JtCl2ipdsLclAsx6eVH-kL8bgO9fdj5sYz8xr4UOMVkWbeA7qp-bU7ZCBw16GYpHjgNCuueBYKcCGLdqbgLLGkNbC3zFU4cEbCrvBfQC8TkLHrg-qciGJ5asCbeHvXkRx4U5z_69LSNOskELrSkMsfokN2WYdxt507ppbyNS3fa7PaZOBqhzp9RIaZ2jfHTlRTJxygSmXNZJbifh7yTw5fvaF3m85GSuarE6n1_1ZbN_SU7utOKTZTd56dFniTgCDdxxnHAHDxqTb1RKdXAvqbJIYyoapizvS6oqus1zltpPCBky_WHCQW6ziSHXB2OHARVYhaNsH36443dOv82Y914SeXCjqMhySRYMeNc-KIpaYR0txeprU7AJodwtDTy-65WMJJhGMFeA49Qlh9dtcmT1Uy9-G2S_NWecD_vQLGusc8FZHdCDIysswAdYRGx54FXsKrWqh_Q4DjeQ9TcW5sU5JL23046GZX1jOXYYZCnutT-Cr5RD0uL_P8iLSGObG6AZ8F1HvJV1niMyyVywdU192DilyQJia4MRo992DA7MmyF2Zl1BNRLjW0I0xHq0CFvnbAE9a2tlqP6gJXkuSIF

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 90ms
90ms XHR
application/json 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230530&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7b027ca311984e60e91cdbfa4bd8f79bc05c3606f0ff27f1fc8af6cc0f1e7a1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:39 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11132
x-xss-protection: 0

GET
H2

200

like.php Show response
www.facebook.com/plugins/ Frame 6712
Redirect Chain

https://web.facebook.com/plugins/like.php?action=like&app_id=382287608570983&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df3d6f8435e64d9c%26domain...
https://www.facebook.com/plugins/like.php?action=like&app_id=382287608570983&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df3d6f8435e64d9c%26domain...

0
1 KB

34ms
33ms

Document
text/html

157.240.251.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/like.php?action=like&app_id=382287608570983&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df3d6f8435e64d9c%26domain%3Dwww.farfeshplus.online%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.farfeshplus.online%252Ff11474d754e906%26relation%3Dparent.parent&container_width=100&href=https%3A%2F%2Fwww.farfeshplus.online%2F&layout=button&locale=en_US&sdk=joey&share=true&show_faces=false&size=small&width=50&_rdc=1&_rdr

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=cbbae6a4461ffcc865adb85f2c734187

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.farfeshplus.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-length: 0
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html;charset=utf-8
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 01 Jun 2023 15:48:40 GMT
expires: Sat, 01 Jan 2000 00:00:00 GMT
pragma: no-cache
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
x-content-type-options: nosniff
x-fb-debug: iZ53DZ63HIxNV0J6L2smTHILcOYLjD/U7HTtZTNeBOPDjyDQHpZUcvop4ibc3Hm/MmhsafuQ3bfF5KnPwYJA8w==
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/html; charset="utf-8"
cross-origin-opener-policy: unsafe-none
date: Thu, 01 Jun 2023 15:48:40 GMT
location: https://www.facebook.com/plugins/like.php?action=like&app_id=382287608570983&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df3d6f8435e64d9c%26domain%3Dwww.farfeshplus.online%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.farfeshplus.online%252Ff11474d754e906%26relation%3Dparent.parent&container_width=100&href=https%3A%2F%2Fwww.farfeshplus.online%2F&layout=button&locale=en_US&sdk=joey&share=true&show_faces=false&size=small&width=50&_rdc=1&_rdr
origin-agent-cluster: ?0
strict-transport-security: max-age=15552000; preload
x-fb-debug: 96I1lqeTTeB8YvVj2+frMPy+Ch/DG8npx1Lz+vtRmT6Zc6NDJB3SeOyl/pdRieJj+Gd4E5g2GtMpL9k66Kg0bg==
x-fb-zr-redirect: 02|1685720920|

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D79E 0
22 B 79ms
79ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=9244528452242&version=m202301230201&ct=119&x=1&cor=2436493295178628000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 52ms
52ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 01 Jun 2023 15:48:39 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 5FA4 13 KB
5 KB 38ms
38ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.farfeshplus.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 5915
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 01 Jun 2023 14:10:04 GMT
expires: Fri, 31 May 2024 14:10:04 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 180E 783 B
534 B 47ms
46ms Document
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

9974561462abdbfe5e5ec0e1d9b966e8d0be0358ae94ed18e9f23a0ae8d81c59

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-9BBSgGu1CT2gmnCMwbT21A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.farfeshplus.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-9BBSgGu1CT2gmnCMwbT21A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 01 Jun 2023 15:48:39 GMT
expires: Thu, 01 Jun 2023 15:48:39 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js Show response
pagead2.googlesyndication.com/bg/ Frame 5FA4 37 KB
14 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ae70268abe00d0f5f9a58ce23f5af80fd5f8d9e8b5a647855901f5321cbd23a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:09:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5941
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 31 May 2024 14:09:39 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 180E 0
0 70ms
69ms Image
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230530&jk=2127257284742242&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
479 B 14ms
13ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://live.demand.supply/e/e.js?r=farfeshplus.online_auto_728x90_sticky_display_bottom&e=ufp&dsReferer=ZmFyZmVzaHBsdXMub25saW5lL0ZQNjQuYXNw
Requested by: Host: live.demand.supply
URL: https://live.demand.supply/impl.v16.11.0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

x-nf-request-id: 01H0G4HP91HMRD74KJFXGZPWNV
date: Thu, 01 Jun 2023 15:48:40 GMT
cf-cache-status: HIT
age: 41560
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "847d6f45a54b1a346481710a0a6f4147-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 7d089a28eb1c1b35-FRA

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 87ms
20ms Preflight 18.130.160.192
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.130.160.192 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-130-160-192.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://as.ad4m.at
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Thu, 01 Jun 2023 15:48:40 GMT
server: nginx

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 170B 16 B
232 B 68ms
67ms Fetch
application/json 18.130.160.192
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.130.160.192 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-130-160-192.eu-west-2.compute.amazonaws.com

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 01 Jun 2023 15:48:40 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
x-frame-options: SAMEORIGIN
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 5FA4 0
12 B 38ms
37ms Image
text/plain 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?zQwAxA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:40 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 73ms
72ms Image
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230530&jk=2127257284742242&bg=!JiWlJXHNAAZu7ficTu07ADkAdvg8WkNpM_Yz61XgSIHPQPJWzRnoLSRBQF7PTYt6TNVQR9D5M4rgS5p6Pz6Df7Um7BT-eljTonACAAAB4lIAAAAEaAEHCgBYTivvAFHLK_K1rXXXWJwiWpzx8Tw0P39Jk9WKjxNnVmS6D6clT2ddIkXAN_QGXQVI8e6uQYYMVndG9xxnYWbrMRqvZfUbhWKQuJRq6y7gzBs8AKzsp9orbpkC63-e7qMlka9XCOcD8RBypWLK1e86pQBzOwXCuZch4wsJ3GO6tEieu7TJeiGVcaKs3W5DcdnAB3AYed4OvIPM5ertEo1J8FVSxcpDq7eQx0AwBnLtQl5OhdvrJ3Ly27MOKOVaBZu5mqT_8ZaWRoEXlO4Oh6qdzXZSRDLW8z5803I5kDnEVa0MHe_AAiA46qwEDvBdqOtBfX5tAMhoYvOujpOHmwyS_OKsjo_x1PzLbtOmmK1euixoL9KZLKUfSCtV8fi_nhgYxbPteYDE4PK8S7kMZiOL0-vH12yvYxtor-tiVyr_LuP0lRkNICo6v_8pEphwKk_Zxae9Nrr6lcEPloI2JiO9VQDa4hxlRUqAFjcpsgc98kpRz8RUknzWmZyz8avSVe8FGiSiaC5tYveP04RyXwdKdBzWbcHf-aXFZrxf24g_5LLqC_2cFr76cMsWIk_Q2yXEmOQL4GwuyxcMTcncggthHElA90jsExSvzDZemHTI_VqH5OLGl4P5En4cmNHjI-VfV0OSwGB1-Wnjh2BfSh89lF6pnqRCAEn_tIIHE-sa3UERBWEdZz1x7JIqxiYmlJHjwJIXpKmfPvMceR9TPD6k3I4bqQ73nEhlA-jB2Uft0WasnhuiMDJulxUFaYp4tn0LbQWuQK_Dy4rH6Hx01qPHqDft2DbVLWOc5jDNezsBLnIazCl11mPECzlIRtbk3MK9NRpFYos3mNTb6lRoxvnkpnXhakSZ4h7Mr0kR58dSgnD2UpcoSty8QGIjTE1naMazvUUjkGXrlZq2UrISAPt0VXxS0SwKLDK9jempKQ8unatNHYeKpk8aWzsvIyQLFyW-bA5bJ-cGySzJjjNEO433s1POr4RCI4HfYOdktkxYeoeY2pudvdY0PE-XRZ1HBFyaVx9_J1tqL9VlEWtOKMneCNYZC3w17DABoWzL-CBBslFQ9kNMmvoFOpnsNGGVhHbWO2vkoRn3dPPed7cGJuBCDhrSYaKPaw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 54ms
53ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.farfeshplus.online

