simcast.com Open in urlscan Pro
45.79.244.12 Public Scan

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:10 GMT
an-x-request-uuid: b38d0d49-7795-470a-afaa-3f948d04d929
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin: https://simcast.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 81.95.5.37; 81.95.5.37; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 pb Show response
ad.360yield.com/1914/ 0
165 B 162ms
49ms Fetch 52.19.94.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.360yield.com/1914/pb
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.19.94.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-19-94-255.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 12 Dec 2023 08:43:10 GMT
access-control-allow-credentials: true
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
408 B 36ms
11ms Fetch
application/json 51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip253.ip-51-89-9.eu

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://simcast.com
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
190 B 91ms
48ms Fetch 2a02:2638:3::7
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=36&wv=8.24.0&cb=34191642186&lsavail=1

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::7 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 12 Dec 2023 08:43:10 GMT
strict-transport-security: max-age=31536000; preload;
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Kestrel
vary: Origin

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
377 B 80ms
44ms Fetch
application/json 23.35.229.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.229.56 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-229-56.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:10 GMT
content-encoding: gzip
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://simcast.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Tue, 12 Dec 2023 08:43:10 GMT

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 37 B
549 B 59ms
32ms Fetch
application/json 104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=949296
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d0f18b9b170174d1a72cefc33bcc6a7e496e2ae7f1f2efbd07ead51b70c0d932

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:10 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wugjtsMCvMx0C7r8AnY2az6xQcvRpWcA%2BfcHB1j%2BiMzptAvTri8Yto%2FTLCWMfaAK97E7adO%2BYqb0Nq3iUPhBU2tJDtsuVmBQpe%2B%2FN%2FFI%2F4ESMErm5OnNLAcwD%2FXzi98rLQAKALDe"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://simcast.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 8344ad9d3f054d7f-FRA
alt-svc: h3=":443"; ma=86400
content-length: 37
expires: 0

POST
H/1.1 200
OK hbjson Show response
grid.bidswitch.net/ 24 B
362 B 186ms
25ms Fetch
application/json 3.127.32.193
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://grid.bidswitch.net/hbjson
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.127.32.193 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-32-193.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 70a3e96524041db707bf92cd238dc54c72ff77a65ad7178ae77bb897122afe66

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

Date: Tue, 12 Dec 2023 08:43:10 GMT
Content-Encoding: gzip
Server: nginx
Content-Type: application/json
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
Connection: keep-alive
Content-Length: 49

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
166 B 61ms
15ms Fetch 145.40.97.66
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 145.40.97.66 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

x-nbr: 8
date: Tue, 12 Dec 2023 08:43:09 GMT
server: envoy
vary: origin, Accept-Encoding
access-control-allow-origin: https://simcast.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 19 B
572 B 43ms
20ms Fetch
application/json 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:10 GMT
an-x-request-uuid: 74aae33e-d877-4e69-926b-463926dc1346
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://simcast.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 81.95.5.37; 81.95.5.37; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 19
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 unruly_prebid Show response
targeting.unrulymedia.com/ 11 B
201 B 44ms
16ms Fetch
application/json 46.228.174.115
AMOBEE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.228.174.115 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 846949c5a40e3ffbb702473e54dfac0646541aa624a844369b6e24e51ddaf96b

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: application/json

Response headers

access-control-allow-origin: https://simcast.com
pragma: no-cache
date: Tue, 12 Dec 2023 08:43:10 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 11
content-type: application/json

POST
H/1.1 200
OK pbjs Show response
smartssp-us-east.iqzone.com/ 2 B
238 B 305ms
113ms Fetch
application/json 8.2.111.104
NATCOWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://smartssp-us-east.iqzone.com/pbjs
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 8.2.111.104 Greenfield, United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

Access-Control-Allow-Origin: https://simcast.com
Date: Tue, 12 Dec 2023 08:43:10 GMT
Access-Control-Allow-Credentials: true
Server: nginx
Connection: keep-alive
Content-Length: 2
Content-Type: application/json

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 334 B
640 B 49ms
25ms Fetch
application/json 34.120.63.153
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUQWX43D
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.63.153 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 153.63.120.34.bc.googleusercontent.com
Software: envoy /
Resource Hash: fc560125cf18dcc2eee3cea104d1ad414d79b5a1be09f2b58a391c69d8126c53

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:10 GMT
content-encoding: gzip
via: 1.1 google
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
server: envoy
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 12 Dec 2023 08:43:10 GMT

POST
H/1.1 200
OK / Show response
ghb.adtelligent.com/v2/auction/ 18 KB
1 KB 1464ms
701ms Fetch
application/json 23.227.151.242
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.adtelligent.com/v2/auction/
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.151.242 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 97e65db9656367ce0fe37602d83a297af3683f38b05d2aec6c6d12694e2fd782

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

Date: Tue, 12 Dec 2023 08:43:11 GMT
Content-Encoding: gzip
Server: Adtelligent
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://simcast.com
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
X-Robots-Tag: noindex
Content-Length: 1145

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
202 B 15ms
13ms XHR
text/plain 2001:4860:4802:38::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1461476486&t=pageview&_s=1&dl=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvinpearll-resort.ph%26pcid%3D48%26rid%3D112%26a%3D0&dr=http%3A%2F%2Fwww.vinpearll-resort.ph%2F&ul=en-us&de=UTF-8&dt=Simcast%20News%20portal.&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAUABAAAAACAAI~&jid=975104170&gjid=206078182&cid=1249156730.1702370590&tid=UA-205158314-1&_gid=1314741565.1702370590&_r=1&gtm=457e3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&jsscut=1&z=1283867288

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:10 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
250 B 38ms
14ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-RFSL1NPH34&gtm=45je3bt0v9124667839&_p=1702370589528&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=1249156730.1702370590&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AAAI&_s=1&sid=1702370590&sct=1&seg=0&dl=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvinpearll-resort.ph%26pcid%3D48%26rid%3D112%26a%3D0&dr=http%3A%2F%2Fwww.vinpearll-resort.ph%2F&dt=Simcast%20News%20portal.&en=page_view&_fv=1&_ss=1&tfd=2435
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-RFSL1NPH34&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:10 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sync Show response
p2.gcprivacy.com/v2/ 451 B
815 B 98ms
98ms XHR
application/json 3.223.231.171
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://p2.gcprivacy.com/v2/sync?pid=Q6CV1VBC&uid=45b64ab0-21d4-4809-92b2-b02b109285a3&u=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvinpearll-resort.ph%26pcid%3D48%26rid%3D112%26a%3D0&h=simcast.com&ref=http%3A%2F%2Fwww.vinpearll-resort.ph%2F&ids=sharedid%2C45b64ab0-21d4-4809-92b2-b02b109285a3%7Cquant%2C%257B%2522value%2522%253A%2522P0-1790214109-1702370589884%2522%252C%2522expiry%2522%253A1736239390224%257D%7C&v=3
Requested by: Host: p.gcprivacy.com
URL: https://p.gcprivacy.com/t/gcid_s.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.231.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-231-171.compute-1.amazonaws.com
Software: /
Resource Hash: 9eb269148717506cc44528fb48d79974905f0135817a176b50e40f1aab8c2085

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:10 GMT
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Max
content-length: 451