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305250101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 54ms
53ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.farfeshplus.online

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305250101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 23 KB
11 KB 446ms
445ms Fetch
text/plain 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2127257284742242&correlator=557929858211640&eid=31072019%2C31073865%2C31074921%2C31074948%2C31074992&output=ldjh&gdfp_req=1&vrg=202305250101&ptt=17&impl=fifs&iu_parts=21939239661%3A22477364305%2Capl%2Cfarfeshapl%2Cdisplay%2Cdynamic&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=300x250&ifi=57&adks=2397457137&didk=1624416091&sfv=1-0-40&prev_scp=refresh%3Dtrue%26test%3Devent&eri=1&sc=1&cookie=ID%3D17e2572f31a26d60%3AT%3D1685634514%3ART%3D1685634514%3AS%3DALNI_Mb86kz-qJMmX-Zc0VOLZK452Jzayg&gpic=UID%3D00000c3a8e2fa047%3AT%3D1685634514%3ART%3D1685634514%3AS%3DALNI_MYaZuaoptZG1uaUJEQu5UNcbSoWNw&abxe=1&dt=1685634521465&lmt=1685634521&dlt=1685634512437&idt=543&adxs=0&adys=1219&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=3&ucis=17&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP64.asp&frm=20&vis=1&psz=300x-1&msz=300x-1&fws=516&ohw=300&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1858218578.1685634513&ga_sid=1685634513&ga_hid=222057478&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY1fWVvYcxSABSAghkEhkKCnB1YmNpZC5vcmcYk_qVvYcxSABSAghqEtYBCghydGJob3VzZRLAAW1DUlF4cDZKNE4rQ0RyYkJqVXY3aDBpYzYxdGFwRlpMOGdLdFJtSk5DRTRDWG0vQ1JpUWxnNVMvMWxxWWhjR09EU09HRWdLSkVtNkt6T25reDVIaUlOUXJIcDJNMlJWbjJrR2JwTCtjQ3dQUzdrK1VUUkVhdlFWS3ZOUW9GWDIwSTRoaVdVTHEwZHRUT2JmVTREQWhqWGE0ckZRakI0U1I0MmdZOHEzZXNCbDRPM1NCcXpJeXdTMmlVWDB0RzFrNhiD_JW9hzFIABIdCg5lc3AuY3JpdGVvLmNvbRjW9ZW9hzFIAFICCGQSGQoKdWlkYXBpLmNvbRjW9ZW9hzFIAFICCGQSGwoMaWQ1LXN5bmMuY29tGO_6lb2HMUgAUgIIag..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305250101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d07d7d107f0e8811d8ca9f08bccea215e9eb6012881eae636b9549dd22d8abc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:41 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11050
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.farfeshplus.online
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 03032023-031527201-1456_180_720x610_stoerer-gbplusdd45da6a-b9ac-4a7c-9506-d902c6e1e866.png
s0.2mdn.net/4528404/ Frame 8854 31 KB
31 KB 38ms
38ms Image
image/png 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/03032023-031527201-1456_180_720x610_stoerer-gbplusdd45da6a-b9ac-4a7c-9506-d902c6e1e866.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ebaa028e53ceb3896c63bfbdb52a422b2419be96e936f7416a4aea330e69010c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9548364509937149214/index.html?e=69&leftOffset=0&topOffset=0&c=bnyTc2AwWf&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:46:53 GMT
x-content-type-options: nosniff
age: 3708
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32039
x-xss-protection: 0
last-modified: Fri, 03 Mar 2023 11:15:27 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 02 Jun 2023 14:46:53 GMT

GET
H2 200 dc_oe=ChMIsdf687Wi_wIVz_ERCB3QCQmrEAAYACC03uxKQhMIhqWv87Wi_wIVOSatBh0-yAZG;stragg=1;&timestamp=1685634521882;str=Show%20Slide%200;strtype=1
ade.googlesyndication.com/ddm/activity/ Frame C902 42 B
107 B 410ms
74ms Image
image/gif 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIsdf687Wi_wIVz_ERCB3QCQmrEAAYACC03uxKQhMIhqWv87Wi_wIVOSatBh0-yAZG;stragg=1;&timestamp=1685634521882;str=Show%20Slide%200;strtype=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:42 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame E59B 6 KB
3 KB 36ms
35ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305250101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.farfeshplus.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 01 Jun 2023 15:48:33 GMT
expires: Fri, 31 May 2024 15:48:33 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 52F2 398 B
223 B 81ms
79ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhC5lOngAhj3p6fbATAB&v=APEucNUc5hJBA4v1nJKN6yS8jPLhLS4u-wGTcTh_iYHswb4TE8SFDyyCjjB-KVoNZjZCbKp64N9NPtk804LqGAOBFHVGloBz7dMtWH1r-n3a48AGC5nPlmPe8yZSaHYj_04WoiUgMZiAlNiGJSzC6yY0iOBV9I1ggNBP1ZNRhxXIe5YwoNotCec

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dc00d2dc19a9dd32d5f89ec3d68bfed90dd775a5fa638855b7fe00d6415f379b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 202
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 01 Jun 2023 15:48:42 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame E59B 78 KB
27 KB 131ms
130ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:42 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 01 Jun 2023 15:48:42 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame E59B 42 B
68 B 70ms
69ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-A5PiFhYXnJv9hpbJmnaNGMItsPvqqzY4E385sxRnJ-qFkJKuO_zY_cb-ijEBhRY80FxWF7GHyLo_lNQBNVxj7KkhGAXa-4MD4CTwQSJ0hvk0C8ekU

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:41 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E59B 0
25 B 71ms
69ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=17684622907188401838&x=1&ct=119

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:41 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

px.gif
d.adtriba.com/ Frame E59B
Redirect Chain

https://d.adtriba.com/collect?atb_ptid=e774d0b4&atb_dpuid=nayoki&atb_dcaid=display-pp_paket_m_alw-on
https://d.adtriba.com/px.gif

42 B
227 B

8ms
8ms

Image
image/gif

3.123.69.224
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adtriba.com/px.gif
Requested by: Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 3.123.69.224 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-123-69-224.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Thu, 01 Jun 2023 15:48:41 GMT
Cache-Control: public, max-age=86400
Server: nginx/1.16.1
Connection: keep-alive
Content-Length: 42
Content-Type: image/gif