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 73ms
58ms XHR
application/json 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20231207&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4ce0b6f82361a16302e2b06d86bda0413a291be8a4060fae6f09b79bb6bea57e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:10 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12242
x-xss-protection: 0

GET
H2 200 316574116785325086577f4b8cc1a98.61896527.m3u8 Show response
d29xw9s9x32j3w.cloudfront.net/videos/m3u8/1000k/ 7 KB
1 KB 8ms
8ms XHR
application/x-mpegurl 18.66.97.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/m3u8/1000k/316574116785325086577f4b8cc1a98.61896527.m3u8
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.28.2/easy-stn-player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-101.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 427042f733de7297029a9193812907dde9edbac35e80775586a078e218bb67e6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 06:02:29 GMT
content-encoding: gzip
via: 1.1 018ffb575888f1c9ec960e3e977c042e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
age: 9642
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
last-modified: Tue, 12 Dec 2023 06:02:05 GMT
server: AmazonS3
etag: W/"a6d32965c61b1c68df85c25ad7dd3c4b"
vary: Accept-Encoding,Origin
access-control-allow-methods: GET, HEAD, POST
content-type: application/x-mpegURL
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
cache-control: max-age=86400
x-amz-cf-id: lN5x-BKvRr274oVVNUh_ZPMVxgIECtqkuetsbV3cr-L-uETD__cxpg==

OPTIONS
H2 204 unruly_prebid
targeting.unrulymedia.com/ Frame 0
0 13ms
13ms Preflight
text/plain 46.228.174.115
AMOBEE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.228.174.115 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Accept-Encoding,Origin,Accept-Language,X-CSRF-Token,x-unruly-override
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://simcast.com
access-control-max-age: 1728000
content-length: 0
content-type: text/plain charset=UTF-8
date: Tue, 12 Dec 2023 08:43:10 GMT

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ Frame 4B30 138 B
692 B 10ms
7ms XHR
application/json 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/library/prebid/8.6.0/prebid.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-52-59-14-4.eu-central-1.compute.amazonaws.com

Software

nginx/1.23.4 /

Resource Hash

b0a001dcfd75237c4a2276c8bf31d4d4b2072f1e422b8c22235bde63e384e799

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:10 GMT
an-x-request-uuid: 987e6151-f953-4027-bfda-9ea5150d4a49
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://simcast.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 81.95.5.37; 81.95.5.37; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 138
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK auction Show response
prebid-server.rubiconproject.com/openrtb2/ Frame 4B30 173 B
460 B 2395ms
1455ms XHR
application/json 69.173.144.137
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/library/prebid/8.6.0/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.144.137 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e24c188b917c3b4d3a3eb0002742f19f1ba38f89232457cb6feff5dc50393bed

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
content-encoding: gzip
x-prebid: pbs-java/2.4.0
Content-Type: application/json
access-control-allow-origin: https://simcast.com
Cache-Control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 166
Expires: 0

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ Frame 4B30 36 B
313 B 23ms
22ms XHR
application/json 104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=438214
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/library/prebid/8.6.0/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c3d5ad52351c6c8e1f2346e18c660c9d6fdd34d7808442ea46162e91610304c

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:10 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E4i9AE3frwZ%2F94HWF0igpyLaMpV%2FWGcLVySJa1kpWr%2FPfxoEMLinCCPDNmy6L3y1BbV3TslEjyeN8fGSjSaCyI3b3Pbtx90cx8sMqNjKWMnTpbiP%2Bn4zajDsoWeilrtCO%2FOj0koF"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://simcast.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 8344ad9d9f724d7f-FRA
alt-svc: h3=":443"; ma=86400
content-length: 36
expires: 0

POST
H2 200 auction Show response
tlx.3lift.com/header/ Frame 4B30 19 B
539 B 30ms
8ms XHR
application/json 52.59.14.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=8.6.0&referrer=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvinpearll-resort.ph%26pcid%3D48%26rid%3D112%26a%3D0&tmax=3000

Requested by

Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/library/prebid/8.6.0/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.59.14.4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:10 GMT
accept-ch: sec-ch-ua-arch,sec-ch-ua-full-version,sec-ch-ua,sec-ch-ua-bitness,sec-ch-device-memory,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ect,sec-ch-save-data,sec-ch-viewport-height,sec-ch-width,user-agent,sec-ch-dpr,sec-ch-ua-platform,sec-ch-prefers-color-scheme,sec-ch-ua-full-version-list,sec-ch-downlink,sec-ch-viewport-width,sec-ch-ua-mobile,sec-ch-rtt
x-auction-status: 16
content-type: application/json; charset=utf-8
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H2 204 unruly_prebid Show response
targeting.unrulymedia.com/ Frame 4B30 0
158 B 14ms
14ms XHR
text/plain 46.228.174.115
AMOBEE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/library/prebid/8.6.0/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.228.174.115 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://simcast.com
pragma: no-cache
date: Tue, 12 Dec 2023 08:43:10 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 4B30 0
109 B 71ms
16ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/library/prebid/8.6.0/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 12 Dec 2023 08:43:10 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H2 204 hb Show response
hb.undertone.com/ Frame 4B30 0
515 B 141ms
104ms XHR
text/plain 13.32.121.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.undertone.com/hb?pid=3590&domain=simcast.com
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/library/prebid/8.6.0/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-90.fra60.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:10 GMT
via: 1.1 c60125e7f3465aceafb0abd071a41a36.cloudfront.net (CloudFront)
accept-ch: sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
x-amz-cf-pop: FRA60-P1
x-cache: Miss from cloudfront
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSDo OUR BUS UNI COM NAV"
access-control-allow-origin: https://simcast.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
x-amz-cf-id: U8XyGYBMme-5Iaq2PSZsLVyDCp94yhhd5XQ0OgDhhz0SJfqQrZ2h3g==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 43ms
22ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 12 Dec 2023 08:43:10 GMT

GET
H2 200 js Show response
aggle.net/ 202 B
656 B 441ms
150ms Script
text/html 15.197.179.7
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aggle.net/js?pid=NEQ7KDHP5&domain=simcast.com&pih1=&pih2=&pih3=
Requested by: Host: p.gcprivacy.com
URL: https://p.gcprivacy.com/t/gcid_s.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 15.197.179.7 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a938864f9581ea3da.awsglobalaccelerator.com
Software: gunicorn /
Resource Hash: 832ecde2a95e0b6b350be4b477050177facd60d8b645a99aef680e64f9132419

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

expires: Tue, 12 Dec 2023 08:43:11 GMT
date: Tue, 12 Dec 2023 08:43:10 GMT
cache-control: no-store
content-type: text/html; charset=utf-8
server: gunicorn
content-length: 202
p3p: CP="NOI OUR BUS UNI COM NAV"

GET
H2

503

xandr
p2.gcprivacy.com/v3/id/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fp2.gcprivacy.com%2Fv3%2Fid%2Fxandr%3Fid%3D%24UID%26gcid%3D27dd92bc-463d-4b3e-aae2-8030cda969d8
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fp2.gcprivacy.com%252Fv3%252Fid%252Fxandr%253Fid%253D%2524UID%2526gcid%253D27dd92bc-463d-4b3e-aae2-8030cda969d8
https://p2.gcprivacy.com/v3/id/xandr?id=4223095330690569392&gcid=27dd92bc-463d-4b3e-aae2-8030cda969d8

0
70 B

90ms
90ms

Image
text/plain

3.223.231.171
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p2.gcprivacy.com/v3/id/xandr?id=4223095330690569392&gcid=27dd92bc-463d-4b3e-aae2-8030cda969d8
Protocol: H2
Server: 3.223.231.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-231-171.compute-1.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:10 GMT
server: awselb/2.0
content-length: 0
content-type: text/plain; charset=utf-8

Redirect headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:10 GMT
an-x-request-uuid: cb12d847-e719-4444-9e47-56f876a47889
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://p2.gcprivacy.com/v3/id/xandr?id=4223095330690569392&gcid=27dd92bc-463d-4b3e-aae2-8030cda969d8
x-proxy-origin: 81.95.5.37; 81.95.5.37; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 345D 13 KB
5 KB 9ms
7ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 72576
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 11 Dec 2023 12:33:34 GMT
expires: Tue, 10 Dec 2024 12:33:34 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 4A04 829 B
1 KB 40ms
18ms Document
text/html 2a00:1450:4001:802::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

fba1e9d7b6124358247ceb38aacadf19e7305c5f4d1436e4071f84737bc900aa

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-7LMRt3Cf0eqRpTKlHro7_A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-7LMRt3Cf0eqRpTKlHro7_A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 12 Dec 2023 08:43:10 GMT
expires: Tue, 12 Dec 2023 08:43:10 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 345D 39 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 12:33:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 72575
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 10 Dec 2024 12:33:35 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 4A04 0
0 41ms
41ms Image
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20231207&jk=101578578091841&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 345D 0
10 B 6ms
6ms Image
text/plain 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?wp1iRQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:10 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 collect.min.js Show response
static.anonymised.io/light/ 5 KB
2 KB 7ms
7ms Script
application/javascript 34.107.217.107
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://static.anonymised.io/light/collect.min.js?v=0.3.1t
Requested by: Host: static.anonymised.io
URL: https://static.anonymised.io/light/bundle.js?v=0.3.1t
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.107.217.107 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 107.217.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 4421d90bbf983478021bbc14981742e33af47dcfbbbbd2df44b975257fde30cb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:23:54 GMT
content-encoding: gzip
age: 1156
x-guploader-uploadid: ABPtcPqsTdsJHuDXO8EikG5eKhBibrWHVmfjl_jvDSlWDC1EnBgEAiGLx4Vu9x6jm7NnFooeRyw
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1975
last-modified: Mon, 11 Dec 2023 14:05:37 GMT
server: UploadServer
etag: "96f276fec5189da348c4a070ca168d8c"
vary: Accept-Encoding
x-goog-generation: 1702303537348633
x-goog-hash: crc32c=w5zeaQ==, md5=lvJ2/sUYnaNIxKBwyhaNjA==
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public,max-age=1200
x-goog-stored-content-length: 1975
accept-ranges: bytes
content-type: application/javascript
expires: Tue, 12 Dec 2023 08:43:54 GMT

GET
H3 200 interestscores.js Show response
static.anonymised.io/light/ 3 KB
2 KB 7ms
7ms Script
application/javascript 34.107.217.107
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://static.anonymised.io/light/interestscores.js?v=0.3.1t
Requested by: Host: static.anonymised.io
URL: https://static.anonymised.io/light/bundle.js?v=0.3.1t
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.107.217.107 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 107.217.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 0409134df4107fe3d86b26248e3e8253287e929e94b690173bbab16e35686cd6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:35:03 GMT
content-encoding: gzip
age: 487
x-guploader-uploadid: ABPtcPoZ0YfaqZYuvFW5J9JK-ME9NTlpUSsm83n6v5qewwPNELpRnBL0Zgh5xe90DjjtTq177gU
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1601
last-modified: Mon, 11 Dec 2023 14:05:39 GMT
server: UploadServer
etag: "fc9cb5ca354311c71851da7601bef2df"
vary: Accept-Encoding
x-goog-generation: 1702303538989683
x-goog-hash: crc32c=yhrDqg==, md5=/Jy1yjVDEccYUdp2Ab7y3w==
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public,max-age=1200
x-goog-stored-content-length: 1601
accept-ranges: bytes
content-type: application/javascript
expires: Tue, 12 Dec 2023 08:55:03 GMT

GET
H2 200 694 Show response
a.ad.gt/api/v1/u/matches/ Frame 4B30 12 KB
4 KB 52ms
18ms Script
application/javascript 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/694?_it=amazon
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvinpearll-resort.ph%26pcid%3D48%26rid%3D112%26a%3D0&ref=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvinpearll-resort.ph%26pcid%3D48%26rid%3D112%26a%3D0&_it=amazon&partner_id=694
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c469dab1d7f5d0a0a2a04e27e97152a92cf05a3a2030ed24c63f21cc5b7824fb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:10 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 12 Dec 2023 08:39:33 GMT
server: cloudflare
age: 217
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=14400
cross-origin-resource-policy: cross-origin
cf-ray: 8344ad9fec326adf-FRA

GET
H2 200 jsync Show response
aggle.net/ 325 B
973 B 158ms
157ms Script
text/html 15.197.179.7
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aggle.net/jsync?pid=NEQ7KDHP5&domain=simcast.com&pih1=&pih2=&pih3=
Requested by: Host: aggle.net
URL: https://aggle.net/js?pid=NEQ7KDHP5&domain=simcast.com&pih1=&pih2=&pih3=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 15.197.179.7 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a938864f9581ea3da.awsglobalaccelerator.com
Software: gunicorn /
Resource Hash: 9b98bf81f66f4309fc3d8e7e44db394906521d819bb5656482c5d67905f317e3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

expires: Tue, 12 Dec 2023 08:43:11 GMT
date: Tue, 12 Dec 2023 08:43:10 GMT
cache-control: no-store
content-type: text/html; charset=utf-8
server: gunicorn
content-length: 325
p3p: CP="NOI OUR BUS UNI COM NAV"