Redirect headers

Date: Thu, 01 Jun 2023 15:48:41 GMT
Last-Modified: Thu, 01 Jun 2023 15:48:41 GMT
Server: nginx/1.16.1
P3P: CP="This is not a P3P policy! See https://www.adtriba.com/privacy-policy.html for more info."
Location: /px.gif
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 01:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/ Frame E59B 3 KB
1 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/window_focus_fy2021.js

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:09:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5942
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 14:09:39 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/ Frame E59B 19 KB
8 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3735e94afb2539b14515fdd10d7cc066cffa99d4b52762959e342295e08a770e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:02:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6372
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7991
x-xss-protection: 0
server: cafe
etag: 2412543371950383451
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 14:02:29 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E59B 171 KB
53 KB 66ms
64ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b108d10517b218ebb22d63ad00b85baf89a7b4f1884c3fd01eb03f0790b1cd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54276
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1685532878231373"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 01 Jun 2023 15:48:42 GMT

GET
H3 200 03032023-031527201-1456_180_720x610_stoerer-gbplusdd45da6a-b9ac-4a7c-9506-d902c6e1e866.png
s0.2mdn.net/4528404/ Frame D052 31 KB
31 KB 39ms
38ms Image
image/png 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/03032023-031527201-1456_180_720x610_stoerer-gbplusdd45da6a-b9ac-4a7c-9506-d902c6e1e866.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9548364509937149214/1676550659977.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ebaa028e53ceb3896c63bfbdb52a422b2419be96e936f7416a4aea330e69010c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9548364509937149214/index.html?e=69&leftOffset=0&topOffset=0&c=UBPaKZQ8tN&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:46:53 GMT
x-content-type-options: nosniff
age: 3708
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32039
x-xss-protection: 0
last-modified: Fri, 03 Mar 2023 11:15:27 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 02 Jun 2023 14:46:53 GMT

GET
H2 200 dc_oe=ChMIk8qJ9LWi_wIVqe0RCB124Q48EAAYACC03uxKQhMI24is87Wi_wIVyA2tBh17LQYB;stragg=1;&timestamp=1685634521984;str=Show%20Slide%200;strtype=1
ade.googlesyndication.com/ddm/activity/ Frame 04AB 42 B
401 B 308ms
74ms Image
image/gif 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIk8qJ9LWi_wIVqe0RCB124Q48EAAYACC03uxKQhMI24is87Wi_wIVyA2tBh17LQYB;stragg=1;&timestamp=1685634521984;str=Show%20Slide%200;strtype=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:42 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 52F2
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_dbm
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESELFlnoS_4yqlT1vI_W9CrSM&google_cver=1

43 B
163 B

48ms
17ms

Image
image/gif

185.86.138.153
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESELFlnoS_4yqlT1vI_W9CrSM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhC5lOngAhj3p6fbATAB&v=APEucNUc5hJBA4v1nJKN6yS8jPLhLS4u-wGTcTh_iYHswb4TE8SFDyyCjjB-KVoNZjZCbKp64N9NPtk804LqGAOBFHVGloBz7dMtWH1r-n3a48AGC5nPlmPe8yZSaHYj_04WoiUgMZiAlNiGJSzC6yY0iOBV9I1ggNBP1ZNRhxXIe5YwoNotCec
Protocol: HTTP/1.1
Server: 185.86.138.153 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:41 GMT
transfer-encoding: chunked
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:42 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESELFlnoS_4yqlT1vI_W9CrSM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 316
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK /
rtb-csync.smartadserver.com/redir/ Frame 52F2 43 B
163 B 80ms
17ms Image
image/gif 185.86.138.153
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=GOOGLE_HOSTED_PI&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_hm%3DSMART_USER_ID_B64
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhC5lOngAhj3p6fbATAB&v=APEucNUc5hJBA4v1nJKN6yS8jPLhLS4u-wGTcTh_iYHswb4TE8SFDyyCjjB-KVoNZjZCbKp64N9NPtk804LqGAOBFHVGloBz7dMtWH1r-n3a48AGC5nPlmPe8yZSaHYj_04WoiUgMZiAlNiGJSzC6yY0iOBV9I1ggNBP1ZNRhxXIe5YwoNotCec
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.138.153 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:41 GMT
transfer-encoding: chunked
content-type: image/gif