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 45ms
44ms Image
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20231207&jk=101578578091841&bg=!k5ClkN_NAAY3kmNgF5I7ADQBe5WfODsInj5iQpmXvi-xrQoWCrNOsbsNoa6qwoOYUSipBW_fPYtS5iODpNRX3nDZDLgRAgAAADBSAAAAAmgBB5kDB3qdL4Trm9iNTq-KTn5o0er_ghc0-caXHHBusuAEKoxjXoXH7E5pdnp1PQ21aOevI_5qnQgj8sc9R1Ku_oyH8I-hWKlqu1te8kn1mKx_vEPTw7Gilrx5qU4taNyVt9JHvp9_oSf7BzaBNWd8UB2hw-T7jVJJMMO36-yzhPr2r9AcadAZe0vXGg0AWWdcjqGVZ7mBOC-knnZ4EDBlYJLZtUdOmL8Ep3sKTIamZ3y62nvNxw2uWH-au8AQxhmpzo9eS2IFUhXaKps_Yp11_hoYR2xl-4J1x_h9ftAYcQFeKMVgTF8DP6XbHuyCuO3pKWQMrYtoip3gNnjPeLHHOB5gLOrAAVhATaI2dBgPsv9Cmo8Rsx_Y-KhtmVLwllHmsM4Ct4rXqQfvgdKEpQ2Mk64nGxUBg2Sryv5YQ7KRJMsklyAEYPdKACOBS2nDAEnZlbCFqDfD_BR_HlnAS-iQFD8Hab1inYoO5k0RzLCDJpuOxhxFJayzQOcQMmrncsIIZbiyrfbCwkuKzUrieQD1KCrRGLkNd3finEnfMurpEsCzlu-A7eDa1j3xfxXubHMZL_v3DVOQad9hVLQ_pFAdyzaY0-au2MKAi0OFa9f4GLBrZNbC2n74CxNLBH5AdfSKjKzRythfuiZ8KVYkGIdwuo4h2dbRFhPpEN1hRM9Tpu-C92AJ2YPnwMVoAFvrql0qbskoNOG6SsHc28-fJV_OghoIC6BXT2pQ17EgU_-a_zUy4SvJBF_HxIsR6B6IhQj3lliM8yKQTfLp5CNf4YgAKXpn2bF67Fdy-g5_RY8ATtCr-kH41pnKg8kNcFPiHXRbob5TRnrWpYOYqyNGEmuBUoO7_6NFdIPIQXDHanJUQz-lJOpW-MFhAGgSg_ZUcNdZyIpc9NLEVLxl9IWLzcjia0xTccac6SuQuKX00V71I-akWT1r_wtzYwe5aJJd9PSQQ01nzK6-1llFhJPRRcobETxJmzJmLFIzfm-CLhzetSLk9wMEf5qBufOd_yIOcDoUKO-pHESRR_JAQtk
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

GET cs
a.usbrowserspeed.com/ 0
0

GET
H2 200 cx-overlay.js Show response
tags.qortex.ai/cxo/ 127 KB
43 KB 24ms
24ms Script
application/javascript 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/cxo/cx-overlay.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-bootstrapper-init
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 9fba1b0797e04bb4e94dffcf9068f89e75b4fa5569dc9efcb5aa72275435457b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:11 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 29 Nov 2023 15:28:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 116
etag: W/"120"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UyL779igTtVIDM9U2UuNxiTD755zfhcO3s%2BteDa7hhE1ST0xw3iBfoFdBBb%2FY4oOhXFyuYbZbe4tOLdqgfGXbV11ATkbdhJVcZ9oMyUOnVUnDz4wuMHr%2FYtmIa3lojySRbTGRA1BmciIjNlF"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8344ada36e0e9b37-FRA

GET
H2 200 p-fc3a8e1a.system.js Show response
tags.qortex.ai/cxo/ 2 KB
1 KB 206ms
206ms Script
application/javascript 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/cxo/p-fc3a8e1a.system.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-overlay.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 9b863b67b5aed3b7b271506c7b0cf48374ecddabc16a3e8527d58e0ce21918f3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:11 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Wed, 29 Nov 2023 15:25:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"120"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ELRP0rKjJuMwHMPPN6eXFOHDpHHgotJ1aCJMs3Pa4cbix%2Bn1J0MF7pSsdgDMvsOLmNGCYNP8WnFlbTw%2FXM4Sn51LzR4UOwLdXDze5Qhqc6dHieotMAcXHoX65NY%2FI0pIUs6dOSbT7kIbh0Oy"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8344ada3be609b37-FRA

GET
H2 200 p-31c577a7.system.js Show response
tags.qortex.ai/cxo/ 14 KB
6 KB 22ms
22ms Script
application/javascript 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/cxo/p-31c577a7.system.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-overlay.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: a87dab54792ca3697212f10ca3a1504a38c2c6d609612d0e3954824d2726a172

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:11 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 29 Nov 2023 15:28:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 115
etag: W/"120"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lAsHkiLYrUR6H11RL2OH6FSprwDifMIb8GioGYrXWl2cR37fTZYSZh9vYtiaeFe8Pu5xd9zg09cHnfyFa8KTDYURm64t%2BX9oNaAebPFD8nOyN4VWRLe6Zrai4Xf0MOteLUXLcLUEe%2FltxeIA"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8344ada50fb69b37-FRA

GET
H2 200 p-92cafdd1.system.entry.js Show response
tags.qortex.ai/cxo/ 552 KB
127 KB 27ms
27ms Script
application/javascript 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/cxo/p-92cafdd1.system.entry.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-overlay.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 795e6324de803dadc036b338826df264db5191a3542905725bf71dbf8b5fe1ce

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:11 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 29 Nov 2023 15:28:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 32
etag: W/"120"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G9ikDr9j9yS1dF5%2FLpHLXpaGRHKMXZEJYhrnFapNv9okm4xZvmcmwku%2FbZk%2Fi9y4KciLrGWA0A%2FOq38KIwpsHPTRQW3oMo0c0CcQOkbo1DZ%2Fu1hOFM%2FibE6FPqxbo2dm4bhWlL6Yd7rgxFS1"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8344ada52fe79b37-FRA

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 108ms
108ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8344ada59fa192a8-FRA
date: Tue, 12 Dec 2023 08:43:11 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SKmR7qXmX8xfSQdBVJNZNfLUjvZu0XrP1kUioQFJnHh4qhpr9FzTFugTTJGpzhecKcrUearzgEzkrEq%2F4rBXhQU5rvtqq3nKz%2BWQ%2BfwJ%2F8jwxyWBwhU0KSLGNzQpW1SEXVC0O1kePrtvdVrloiA%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
259 B 108ms
107ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-92cafdd1.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Dec 2023 08:43:11 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NriNSUJnTyvpG2QNwEf2Mz8w17Fz5sVUuh0jpChyul9eh2oplksazOd32h9Ps77loBD6UQJZYOks8YeG5ML%2FkTk1hc8%2B4Q7m73Hdmf7RBNxQ7%2FVPk5PPp2MvhZPe3NYGCDkDPj8QLUxf4GKXU3Y%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8344ada6481a92a8-FRA
content-length: 0

GET
H2 200 simcast.com Show response
demand.qortex.ai/api/v1/group/configs/stn-12018/ 20 KB
5 KB 258ms
248ms XHR
application/json 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://demand.qortex.ai/api/v1/group/configs/stn-12018/simcast.com
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-92cafdd1.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a72dd11cf63796929ed2cad8c0f7c2db12eb3d1778f6eb306e72910e6efc0b87

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:11 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DkmQSYdkGDYVlBKbIEemfcD0FZ64mRdUodSogiGot%2Baolaz84y7nx6qBjXV8YOHhA5IAT2HCmywPjxFkiJxxnIS0Ta9lNhuZCElQyJdtijzzwd5vahr1ag8%2FfMKvcEOeuNySVbJPbPWLl9gJfSo%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cf-ray: 8344ada5ffeb92a8-FRA

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 188ms
188ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8344ada59fa492a8-FRA
date: Tue, 12 Dec 2023 08:43:11 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tGmhXRQKZIjyYS5YXYaIn3bo5%2F40Hy0R2P99AzsQXOblmdx5f4o3Zjsu%2FVmHhRfIPQH1rQ43a84CCMv6NdIMEEl%2BABlebyX%2BrPf4jb1deg2glT7ffrK9GkR63TveQgEJhcGgRxuTXpUu0dVYbm4%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
262 B 104ms
104ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-92cafdd1.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Dec 2023 08:43:11 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RPKDLrByErNgiSWqgkYGSIi9mQYiVL5cQP4XyB0eaPByiXd9WzRiTvLWi0J7%2Fx44RlDCVINgudFSpnqcd28%2FLKLXJ%2BtI7z1A3v%2BEVcVtbCu8cct3DEnJox38BHae%2B3lQFFSPPehRt%2FdrpqSrHfc%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8344ada6c88892a8-FRA
content-length: 0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 42ms
14ms Preflight
application/json 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fsimcast.com%2F&domain=simcast.com&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Tue, 12 Dec 2023 08:43:11 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 253535
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 49 B
101 B 95ms
95ms Fetch
application/json 35.244.193.51
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0010b00002PIxPJAA1&gdpr=0&src=pbjs&ver=8.24.0&coppa=0
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: d0d2e098cd489ef7bc528c86de8ab5c51b5d6cdf9b76a8b08766036992f0d2f4

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 12 Dec 2023 08:43:11 GMT
via: 1.1 google
vary: origin
content-type: application/json
access-control-allow-origin: https://simcast.com
cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49

GET
H/1.1 200
OK / Show response
id.a-mx.com/sync/ 66 B
264 B 86ms
12ms Fetch
application/json 131.153.158.209
SECUREDSERVERS-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://id.a-mx.com/sync/?tagId=&ref=http://www.vinpearll-resort.ph/&u=https://simcast.com/?d=vinpearll-resort.ph&pcid=48&rid=112&a=0&tl=https://simcast.com/?d=vinpearll-resort.ph&pcid=48&rid=112&a=0&nf=0&rt=true&v=8.24.0&av=2.0&vg=aaw&us_privacy=null&am=null&gdpr=0&gdpr_consent=
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 131.153.158.209 Amsterdam, Netherlands, ASN60558 (SECUREDSERVERS-EU, US),
Reverse DNS
Software: /
Resource Hash: 37d080ec5c6a43a463ad1d31cf982c2d3479fba7b8f636193dac308e4f45b618

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 12 Dec 2023 08:43:11 GMT
access-control-allow-credentials: true
content-length: 66
content-type: application/json

GET
H2 200 json Show response
gum.criteo.com/sid/ 2 B
370 B 42ms
13ms Fetch
application/json 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fsimcast.com%2F&domain=simcast.com&cw=1&lsw=1

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: application/json

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:11 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 226776
expires: 0

GET
H2 200 pbhid Show response
id.hadron.ad.gt/api/v1/ 227 B
241 B 18ms
18ms Fetch
application/json 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/api/v1/pbhid?partner_id=405&_it=prebid
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 14feecfa02cc59ee705984377a16e99c55e6aa1277dfa763b84a2bf58e23b5a9

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 12 Dec 2023 08:43:11 GMT
content-encoding: gzip
server: cloudflare
allow: POST, OPTIONS, GET
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cf-ray: 8344ada64ee44d55-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 135 B
412 B 33ms
8ms Fetch
application/json 162.19.138.116
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ec2-54-82-17-205.compute-1.amazonaws.com

Software

Resource Hash

480613f771d4b2960ecbcbf9f0a8435d009d8f5fd10ab14bba1b1018762708e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 12 Dec 2023 08:43:11 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET envelope
api.rlcdn.com/api/identity/ 0
0

GET
H2 204 any Show response
idx.liadm.com/idex/prebid/ 0
366 B 284ms
93ms Fetch 54.82.17.205
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://idx.liadm.com/idex/prebid/any?resolve=nonId

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.82.17.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 12 Dec 2023 08:43:11 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin
request-time: 2
access-control-allow-origin: https://simcast.com
cache-control: max-age=3599, private
access-control-allow-credentials: true
trace-id: d1ed70611aabc559
expires: Tue, 12 Dec 2023 09:43:11 GMT

GET
H2 200 id Show response
id.crwdcntrl.net/ 43 B
314 B 100ms
30ms Fetch
application/json 52.212.46.188
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://id.crwdcntrl.net/id?c=17228
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.212.46.188 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-46-188.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: a96e1e97d62ab9747678b947bdf0a0ea5f81790b1e3a1df2d4607a86bf802596

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:11 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://simcast.com
cache-control: no-cache
x-server: 10.45.16.141
access-control-allow-credentials: true
content-length: 43
expires: 0

GET
H/1.1 200
OK fpc Show response
at.teads.tv/ 0
334 B 67ms
39ms Fetch
text/plain 23.218.209.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://at.teads.tv/fpc?analytics_tag_id=PUB_17018&tfpvi=&gdpr_consent=&gdpr_status=22&gdpr_reason=220&ccpa_consent=&sv=prebid-v1
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.218.209.56 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-218-209-56.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 12 Dec 2023 08:43:11 GMT
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: https://simcast.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Tue, 12 Dec 2023 08:43:11 GMT

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 45ms
7ms Script
application/javascript 2600:9000:223c:5a00:10:dd8:5e40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223c:5a00:10:dd8:5e40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

c7f6468c8ac1542980b2d5f637fa933d7d00d2c6ff6690e34505d2aed0c0e23a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:33:18 GMT
via: 1.1 3a3c1dcacd115187f53f40028ae4bd24.cloudfront.net (CloudFront)
content-security-policy: default-src 'self'
x-amz-cf-pop: FRA56-P2
age: 594
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 8730
x-amz-expiration: expiry-date="Tue, 17 Oct 2028 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
last-modified: Tue, 17 Oct 2023 13:17:45 GMT
server: AmazonS3
etag: "c46e30de24d0f12167e302e9e32ff4a5"
content-type: application/javascript
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: ARHw4IXE39XfrBWrvYa2vWPp14U-bs-D5hWxhOTLUZnWm-AlFA9BKQ==

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ 3 KB
3 KB 41ms
7ms Script
text/javascript 2600:9000:2250:2000:a:e047:753:a221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:2000:a:e047:753:a221 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 72e960baa80ec819264a604f2f8a8e5c21f81b785ebc17595211ad170d8b1bdc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-version-id: KP_OVZMS6roEW_XJdOd.KnSEmM8GWiP3
Date: Tue, 12 Dec 2023 06:19:35 GMT
Via: 1.1 2a6277094357eb47f8dbeacb06ed96c2.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P2
Age: 8617
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 2776
Last-Modified: Thu, 19 Oct 2023 06:40:11 GMT
Server: AmazonS3
ETag: "a3a9a9ee8e72db69d54e805f0586c651"
Content-Type: text/javascript
Accept-Ranges: bytes
X-Amz-Cf-Id: gLUhQQtE2VaXBdpT5Wy0DFPzkjaDf3Vvmek8yRaYeV-kgMmICrn5TA==

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 152 KB
33 KB 55ms
28ms Script
text/javascript 2606:4700:10::6816:3456
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3456 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

65d03eb82a79a732d7c0180593c4f5dc98a8fac5c20c3a5446c4f14bf93d280a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:11 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 07 Dec 2023 12:57:20 GMT
server: cloudflare
x-amz-request-id: SB3XV3WX7D3TRQY4
age: 3293
etag: W/"5fcefeebf5ddc7b2ddf2435967e63de9"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 8344ada6999818c7-FRA
x-amz-id-2: XK/uEyn2Io5UalpG02MciRCI2T5BGC42ZH9PVGUjT++wf10oqSqzOVRQs4UsI2d0cvzgX31ynXk=