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E59B 0
26 B 69ms
69ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6252125065936&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:42 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E59B 0
26 B 69ms
69ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6252125065936&version=m202301230201&ct=119&x=1&cor=17684622907188402000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:42 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame E59B 85 KB
36 KB 86ms
85ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DMf3U0VQ9rR42mktOgeLhm6orh5RJi3h5r0Mt1QATFDV0CausPJJ20aS3kr38r5trAruj2oB3NjQHKG6GelRBDsNCV89BaClyreFJP8aX9IO4n2kGift6xjWpIfxmRhYH-CCVZwIW6LGZmecaw4UArClY-VPIDjK3QP_w_vPbQ6pWrsfQ&cry=1&dbm_d=AKAmf-CZ7xf81mqyMyqez9xsDdF2jiBM9TRf8b1NNjQ02ywhL42rn9Fjx9mIxlE35igpuCpzoN2pZp5guiON04e6z9pngFAV2GMZYjD17BLRAdQUirklu9jJKc2ZJ4XcbmgQKBe1QhaamK_Y25aDjZo5fB-NBtCxBIJx-2IgX5t0Ok9scEEcVcgflOv285QJ9Mcx9gRuwyOId11PhMp8h6N6H7-7G0OMS86FAS-JzQ0Hh5jYSp4tFbE7zsrRDTN_YhWmSt5GzULHFOJvCEvru2n0H_SfMT5nswhGhwgksDW83BaCZdsyLXukkseZMPL29GGOWmZfj5xE2rwbfhfNQ96WNRb8BLrFEdKn_w9OOhEYZudMEIE0G4XlpeBNLbAoUErO7thVFWW_pnp8WcjAUoavYnN1aAHouSIcUqnmwOxMeUMBKutPee07bqV5thOU78fNjBtDRuAKv6Bzv2gY4BFAPBVKQWvh0LH_G-fBgQ-nbadnZA6lSobEtxFqMsVgXPq6Vrb4J3fB1E1JyJI03LSnyCVddRitXQaovC8kmNGLuw2VR1EY4u8HNC134A0O7npbH1x0tQDZjCNJ2pMykdBy3DNzcIyMsaOfv2pF2dFqdm4XX2NhcbGl9I-WSbrf6sPKTBh7U6G-a2X7FVq-Sk996eEykoamv5TXFbW-Lb_xxAO6tt0to9zUmoXv6tAB06z6dGkVMCgvM0qd6XIo0R_g7WuGsmi_iuLLBFMULsauPoFc9tz-tXFP5yyCB6weRmFpCX-SyizTzPAx32VSBFkBJKWu_emEM7b08dapGXF1WQLgwQX_An19yv5bOZDrkOztqlPtOiZEkayJJeTaoYdyQUyRiUXOcuPVT7FADCz1drUha0a9eVdkSkoS4SYVW5WmtgT6_D_eIsp-aOIQV96KlmKCyGDuyvWnzlIR3gI_K4QeZKscKWoC9xnVLK2OY2TXmf9pgckb-LpLZy9OgP8IE2E58F90OBuxKhu039YPngyre67wsFAsHJjEWhNAoIB8Irit0mCFjcOODQv9p8orbPJWWp8NLXFn7S_6qPLhddYcMNbNv8BQAw964v6L_0U10KyAhmCwk3MWEBlPHyrEtdkO4NUIrlPP7DohfwGlEDNi8a0nxcnKEKJal_OTM1l2yQu9a13U29oKlUxylHV-r-oxA5008KX3PpNW2mwE4J90u0q_NZDJJOf7Wk0wT_tdf7nbDcb3qF228ChdrKziFpJT4LVo13c7bSA9Gcq9knolffJPaHeca9-mKEUIZHcR7VsO9gyXl7CekmSyvE-qpcnPGZv239zFmR56gbAssyb-_oankLA-3N34rwT-iLSN-ZrQ51h2Zu5oovnaFY7nr0JMa95Y3C9xNe5XNc-gU6XqgEMKtx1MbLOCFGteOR4HuI32EQeD4efMbc7xaCqKfuu7dJg2P_UZNTTF1ImVjvKdVvyuufew8rNap6_PDGZRiV69NMnwekdKiz-xdzXyPMUK7Aqt91nFPeg1fscSzFNWwhjZk6o80r888D9mSOzUHqZGAvBRlLXbVRhj7q3U4-f8miN3XAZUjTzeP06OdpVK0QfOTMfOjf9dpIuAWkTQ0B-7VxP9dx_x-_SteFlw2A7IVlHFOTa9lt5ZOtwQhvfAW44Wk_7KWHfFjddwz5eFSOaqkkV2CNCdY944BoBEK16pKjRnVqQRcAByuVyboXk6wgCO0PsVdT0_paCkJKwkSE8gWMmIQXx1CXz9OAzaOxoFF9ha1o26KRQfRXwdm2yRFDQt66986hvZT2z5cXT4aisPYVPf7L7zfEdfEwDshORcYh24voXkTwWQ4aMWl1BQ_DTInZnmbVSR0IR-C_1pSU0GXHYXEljCIP4EmvvBm3HjStuCh-0-VAwN2gjn3H83TFrriIcdOUGAsYZXqfPWs7N-T6v2MYXmnsPdWmFDOxom3-L7z_ojhr5Lt_su1z_FomadOXJ_VwLsBXLAjCyumgyOeezxdVdMjgn6kagtf7TJ2lnkOftp8H_Lh1kgNlJBNGvuoSpX4W-yEhupMumDTLQyc_lD5xlGmTdBnPtUFQAbmUtC9rDinB3eCX31oqwREKtVd82d1FjmTo6ZWTtja7_c2lWbl0u-NdCy7ye_RmoRXVO6No0DI1LnlKYRbmc6RJ32iifHtwft0a9uRj26k8encUUNtmXDfNkrjclsQ0k9XBMaZdsxtbPlRZs6IGr1Y4TjzJfEoVP8truOwusVHPZCgz9wXe5ToDZgV0UStKc88XkEkuM8XQ1LClNuGVSDJrVxamUGR9H95Ukc8fuaU6TlUQ-OElKLxRNL3dBfLkLbH9DLPddMqJ7qj_aerdMs6DtYZxTFV0y8n26E0Mk1NES8kuV1NJPkdXU3K0YmH9mJHEGi-UtBC2xcMY8S1FHFEo-Juju_4rxtGkpM0mbqlvL07rKHGZYjkd7ZLM0Ozx3LNREhbXc8n9rB87KMPuSnT5WkvKjG2HwIyKjuBB3m7SdKe_Ye9HOF90qcFaEaCE0zmVvHrEY5iJPaFJ1VWVoUNA8TfelwN9x0ACwJmT2KYxd7fpYkJXEHJqBBQYNVVHcynUPoUTqwenuToa20UTTPnxacOUM75U7dv7opQWO5SrLLqbD7f2DWYNe_iFHt33D6AgORI_98fG8kaL9vwlPu1XKZDXBzWzGsEx6c1UITBSP5xEn7PEiWipcgZP7m9eQgaSxpDlJwZoO_th8imYkldS_J14UR7Vg6DoX0Lug4NmHjCAWiNwWF7HJH02nGxQHXhqzc4SxKRYD8U7fKRorFzgntxRtREL8u9szHwF6NOsKkjSMGLOHDwUOYT7Wunj8OagVg61CrCTEsjJus7MTQys8B0akgE-kn0nMyC15TC3EzgWV8-xAYnDhaIh_zhj_fG_7Px8Gbtc69TKzHg8PSidFdBuD7gafzB6feSOKLD8vMhBXfAQ7INSVaUIQBgIBvgQjOMMmHRp2tWr_pX27FCQlQo4Y4SA9l_yePn5FgYQR6AbsfJA7bv8_Jn0NIvz19oMevQPrjk6lEKvSj9S_alvWJx8nRTKV8KjZDW6LcbIICV4xQ6-jZn76zcwaVh1uH1eJm46R5AvolCUBIqdEoXY_rBD334sLTS6aX3hdkWxfSL4Xukx65JgihE34OKSDMSl3Rm5ItnquQo9_17g7Ni6d1U9h7TMosISsYbTK_PYPx1iN6lpR_spGP981ik2DWCdtmaVV8viPaDPBBxKITYEdg9X9g9UTt2Wq85G9TNHrEfMko-bjj-SVYAAkzhsphkC4oK3rzQpl1EJ-C2k0_KhLwjzL-F5095XARAYKq063zDXHvUFZzoxK65gvrno-mWu4cGjhh9oKBEhJgrxP4_SiCkH0-NaZho8Dw5hKsGqMOgA4mQ09iQd_OOioqhVVDasHRDg9eLugEEk_NAQvovpOpIC0r6SfZbX1ZrJ4FefHrMFysNAc1WfaJSDgYETEpOpLeib5SqdSh8Av7-eIxJMHBskwOWyhAisoX0VHLceLEz6-ywYGKpjku6VSDx1aItvBphX1R0vf7VpIfzob6ipIL3FzoY6FXoZFFBlHp6IMNZhatYxc9FKBhc22lcNCEmrLXk9PRXOOMKpsHAM2lnPfmOAdf9u8y-b-ZM0VnaD2EtqqkFOVZIR11tCUV_GCspNTlFnIgdHFllmRoeebxDJEWXUYPvrUmIYZZK5yVXYnaJyJBXU44fHJSggFKUOxKEhzrt186S483EUPBDXkwwmXJFNZN67_VOXuSd_v4jrM_T5DAczP1_VusLnX4_B9illCMjRAR0QKl_GHJZppbD0jCyqGBFd5cK23WQrb5qEeiV0SbaReKyeEvi0Vesr8xJM4R1f8e0N3l-PYUyh68Ecjp1mC6CdYNYC2NCoyyFAxQmGqwDfuN6w4OsI9F5Nmdz_FCKchOgzKYRY31NxFCgQj9FIm5_bGUFn4mBcx6iM-gYGrbZidsObYru6-iMPnH35XO0mWThkeNkOPpItIsKWiIBTs&cid=CAQSOwBygQiDfk3n9_iKLKvd8lctiC18Nm8uy03N6KM8xp-NgKLf_KePKgAJslFr1Bsk2BINMPKua6ZHaEzSGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=17684622907188402000&adk=531095043&idt=138&cac=0&dtd=9

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4dc13bb7bb2f574671038ff407c0c8b4d5811de5a1d46c1dbda9cedc1d818800