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 43 KB
13 KB 57ms
27ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

2f1ad4ec7176f493b16e0d186f222e3484248cbb48f82289c736a0877f2d5894

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 05 Dec 2023 05:12:22 GMT
server: nginx
etag: W/"656eb136-aa2f"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 13 Dec 2023 08:43:11 GMT

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 30ms
8ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 19:42:46 GMT
content-encoding: gzip
age: 478825
x-guploader-uploadid: ABPtcPq15xIbIbXY6nprd-JVTBV0iLqfJkZsVBJ80bNsn3tMHDeQ1lbSePmHUH3XGm2QieXvuw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7927
last-modified: Thu, 27 May 2021 18:30:51 GMT
server: UploadServer
etag: "df5542b88bc0e368c6999754a5b9e2ba"
x-goog-generation: 1622140251693895
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
content-type: application/javascript
cache-control: no-transform
x-goog-stored-content-length: 7927
accept-ranges: bytes
expires: Thu, 05 Dec 2024 19:42:46 GMT

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 1 KB
1 KB 62ms
30ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b04a268fbd6ac543dcd653b1c529871767a5b78cb2a2f40e54bcb0bfe2daa154

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:11 GMT
via: 1.1 google, 1.1 google
last-modified: Thu, 03 Aug 2023 03:28:51 GMT
server: Google Frontend
etag: fc4e6bfe266081c4873c6f08c8298e5c
content-type: text/javascript; charset=utf-8
x-cloud-trace-context: 2160a428822d834e9e363551182a719e
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1207

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 39 KB
12 KB 35ms
8ms Script
text/javascript 65.9.66.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-97.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e885badff253144e188588b5657e13cfa1135d4cd682053c9cca02b83baf1ef2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 04:19:56 GMT
content-encoding: gzip
via: 1.1 95e0c26862caa0a0aa5e9580919524f8.cloudfront.net (CloudFront)
last-modified: Wed, 06 Sep 2023 15:56:57 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
age: 16026
x-amz-server-side-encryption: AES256
etag: W/"e073e71ed7a44e6f9cdd72904fda5940"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: 3pFbP9-32N4YPu6IEvUHXbuB1Q_lYeizGepO8XOjZ9tHj27-jZwJkw==

GET
H3 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
1 KB 34ms
23ms Script
application/javascript 2606:4700::6810:5914
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:11 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 9780
x-jsd-version: master
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230048-FRA
x-jsd-version-type: branch
server: cloudflare
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L5asH1L%2BCCyVEsw%2BVD%2BKPzIR7zptZ%2FEyEYLtCrOIu2aMwY9acFB0Jrmn77uMSPMv%2FQ7MMLkn9qQdikqE0XSA4xc6pu17TPXAvi5SfDq2I2jgQlNuwX0wnLcB2IZAuoTzFVhZEPxZuKj26rvupO8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 8344ada6883835e1-FRA

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 11 KB
4 KB 14ms
13ms Script
application/javascript 172.64.152.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.152.89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f6cfe89b284e6a2100a86b8d6b0e52b76b85cc62622a40d63e929f328d883a6a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:11 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 30 Oct 2023 20:31:13 GMT
server: cloudflare
age: 273625
etag: W/"65401291-2b7d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 8344ada679b565d2-FRA
expires: Fri, 15 Dec 2023 08:43:11 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 171 KB
46 KB 535ms
535ms Fetch
text/plain 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=101578578091841&correlator=4325014922779118&eid=31080078%2C31079240%2C31080057&output=ldjh&gdfp_req=1&vrg=202312070101&ptt=17&impl=fifs&iu_parts=22181265%3A22632072816%2Csmc_970v_2%2Csmc_300v_4%2Csmc_300v_3%2Csmc_sticky_footer_2%2Csmc_200v_2&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5&prev_iu_szs=970x250%7C970x90%7C728x250%7C728x90%2C336x280%7C320x100%7C300x250%7C300x100%2C336x280%7C320x100%7C300x250%7C300x100%2C728x90%2C970x90%7C728x90&ifi=2&sfv=1-0-40&sc=1&cookie_enabled=1&abxe=1&dt=1702370591739&lmt=1702370591&adxs=315%2C791%2C1230%2C0%2C315&adys=310%2C1172%2C405%2C2232%2C2000&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0%7C1%7C2&ucis=1%7C2%7C3%7C4%7C5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvinpearll-resort.ph%26pcid%3D48%26rid%3D112%26a%3D0&ref=http%3A%2F%2Fwww.vinpearll-resort.ph%2F&vis=1&psz=1600x0%7C417x0%7C339x0%7C1600x2162%7C1600x0&msz=1600x0%7C417x0%7C339x0%7C728x0%7C1600x0&fws=0%2C0%2C0%2C128%2C0&ohw=0%2C0%2C0%2C0%2C0&ga_vid=1249156730.1702370590&ga_sid=1702370590&ga_hid=1461476486&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj5h8fpxTFIAFICCGQSGAoJeWFob28uY29tGPmHx-nFMUgAUgIIZBIZCgp1aWRhcGkuY29tGPmHx-nFMUgAUgIIZBIbCgxpZDUtc3luYy5jb20Y-YfH6cUxSABSAghkEhwKDWNyd2RjbnRybC5uZXQY-YfH6cUxSABSAghkEhkKCnB1YmNpZC5vcmcY-YfH6cUxSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGPmHx-nFMUgAUgIIZBIXCghydGJob3VzZRj5h8fpxTFIAFICCGQSFAoFb3BlbngY-YfH6cUxSABSAghkEhsKDGxpdmVyYW1wLmNvbRj5h8fpxTFIAFICCGQSHQoObGl2ZWludGVudC5jb20Y-YfH6cUxSABSAghk&dlt=1702370589093&idt=730&prev_scp=refresh_count%3D0%26hb_bd%3D0%26anh%3Dtrue%7Crefresh_count%3D0%26hb_bd%3D0%26anh%3Dtrue%7Crefresh_count%3D0%26hb_bd%3D0%26anh%3Dtrue%7Crefresh_count%3D0%26hb_bd%3D0%26anh%3Dadhesion%7Crefresh_count%3D0%26hb_bd%3D0%26anh%3Dtrue&cust_params=gcRTDTest%3Dtrue%26pbstck_ab_test%3Dtrue%26wvr%3D3%26wie%3Dtop%26cndl%3D10%26cnrtt%3D0%26cntp%3Dna%26cnet%3D4g%26cnsd%3Dfalse%26wrc%3Dfr%26gpt_l%3D300%26wrap_l%3D1700%26ccp%3Dunknown%26sesdepth%3D1%26page_r%3D500%26padpr%3D16%2633acrossId%3Dfalse%26amxId%3Dfalse%26criteo%3Dfalse%26hadronId%3Dfalse%26id5Id%3Dfalse%26identityLink%3Dfalse%26liveIntentId%3Dfalse%26lotamePanoramaId%3Dfalse%26pairId%3Dfalse%26quantcastId%3Dfalse%26sharedId%3Dtrue%26teadsId%3Dfalse%26uid2%3Dfalse%26uids%3Dpubcid%26uids_c%3D1%26waai%3D700%26gc_bucket%3DB%26waae%3D1500%26pbglobal%3Daaw%26tif%3Dtrue%26lui%3D2s&adks=384240024%2C2056396624%2C15329010%2C1529572179%2C1416326483&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65ee953f39e9872396e19e94bbe5435a0208c75f5fc49fe2a904d8513793495a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:12 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 47036
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://simcast.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame F7BB 6 KB
3 KB 92ms
42ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 12 Dec 2023 08:43:11 GMT
expires: Wed, 11 Dec 2024 08:43:11 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
271 B 33ms
9ms Fetch
application/json 162.19.138.119
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.119 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533570.ip-162-19-138.eu

Software

Resource Hash

a8dbd5d760717467a6e72aa3d53f601a4bfb36c933d529789ca686102156eea9

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 12 Dec 2023 08:43:10 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H3 200 envelope Show response
lexicon.33across.com/v1/ 49 B
65 B 97ms
97ms XHR
application/json 35.244.193.51
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0010b00002PIxPJAA1&src=esp&ver=1.2.0
Requested by: Host: cdn-ima.33across.com
URL: https://cdn-ima.33across.com/ob.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: d0d2e098cd489ef7bc528c86de8ab5c51b5d6cdf9b76a8b08766036992f0d2f4

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 12 Dec 2023 08:43:11 GMT
via: 1.1 google
vary: origin
content-type: application/json
access-control-allow-origin: https://simcast.com
cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49

GET
H2

200

esp Show response
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvinpearll-resort.ph%26pcid%3D48%26rid%3D112%26a%3D0&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvinpearll-resort.ph%26pcid%3D48%26rid%3D112%26a%3D0&rid=esp&cc=1

85 B
193 B

119ms
118ms

Fetch
application/json

34.120.135.53
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvinpearll-resort.ph%26pcid%3D48%26rid%3D112%26a%3D0&rid=esp&cc=1
Protocol: H2
Server: 34.120.135.53 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 53.135.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: 51bef8efb8d8fddab2b33a4dc4f46d1e6686b21c66ef5f22c57f3913e0d8c7cd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:11 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-kK8msS80Q4eA0gvUPcPpAZkSJHo"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

Redirect headers

date: Tue, 12 Dec 2023 08:43:11 GMT
via: 1.1 google
x-powered-by: Express
vary: Origin
access-control-allow-origin: https://simcast.com
location: /esp?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvinpearll-resort.ph%26pcid%3D48%26rid%3D112%26a%3D0&rid=esp&cc=1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
330 B 38ms
30ms XHR
application/json 52.212.46.188
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.212.46.188 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-46-188.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 874c2484dc0971f7ce892eb8363ee8bc44efe25c994b4ec670b91209480b1849

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:11 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://simcast.com
cache-control: no-cache
x-server: 10.45.16.206
access-control-allow-credentials: true
content-length: 60
expires: 0

POST
H2 200 579.json Show response
id5-sync.com/g/v2/ 251 B
528 B 24ms
9ms Fetch
application/json 162.19.138.116
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/579.json

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ec2-3-75-62-37.eu-central-1.compute.amazonaws.com

Software

Resource Hash

6a5a0e6e31d39a45a983e433da8d2b29b81bf8d5363bfb12ffa1db393781184f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 12 Dec 2023 08:43:11 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2 200 fed Show response
ups.analytics.yahoo.com/ups/58813/ 2 B
199 B 48ms
12ms XHR
application/json 3.75.62.37
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ups.analytics.yahoo.com/ups/58813/fed?gpp_sid=-1&v=1&url=https%3A%2F%2Fsimcast.com%2F

Requested by

Host: connectid.analytics.yahoo.com
URL: https://connectid.analytics.yahoo.com/connectId-gpt.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.75.62.37 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/9.1.10.94 /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:11 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
vary: Origin
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
access-control-allow-origin: https://simcast.com
content-type: application/json
access-control-allow-credentials: true

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 6CC2 15 KB
6 KB 15ms
15ms Document
text/html 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=simcast.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4563823fd629a48517c7feb8bf33640e12440e08bdde7a172ce477c2ddfc9c4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 12 Dec 2023 08:43:11 GMT
server: Kestrel
server-processing-duration-in-ticks: 317275
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 285 B
560 B 50ms
26ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 3966e773d007c4563c7d0e325ff86385d62b1a8302ffd575ad9d96f6662413e0

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 12 Dec 2023 08:43:11 GMT
via: 1.1 google, 1.1 google
server: Google Frontend
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
x-cloud-trace-context: b2f23c2897788887952bd4386ff72999
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With
content-length: 285
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2

200

sid Show response
mug.criteo.com/ Frame 6CC2
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=simcast.com&sn=ChromeSyncframe&so=0&topUrl=simcast.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=frYSY3xKYUtrRUlQUHo1QkpjeWlNNlJkNEh4VmhrbC93aTFiSFYzYXpnWjhkZHNNTXdyTXVvTFNLcCtWVEc5YXljUnc1am8wRnN1VkRaZytKZmExaVpYWG54SmhKdXBDdUI2bE4vNEtsdU1zSW4xajJVWnlRM3J4bjRRN1...

433 B
654 B

16ms
16ms

Fetch
application/json

2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=frYSY3xKYUtrRUlQUHo1QkpjeWlNNlJkNEh4VmhrbC93aTFiSFYzYXpnWjhkZHNNTXdyTXVvTFNLcCtWVEc5YXljUnc1am8wRnN1VkRaZytKZmExaVpYWG54SmhKdXBDdUI2bE4vNEtsdU1zSW4xajJVWnlRM3J4bjRRN1RpV1ZLdnZPMW0zc0V3ODZHcTF6dGFPU0xDUlNYQ1F4T285SmZrTmR0R0QwYXhiKytQRVNIdzdJMndJMjRnTjFtRFh2MWF5UGdjQ1RPUUw2dkdyUC9IZEQwb1cxemZJcTJSbjBFSC80ZEcxUVRIZlF1R282eDhxaVFsemtkOWJPK2t6S1Rucy9jMm9aenZDczJSMG5ZRnhOMUQ4aGRzZz09fA&cppv=2

Protocol

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

32afae54845f350351aa6f250d738fe1ea887f570b27bc0a47ae728c943bd966

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:11 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 2997508
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:11 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=frYSY3xKYUtrRUlQUHo1QkpjeWlNNlJkNEh4VmhrbC93aTFiSFYzYXpnWjhkZHNNTXdyTXVvTFNLcCtWVEc5YXljUnc1am8wRnN1VkRaZytKZmExaVpYWG54SmhKdXBDdUI2bE4vNEtsdU1zSW4xajJVWnlRM3J4bjRRN1RpV1ZLdnZPMW0zc0V3ODZHcTF6dGFPU0xDUlNYQ1F4T285SmZrTmR0R0QwYXhiKytQRVNIdzdJMndJMjRnTjFtRFh2MWF5UGdjQ1RPUUw2dkdyUC9IZEQwb1cxemZJcTJSbjBFSC80ZEcxUVRIZlF1R282eDhxaVFsemtkOWJPK2t6S1Rucy9jMm9aenZDczJSMG5ZRnhOMUQ4aGRzZz09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 279880
content-length: 0
expires: 0