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:42 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36556
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame E59B 106 KB
37 KB 36ms
35ms Script
text/javascript 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
Origin: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 09:27:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 22889
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 02 Jun 2023 09:27:13 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/ Frame E59B 11 KB
4 KB 36ms
35ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DMf3U0VQ9rR42mktOgeLhm6orh5RJi3h5r0Mt1QATFDV0CausPJJ20aS3kr38r5trAruj2oB3NjQHKG6GelRBDsNCV89BaClyreFJP8aX9IO4n2kGift6xjWpIfxmRhYH-CCVZwIW6LGZmecaw4UArClY-VPIDjK3QP_w_vPbQ6pWrsfQ&cry=1&dbm_d=AKAmf-CZ7xf81mqyMyqez9xsDdF2jiBM9TRf8b1NNjQ02ywhL42rn9Fjx9mIxlE35igpuCpzoN2pZp5guiON04e6z9pngFAV2GMZYjD17BLRAdQUirklu9jJKc2ZJ4XcbmgQKBe1QhaamK_Y25aDjZo5fB-NBtCxBIJx-2IgX5t0Ok9scEEcVcgflOv285QJ9Mcx9gRuwyOId11PhMp8h6N6H7-7G0OMS86FAS-JzQ0Hh5jYSp4tFbE7zsrRDTN_YhWmSt5GzULHFOJvCEvru2n0H_SfMT5nswhGhwgksDW83BaCZdsyLXukkseZMPL29GGOWmZfj5xE2rwbfhfNQ96WNRb8BLrFEdKn_w9OOhEYZudMEIE0G4XlpeBNLbAoUErO7thVFWW_pnp8WcjAUoavYnN1aAHouSIcUqnmwOxMeUMBKutPee07bqV5thOU78fNjBtDRuAKv6Bzv2gY4BFAPBVKQWvh0LH_G-fBgQ-nbadnZA6lSobEtxFqMsVgXPq6Vrb4J3fB1E1JyJI03LSnyCVddRitXQaovC8kmNGLuw2VR1EY4u8HNC134A0O7npbH1x0tQDZjCNJ2pMykdBy3DNzcIyMsaOfv2pF2dFqdm4XX2NhcbGl9I-WSbrf6sPKTBh7U6G-a2X7FVq-Sk996eEykoamv5TXFbW-Lb_xxAO6tt0to9zUmoXv6tAB06z6dGkVMCgvM0qd6XIo0R_g7WuGsmi_iuLLBFMULsauPoFc9tz-tXFP5yyCB6weRmFpCX-SyizTzPAx32VSBFkBJKWu_emEM7b08dapGXF1WQLgwQX_An19yv5bOZDrkOztqlPtOiZEkayJJeTaoYdyQUyRiUXOcuPVT7FADCz1drUha0a9eVdkSkoS4SYVW5WmtgT6_D_eIsp-aOIQV96KlmKCyGDuyvWnzlIR3gI_K4QeZKscKWoC9xnVLK2OY2TXmf9pgckb-LpLZy9OgP8IE2E58F90OBuxKhu039YPngyre67wsFAsHJjEWhNAoIB8Irit0mCFjcOODQv9p8orbPJWWp8NLXFn7S_6qPLhddYcMNbNv8BQAw964v6L_0U10KyAhmCwk3MWEBlPHyrEtdkO4NUIrlPP7DohfwGlEDNi8a0nxcnKEKJal_OTM1l2yQu9a13U29oKlUxylHV-r-oxA5008KX3PpNW2mwE4J90u0q_NZDJJOf7Wk0wT_tdf7nbDcb3qF228ChdrKziFpJT4LVo13c7bSA9Gcq9knolffJPaHeca9-mKEUIZHcR7VsO9gyXl7CekmSyvE-qpcnPGZv239zFmR56gbAssyb-_oankLA-3N34rwT-iLSN-ZrQ51h2Zu5oovnaFY7nr0JMa95Y3C9xNe5XNc-gU6XqgEMKtx1MbLOCFGteOR4HuI32EQeD4efMbc7xaCqKfuu7dJg2P_UZNTTF1ImVjvKdVvyuufew8rNap6_PDGZRiV69NMnwekdKiz-xdzXyPMUK7Aqt91nFPeg1fscSzFNWwhjZk6o80r888D9mSOzUHqZGAvBRlLXbVRhj7q3U4-f8miN3XAZUjTzeP06OdpVK0QfOTMfOjf9dpIuAWkTQ0B-7VxP9dx_x-_SteFlw2A7IVlHFOTa9lt5ZOtwQhvfAW44Wk_7KWHfFjddwz5eFSOaqkkV2CNCdY944BoBEK16pKjRnVqQRcAByuVyboXk6wgCO0PsVdT0_paCkJKwkSE8gWMmIQXx1CXz9OAzaOxoFF9ha1o26KRQfRXwdm2yRFDQt66986hvZT2z5cXT4aisPYVPf7L7zfEdfEwDshORcYh24voXkTwWQ4aMWl1BQ_DTInZnmbVSR0IR-C_1pSU0GXHYXEljCIP4EmvvBm3HjStuCh-0-VAwN2gjn3H83TFrriIcdOUGAsYZXqfPWs7N-T6v2MYXmnsPdWmFDOxom3-L7z_ojhr5Lt_su1z_FomadOXJ_VwLsBXLAjCyumgyOeezxdVdMjgn6kagtf7TJ2lnkOftp8H_Lh1kgNlJBNGvuoSpX4W-yEhupMumDTLQyc_lD5xlGmTdBnPtUFQAbmUtC9rDinB3eCX31oqwREKtVd82d1FjmTo6ZWTtja7_c2lWbl0u-NdCy7ye_RmoRXVO6No0DI1LnlKYRbmc6RJ32iifHtwft0a9uRj26k8encUUNtmXDfNkrjclsQ0k9XBMaZdsxtbPlRZs6IGr1Y4TjzJfEoVP8truOwusVHPZCgz9wXe5ToDZgV0UStKc88XkEkuM8XQ1LClNuGVSDJrVxamUGR9H95Ukc8fuaU6TlUQ-OElKLxRNL3dBfLkLbH9DLPddMqJ7qj_aerdMs6DtYZxTFV0y8n26E0Mk1NES8kuV1NJPkdXU3K0YmH9mJHEGi-UtBC2xcMY8S1FHFEo-Juju_4rxtGkpM0mbqlvL07rKHGZYjkd7ZLM0Ozx3LNREhbXc8n9rB87KMPuSnT5WkvKjG2HwIyKjuBB3m7SdKe_Ye9HOF90qcFaEaCE0zmVvHrEY5iJPaFJ1VWVoUNA8TfelwN9x0ACwJmT2KYxd7fpYkJXEHJqBBQYNVVHcynUPoUTqwenuToa20UTTPnxacOUM75U7dv7opQWO5SrLLqbD7f2DWYNe_iFHt33D6AgORI_98fG8kaL9vwlPu1XKZDXBzWzGsEx6c1UITBSP5xEn7PEiWipcgZP7m9eQgaSxpDlJwZoO_th8imYkldS_J14UR7Vg6DoX0Lug4NmHjCAWiNwWF7HJH02nGxQHXhqzc4SxKRYD8U7fKRorFzgntxRtREL8u9szHwF6NOsKkjSMGLOHDwUOYT7Wunj8OagVg61CrCTEsjJus7MTQys8B0akgE-kn0nMyC15TC3EzgWV8-xAYnDhaIh_zhj_fG_7Px8Gbtc69TKzHg8PSidFdBuD7gafzB6feSOKLD8vMhBXfAQ7INSVaUIQBgIBvgQjOMMmHRp2tWr_pX27FCQlQo4Y4SA9l_yePn5FgYQR6AbsfJA7bv8_Jn0NIvz19oMevQPrjk6lEKvSj9S_alvWJx8nRTKV8KjZDW6LcbIICV4xQ6-jZn76zcwaVh1uH1eJm46R5AvolCUBIqdEoXY_rBD334sLTS6aX3hdkWxfSL4Xukx65JgihE34OKSDMSl3Rm5ItnquQo9_17g7Ni6d1U9h7TMosISsYbTK_PYPx1iN6lpR_spGP981ik2DWCdtmaVV8viPaDPBBxKITYEdg9X9g9UTt2Wq85G9TNHrEfMko-bjj-SVYAAkzhsphkC4oK3rzQpl1EJ-C2k0_KhLwjzL-F5095XARAYKq063zDXHvUFZzoxK65gvrno-mWu4cGjhh9oKBEhJgrxP4_SiCkH0-NaZho8Dw5hKsGqMOgA4mQ09iQd_OOioqhVVDasHRDg9eLugEEk_NAQvovpOpIC0r6SfZbX1ZrJ4FefHrMFysNAc1WfaJSDgYETEpOpLeib5SqdSh8Av7-eIxJMHBskwOWyhAisoX0VHLceLEz6-ywYGKpjku6VSDx1aItvBphX1R0vf7VpIfzob6ipIL3FzoY6FXoZFFBlHp6IMNZhatYxc9FKBhc22lcNCEmrLXk9PRXOOMKpsHAM2lnPfmOAdf9u8y-b-ZM0VnaD2EtqqkFOVZIR11tCUV_GCspNTlFnIgdHFllmRoeebxDJEWXUYPvrUmIYZZK5yVXYnaJyJBXU44fHJSggFKUOxKEhzrt186S483EUPBDXkwwmXJFNZN67_VOXuSd_v4jrM_T5DAczP1_VusLnX4_B9illCMjRAR0QKl_GHJZppbD0jCyqGBFd5cK23WQrb5qEeiV0SbaReKyeEvi0Vesr8xJM4R1f8e0N3l-PYUyh68Ecjp1mC6CdYNYC2NCoyyFAxQmGqwDfuN6w4OsI9F5Nmdz_FCKchOgzKYRY31NxFCgQj9FIm5_bGUFn4mBcx6iM-gYGrbZidsObYru6-iMPnH35XO0mWThkeNkOPpItIsKWiIBTs&cid=CAQSOwBygQiDfk3n9_iKLKvd8lctiC18Nm8uy03N6KM8xp-NgKLf_KePKgAJslFr1Bsk2BINMPKua6ZHaEzSGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=17684622907188402000&adk=531095043&idt=138&cac=0&dtd=9