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 106ms
106ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8344ada7b91892a8-FRA
date: Tue, 12 Dec 2023 08:43:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y3VOpsPkxSxHSMAz5jNuN%2FiROkgsZx1Ku90luVVSuawBV43%2BZAFl5HOkM3cMU2gEJecP2GxuSO6tHfRq2YQuEZGIL01paExf%2B5pSHMk0wStrojMsqq1jqFain2FlgBvRaRYQcKyd51th5KT7RJs%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 pwt.js Show response
ads.pubmatic.com/AdServer/js/pwt/161089/5500/ 212 KB
64 KB 49ms
8ms Script
application/javascript 23.32.184.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/pwt/161089/5500/pwt.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-92cafdd1.system.entry.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.32.184.192 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-184-192.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 4dcf78b31f69c1674cb5a75cd5fd5744538b50eaf34076396d9cf54acebee6e4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:11 GMT
content-encoding: gzip
last-modified: Sat, 29 Apr 2023 00:43:34 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=32064
accept-ranges: bytes
content-length: 65407
expires: Tue, 12 Dec 2023 17:37:35 GMT

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
263 B 112ms
112ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-92cafdd1.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Dec 2023 08:43:12 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2diLJnGQlEd%2BPZ8%2B4O6EntR9USJv%2BolNOBleYKOjseTgsELElik9EHiA83Gsun6%2ByCYbRbp4i026EIjB%2FcqB%2BWPSLGwljYaRNiyTawL9gnRXm2GDZKr2uyq0upGjWHBZz90Y9T4r0ZZqBJcrI5Q%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8344ada869a792a8-FRA
content-length: 0

GET
H/1.1 200
OK user-sync Show response
sync.adkernel.com/ Frame D994 0
134 B 47ms
13ms Document
text/plain 77.245.57.72
WEBAIR-INTERNET-MTL

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=200527&r=https%3A%2F%2Fdemand.qortex.ai%2Fsync%3Fakuid%3Dhttps%3A%2F%2Fsimcast.com%7C%7BUID%7D
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-92cafdd1.system.entry.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 77.245.57.72 , United States, ASN36057 (WEBAIR-INTERNET-MTL, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store
Connection: close
Content-Length: 0
Date: Tue, 12 Dec 2023 08:43:12 GMT
Server: nginx

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 102ms
102ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8344ada7c92092a8-FRA
date: Tue, 12 Dec 2023 08:43:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nVRsKzmMOYicy98mUBHd%2BkAvvPOvzkTCz%2FG0La2wbOEL6UYiufAtzEg1PPxMBUXzpX3VbbUCkTmuNWSS0cp772%2BdP%2BtuK9PVuEzHTaBQwFLKDLC1A%2BZiwWIKrqKcNdObynxPBvi1%2F7JNwohGBN8%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
266 B 106ms
106ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-92cafdd1.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Dec 2023 08:43:12 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y%2BG0LW9gGCwG2Uo%2BBJNNdzPV%2F7WANMSb93Adqh7m3%2FzDHz6MhBYJGsaz%2FfWCJlY6SlWc7P%2BTD%2FjV67ihXNXRdW9ZVGHNwaoCqifEA6qTFUJGzZvBFypzptKLMqLhDR2HGhPK01cQMjhCUq9n91c%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8344ada879ab92a8-FRA
content-length: 0

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame 5DF6 0
167 B 38ms
17ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 20
content-type: text/html
date: Tue, 12 Dec 2023 08:43:12 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H2 200 publishertag.prebid.139.js Show response
static.criteo.net/js/ld/ 95 KB
31 KB 19ms
19ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.139.js

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

139b31c08f90a423ecbc70bb84529127db75894a8bb23c4858e141f89cdc0a32

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:12 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 26 Oct 2023 13:53:27 GMT
server: nginx
etag: W/"653a6f57-17cae"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 13 Dec 2023 08:43:12 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame A2CC 15 KB
6 KB 16ms
15ms Document
text/html 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=simcast.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.139.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4563823fd629a48517c7feb8bf33640e12440e08bdde7a172ce477c2ddfc9c4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 12 Dec 2023 08:43:11 GMT
server: Kestrel
server-processing-duration-in-ticks: 846040
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 publishertag.prebid.139.js Show response
static.criteo.net/js/ld/ 95 KB
31 KB 51ms
24ms XHR
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.139.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.139.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

139b31c08f90a423ecbc70bb84529127db75894a8bb23c4858e141f89cdc0a32

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:12 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 26 Oct 2023 13:53:27 GMT
server: nginx
etag: W/"653a6f57-17cae"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 13 Dec 2023 08:43:12 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012310301456000/ Frame 215E 196 KB
56 KB 61ms
7ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c6077711ce3174050ccebe6559eb5f0e251942c2cad21900d1c3ef316065565b

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 12 Dec 2023 03:37:55 GMT
age: 18317
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56081
x-xss-protection: 0
server: sffe
etag: "6a17d296884b026a"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 11 Dec 2024 03:37:55 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012310301456000/v0/ Frame 215E 15 KB
5 KB 78ms
25ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b53b6ad23b258ce11eed97786741510819a369348afcf1260856fe3041fc33de

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 12 Dec 2023 03:37:45 GMT
age: 18327
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5225
x-xss-protection: 0
server: sffe
etag: "0b7142e00666043e"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 11 Dec 2024 03:37:45 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012310301456000/v0/ Frame 215E 95 KB
29 KB 76ms
23ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3907cc5ed9d4a0cdb316d069614220b55fccd5624ac173592a7a4c2c3aae0636

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 09 Dec 2023 01:47:30 GMT
age: 284142
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29077
x-xss-protection: 0
server: sffe
etag: "7b1f1965b6cd6fda"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 08 Dec 2024 01:47:30 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012310301456000/v0/ Frame 215E 5 KB
2 KB 72ms
19ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

516f5e4c2dc5c69f3e1707e76695f866f8e62468aca15c1a9ddb165eb684f6f0

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 11 Dec 2023 13:51:29 GMT
age: 67903
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1911
x-xss-protection: 0
server: sffe
etag: "5b0a82507b260c6e"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 10 Dec 2024 13:51:29 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012310301456000/v0/ Frame 215E 40 KB
13 KB 73ms
20ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18ebc36644e10f87e20812c15e329c1b25848c62cd6cdfe74427cdf8995bc3a9

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 12 Dec 2023 01:09:26 GMT
age: 27226
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12952
x-xss-protection: 0
server: sffe
etag: "9817e561a46c70fa"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 11 Dec 2024 01:09:26 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 215E 2 KB
571 B 16ms
16ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:300&lang=en

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4d20f3d941ac9828ed48f9424e249fba0939dc62e99875ae214e85de9886b62d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 12 Dec 2023 08:43:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 12 Dec 2023 08:40:23 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 12 Dec 2023 08:43:12 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 215E 2 KB
2 KB 8ms
7ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: simcast.com
URL: https://simcast.com/?d=vinpearll-resort.ph&pcid=48&rid=112&a=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 11:53:15 GMT
x-content-type-options: nosniff
server: cafe
age: 74997
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Tue, 12 Dec 2023 11:53:15 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 215E 295 B
319 B 11ms