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae8017866a6744d35f26aa9da389e9771d40bcae3ee65df4c1b5e16e57b09fda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:56:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6710
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 6053914914909336730
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:56:52 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/ Frame E59B 29 KB
11 KB 36ms
35ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a91fca903f7f2a3d051f657b5b25baed4e99b6c1e51bfee63737f73ff54f2b7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:56:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6707
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11027
x-xss-protection: 0
server: cafe
etag: 5492578185836041520
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:56:55 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame E59B 41 KB
15 KB 38ms
37ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 07:39:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 202149
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 May 2024 07:39:33 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame F409 1 KB
649 B 35ms
35ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 77611
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 18:15:11 GMT
etag: 48472445140208031
expires: Thu, 01 Jun 2023 18:15:11 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame E59B 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3d50a32f3ea1cbe8c65e583d0439da8ee702fdb8fa174fb3272b70f1c90090e9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame DE4F 22 KB
8 KB 39ms
38ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 151890
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 30 May 2023 21:37:12 GMT
expires: Wed, 29 May 2024 21:37:12 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/18202846792940755015/ Frame F579 14 KB
4 KB 39ms
39ms Document
text/html 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/18202846792940755015/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb82eaa28d61b2c6e19349b5084b90d2933fb06b28560c33bc2edb2caa9babbe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 202705
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 3879
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 30 May 2023 07:30:17 GMT
expires: Wed, 29 May 2024 07:30:17 GMT
last-modified: Fri, 02 Dec 2022 10:53:15 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame E59B 0
0 86ms
86ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvz1lZPXxUB2h0g5jvH8G1i45E4bMiBrxDnMRh5qawir1RAqjq9dYh9QnRT7ebF8ZiU6Phg_H1ZbWUZu79EMmHGqg3axfgVZ2KxwS-h7xUPGeYr4C-BGWZm57C2ACquR3lurgKbMfVaZ7IVSyOYDov70s9l2kpuDRojGyZzR-2deLfK1VEEJqg7DS2mfMH2cBxZpzKzoDb68PxDhHS2mOvfxlbH7rrjfEqIM7lS3mPHEHs90NdcQBcNvIigWSysU3Ap_3Dzw10agWD4qab1rhxtZ9COHsw3ItTBOA-IxQwnL-pGpwv3qMILg0N6r1GmDygJnli31rtKZPQtgAispZkG9wDeNpg1NvtvSB-POB8Y7qpVjnlzei4DgAXQN-zoTYrJ5KCMLMT49R1MbigGmlKDtb3NPj8df-ikrZyhf_fxmeGbDKcLWSASliFElDL5MC0FNhuXQq9Xd8gg-QwjAWWT8mFJ27cnO1MYnxoYAeD9rgcKIKps1aMUs4IwCrwc82PTJSwW942p60et4S0awnPfjXNbcz2sOBB-6Ief8zaI8CpgZT5KteNy4POM9cFNpJm-xGyK7vVOnec1NOPcu6eFxfgQQW9X3DXbUhNozWOZLnRcNFlE4cHJeT5Mn0hohRN1O4MZftTEXdSPGxM43AVTtI_XHq_8uMAJwhbYgou8kEvtYW6gKvl1mFRpN1LmTWrm-up-tEl8E1z4mlRHXVK7QraA2uwCoKMpN85n53iTQPjfLAfSdvoHrl_EGniSOSIGZVFSW7Rjzjk2JdFqJd684dpx81G_30HeWbqKz-39RN3TgCP6WH-57dbUeMOh692aKVavoBMFSgayOWrGAZenwKWHq8sxetiexD2KHaPpkpvNHv1lzxOliZlQDNZeZEjS4zn5pg9itow3zM5oy34qZsXCWUaYyQtg5EZ5WOcw8noaKST9IaM2IJ4P9JskBz558BqpiH-n-y5fNvIiOreJG7MACSbD8DCyv3U7SR5HKvMjHxlGPBj4MevDGvl-9cM3OLbA1xuPExJfpMH7Lom6tcn2rkh5Z7xrMiFQgDSIciZcwpuOXMaVlL9YGvuzy1naRVshHiFDnWMTUxBaBfR2FXXivxRHb36lWEi5xu4S8U6Znx0OhXksMqbcK7mmzUUlSu1mH1mgvZbN45zrD_8Jrle5SxH-OAvd78PqzzE5ur_vveKffK6StB9eNERRob4yNqDmXsuR2fSddLQWDuTXvi1Jl6OoywxVvdWKtobhQz0eQ9YuxCxIT3Y8jackF3g_7iG57TW6vWOrXg4Z2mf6VmlWvNnkmzNskPvawPXFDtrbgiGzwuoCXPaPkkGTA-PUMiYmCZHL2_0&sai=AMfl-YTULqULy8knF9x2iQDV-8w_B-pv42SFWL-M9MLVawIgZHyxh4pj93Lwt_ZXfnC2PITOyfvIYIts-zBhTd6wo77SOrxN68Xu1hahS_RHCNgCozdQ2KcP59Wh3-Et5c1hJP7PqoQNXJrVhMMOuTBS43Hwxc-f_6yPlERsGP9d7Kj4ukmACZjev4zFn8NOEz3OgTTj50_l_Sk4CACaeopdJ9nHZcGKcRf3EIv2FxuliwjTLGXofa5qEms6N4lkhffCJgaA&sig=Cg0ArKJSzD7QEltJ4dLvEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=55&cbvp=1&cstd=53&cisv=r20230530.87906&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 01 Jun 2023 15:48:42 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Thu, 01 Jun 2023 15:48:42 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F409
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEND8eNVe3QWaOGLgV5Y381I&google_cver=1&google_push=ATf1kGNJ90roiCAD57ZUtw8Bfp1vefBLWIXyzvBdMnSBrQ-w7E-hIPhbNd...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ATf1kGNJ90roiCAD57ZUtw8Bfp1vefBLWIXyzvBdMnSBrQ-w7E-hIPhbNdzPkU49UsJg-Jq50iy7yVn366aasfNy9kfpT5v18HB4&google_hm=jngQr49iRC0q...

170 B
188 B

47ms
47ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ATf1kGNJ90roiCAD57ZUtw8Bfp1vefBLWIXyzvBdMnSBrQ-w7E-hIPhbNdzPkU49UsJg-Jq50iy7yVn366aasfNy9kfpT5v18HB4&google_hm=jngQr49iRC0qFqwjkR-k8w

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ATf1kGNJ90roiCAD57ZUtw8Bfp1vefBLWIXyzvBdMnSBrQ-w7E-hIPhbNdzPkU49UsJg-Jq50iy7yVn366aasfNy9kfpT5v18HB4&google_hm=jngQr49iRC0qFqwjkR-k8w
pragma: no-cache
date: Thu, 01 Jun 2023 15:48:42 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame F409 70 B
264 B 34ms
32ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEEjXm2ByOVAEsbWhP3gHCGo&google_cver=1&google_push=ATf1kGNQFufSn-aZd7ysgdf3Su-LQVbZLTK7FfaE_phUCKYL0AHSPhQ79yrgRbHo79t0AODSKvBVMB6Yb3o9dA2k-RkDIcGPJAXQ
Requested by: Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 01 Jun 2023 15:48:42 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F409
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESED-D9n2ouvVkvufclUQ5Xjg&google_cver=1&google_push=ATf1kGO8qdSVSbHjh7m49xGZrkM39MxXRhRf2ejeFObNLkqmxNM0Se4Swr3ZOgKJPMS1OGtqcuJbdmFVC8o80mmEL8GEqND...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGO8qdSVSbHjh7m49xGZrkM39MxXRhRf2ejeFObNLkqmxNM0Se4Swr3ZOgKJPMS1OGtqcuJbdmFVC8o80mmEL8GEqND5D590

170 B
188 B

48ms
48ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGO8qdSVSbHjh7m49xGZrkM39MxXRhRf2ejeFObNLkqmxNM0Se4Swr3ZOgKJPMS1OGtqcuJbdmFVC8o80mmEL8GEqND5D590

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGO8qdSVSbHjh7m49xGZrkM39MxXRhRf2ejeFObNLkqmxNM0Se4Swr3ZOgKJPMS1OGtqcuJbdmFVC8o80mmEL8GEqND5D590
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F409
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEEoBZVkknJUHlsQn5JlXoV0&google_cver=1&google_push=ATf1kGNryddm3OOJ1x1DZeO4RP43ScBRGVx2BvXiaxflj6812uIg3PS5W0pubCYUXPTqlmvXo0UoAyHI...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDkxNTYyMTg2MzY0NTQ5NzQ3Ng&google_push=ATf1kGNryddm3OOJ1x1DZeO4RP43ScBRGVx2BvXiaxflj6812uIg3PS5W0pubCYUXPTqlmvXo0UoAy...

170 B
188 B

49ms
49ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDkxNTYyMTg2MzY0NTQ5NzQ3Ng&google_push=ATf1kGNryddm3OOJ1x1DZeO4RP43ScBRGVx2BvXiaxflj6812uIg3PS5W0pubCYUXPTqlmvXo0UoAyHIOMY70k8wHOnnp_XguTyB

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDkxNTYyMTg2MzY0NTQ5NzQ3Ng&google_push=ATf1kGNryddm3OOJ1x1DZeO4RP43ScBRGVx2BvXiaxflj6812uIg3PS5W0pubCYUXPTqlmvXo0UoAyHIOMY70k8wHOnnp_XguTyB
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F409
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEAfr6nX-g1rLNzXiccYSNU4&google_cver=1&google_push=ATf1kGPdsZdqMkXjZPk7JVGgX8Ey0R90bNiET-sB-Cy6SMmchm39FNKv_j5_nGjJzMBgHfb63FE...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TElEQjlUUUYtTi0yRFNY&google_push=ATf1kGPdsZdqMkXjZPk7JVGgX8Ey0R90bNiET-sB-Cy6SMmchm39FNKv_j5_nGjJzMBgHfb63FE3KqqDvpOYMyVuTFxHXlDc-74

170 B
188 B

48ms
48ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TElEQjlUUUYtTi0yRFNY&google_push=ATf1kGPdsZdqMkXjZPk7JVGgX8Ey0R90bNiET-sB-Cy6SMmchm39FNKv_j5_nGjJzMBgHfb63FE3KqqDvpOYMyVuTFxHXlDc-74

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TElEQjlUUUYtTi0yRFNY&google_push=ATf1kGPdsZdqMkXjZPk7JVGgX8Ey0R90bNiET-sB-Cy6SMmchm39FNKv_j5_nGjJzMBgHfb63FE3KqqDvpOYMyVuTFxHXlDc-74
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 5b959e9b7aef6dd90a6fa539ca64ac62
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F409
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEC3gYazDDQ5P0Wy-qWuhsuI&google_cver=1&google_push=ATf1kGNPwWeSZEpGkmPkyE8gvQfv1hoSePz_xstxCa2aqDt4RW52ZQLch85hP2ZBbdzT6v8mwzqlv230tT8N-1g1OySjuQ40PSzs
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&gdpr_consent=&us_privacy=&sync=1&google_push=ATf1kGNPwWeSZEpGkmPkyE8gvQfv1hoSePz_xstxCa2aqDt4RW52ZQLch85hP2ZBbdzT6v8mwzqlv230tT8N-1g1OySjuQ40PSz...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MjMwNDQyNzIxNzM5MDcxNDUwNDE4Ng%3D%3D&google_push=ATf1kGNPwWeSZEpGkmPkyE8gvQfv1hoSePz_xstxCa2aqDt4RW52ZQLc...

170 B
188 B

49ms
49ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MjMwNDQyNzIxNzM5MDcxNDUwNDE4Ng%3D%3D&google_push=ATf1kGNPwWeSZEpGkmPkyE8gvQfv1hoSePz_xstxCa2aqDt4RW52ZQLch85hP2ZBbdzT6v8mwzqlv230tT8N-1g1OySjuQ40PSzs

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MjMwNDQyNzIxNzM5MDcxNDUwNDE4Ng%3D%3D&google_push=ATf1kGNPwWeSZEpGkmPkyE8gvQfv1hoSePz_xstxCa2aqDt4RW52ZQLch85hP2ZBbdzT6v8mwzqlv230tT8N-1g1OySjuQ40PSzs
date: Thu, 01 Jun 2023 15:48:43 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

/
onetag-sys.com/match/ Frame F409
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEJXJvSNgX9ng7pOKv3qRJH8&google_cver=1&google_push=ATf1kGMa4G0dAWig3pEUtF_9U8tYo7MtDbYTJUUHrU7nvfmPgbBg_Fib5Fcg7CeMBp6b9K_F_uXDFQo_G_8...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGMa4G0dAWig3pEUtF_9U8tYo7MtDbYTJUUHrU7nvfmPgbBg_Fib5Fcg7CeMBp6b9K_F_uXDFQo_G_8469-QeLpbHoErO5lKTw
https://onetag-sys.com/match/?int_id=19&google_error=5

0
151 B

7ms
7ms

Image
text/plain

51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=19&google_error=5

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip253.ip-51-89-9.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:48:42 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=19&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 255
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame F409 0
12 B 47ms
46ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13L1QtLyCXGL9u4-V7CEsTNaMPgE3iAaYuhvIbmHrIh7I_AGwen_cVPSI2RJNKpABXPYL6HDBw

Requested by

Host: 24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com
URL: https://24ecd35660f23f52b07494237aac9f5b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:48:42 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 a6fc438daf2c8cc18f7294c60eb5597b.js Show response
s0.2mdn.net/sadbundle/18202846792940755015/ Frame F579 57 KB
15 KB 40ms
39ms Script
application/x-javascript 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/18202846792940755015/a6fc438daf2c8cc18f7294c60eb5597b.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/18202846792940755015/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4aecc48eb93fc11fa599dbf5ba5f0411c9a8dfdff8ea03764240c5d734d35665

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18202846792940755015/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 21:57:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 150658
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15831
x-xss-protection: 0
last-modified: Fri, 02 Dec 2022 10:53:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 May 2024 21:57:44 GMT

GET
H3 200 WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js Show response
pagead2.googlesyndication.com/bg/ Frame DE4F 37 KB
14 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ae70268abe00d0f5f9a58ce23f5af80fd5f8d9e8b5a647855901f5321cbd23a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:09:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5943
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 31 May 2024 14:09:39 GMT

GET
H3 200 9881d7df0b300d92200ebcbe31ea57a7.svg
s0.2mdn.net/sadbundle/18202846792940755015/media/ Frame F579 2 KB
799 B 40ms
40ms Image
image/svg+xml 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/18202846792940755015/media/9881d7df0b300d92200ebcbe31ea57a7.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/18202846792940755015/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8537b6920d550414d47001cd97c0f4b41d76bdc02f0eaeffef3c1a213212fa78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18202846792940755015/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 27 May 2023 17:32:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 425759
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 761
x-xss-protection: 0
last-modified: Fri, 02 Dec 2022 10:53:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 May 2024 17:32:43 GMT

GET
H3 200 0ed71ec9c849f515c0fc68561d4c6b57.svg
s0.2mdn.net/sadbundle/18202846792940755015/media/ Frame F579 15 KB
5 KB 42ms
41ms Image
image/svg+xml 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/18202846792940755015/media/0ed71ec9c849f515c0fc68561d4c6b57.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/18202846792940755015/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e7bc3c8964f007cd1de1b45e3d7c15de84e4bb74dddec186d78389dcd3bf079

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18202846792940755015/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Fri, 26 May 2023 22:06:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 495717
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5182
x-xss-protection: 0
last-modified: Fri, 02 Dec 2022 10:53:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 25 May 2024 22:06:45 GMT

GET
H3 200 ac4848f5dbf9aff1f6f13ddd9583fb81.svg
s0.2mdn.net/sadbundle/18202846792940755015/media/ Frame F579 13 KB
4 KB 43ms
42ms Image
image/svg+xml 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/18202846792940755015/media/ac4848f5dbf9aff1f6f13ddd9583fb81.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/18202846792940755015/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

63faa8b7384c37c4834b77615586404ad7d7591d5ab8ac0c50c2b10470b35b0b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18202846792940755015/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 27 May 2023 07:50:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 460665
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4549
x-xss-protection: 0
last-modified: Fri, 02 Dec 2022 10:53:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 May 2024 07:50:57 GMT

GET
H3 200 c47a56467d7806c94a9953bb95c1e91c.svg
s0.2mdn.net/sadbundle/18202846792940755015/media/ Frame F579 7 KB
2 KB 42ms
42ms Image
image/svg+xml 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/18202846792940755015/media/c47a56467d7806c94a9953bb95c1e91c.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/18202846792940755015/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aac844676f509734b1097c23a6f007746c5c29ea8995fc3499f87841094aa775

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18202846792940755015/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Fri, 26 May 2023 22:10:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 495516
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1817
x-xss-protection: 0
last-modified: Fri, 02 Dec 2022 10:53:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 25 May 2024 22:10:06 GMT

GET
H3 200 bfb145a64f74e892297169fa60a74aa1.svg
s0.2mdn.net/sadbundle/18202846792940755015/media/ Frame F579 44 KB
12 KB 41ms
40ms Image
image/svg+xml 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/18202846792940755015/media/bfb145a64f74e892297169fa60a74aa1.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/18202846792940755015/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7445b15985bff8d1911cf49ade51d502ac43f40063b0cec581a4c6a03aeb7134

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18202846792940755015/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 27 May 2023 01:24:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 483856
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12543
x-xss-protection: 0
last-modified: Fri, 02 Dec 2022 10:53:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 May 2024 01:24:26 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame E59B 0
0 77ms
77ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvz1lZPXxUB2h0g5jvH8G1i45E4bMiBrxDnMRh5qawir1RAqjq9dYh9QnRT7ebF8ZiU6Phg_H1ZbWUZu79EMmHGqg3axfgVZ2KxwS-h7xUPGeYr4C-BGWZm57C2ACquR3lurgKbMfVaZ7IVSyOYDov70s9l2kpuDRojGyZzR-2deLfK1VEEJqg7DS2mfMH2cBxZpzKzoDb68PxDhHS2mOvfxlbH7rrjfEqIM7lS3mPHEHs90NdcQBcNvIigWSysU3Ap_3Dzw10agWD4qab1rhxtZ9COHsw3ItTBOA-IxQwnL-pGpwv3qMILg0N6r1GmDygJnli31rtKZPQtgAispZkG9wDeNpg1NvtvSB-POB8Y7qpVjnlzei4DgAXQN-zoTYrJ5KCMLMT49R1MbigGmlKDtb3NPj8df-ikrZyhf_fxmeGbDKcLWSASliFElDL5MC0FNhuXQq9Xd8gg-QwjAWWT8mFJ27cnO1MYnxoYAeD9rgcKIKps1aMUs4IwCrwc82PTJSwW942p60et4S0awnPfjXNbcz2sOBB-6Ief8zaI8CpgZT5KteNy4POM9cFNpJm-xGyK7vVOnec1NOPcu6eFxfgQQW9X3DXbUhNozWOZLnRcNFlE4cHJeT5Mn0hohRN1O4MZftTEXdSPGxM43AVTtI_XHq_8uMAJwhbYgou8kEvtYW6gKvl1mFRpN1LmTWrm-up-tEl8E1z4mlRHXVK7QraA2uwCoKMpN85n53iTQPjfLAfSdvoHrl_EGniSOSIGZVFSW7Rjzjk2JdFqJd684dpx81G_30HeWbqKz-39RN3TgCP6WH-57dbUeMOh692aKVavoBMFSgayOWrGAZenwKWHq8sxetiexD2KHaPpkpvNHv1lzxOliZlQDNZeZEjS4zn5pg9itow3zM5oy34qZsXCWUaYyQtg5EZ5WOcw8noaKST9IaM2IJ4P9JskBz558BqpiH-n-y5fNvIiOreJG7MACSbD8DCyv3U7SR5HKvMjHxlGPBj4MevDGvl-9cM3OLbA1xuPExJfpMH7Lom6tcn2rkh5Z7xrMiFQgDSIciZcwpuOXMaVlL9YGvuzy1naRVshHiFDnWMTUxBaBfR2FXXivxRHb36lWEi5xu4S8U6Znx0OhXksMqbcK7mmzUUlSu1mH1mgvZbN45zrD_8Jrle5SxH-OAvd78PqzzE5ur_vveKffK6StB9eNERRob4yNqDmXsuR2fSddLQWDuTXvi1Jl6OoywxVvdWKtobhQz0eQ9YuxCxIT3Y8jackF3g_7iG57TW6vWOrXg4Z2mf6VmlWvNnkmzNskPvawPXFDtrbgiGzwuoCXPaPkkGTA-PUMiYmCZHL2_0&sai=AMfl-YTULqULy8knF9x2iQDV-8w_B-pv42SFWL-M9MLVawIgZHyxh4pj93Lwt_ZXfnC2PITOyfvIYIts-zBhTd6wo77SOrxN68Xu1hahS_RHCNgCozdQ2KcP59Wh3-Et5c1hJP7PqoQNXJrVhMMOuTBS43Hwxc-f_6yPlERsGP9d7Kj4ukmACZjev4zFn8NOEz3OgTTj50_l_Sk4CACaeopdJ9nHZcGKcRf3EIv2FxuliwjTLGXofa5qEms6N4lkhffCJgaA&sig=Cg0ArKJSzD7QEltJ4dLvEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=256&vt=11&dtpt=201&dett=3&cstd=53&cisv=r20230530.87906&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP64.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS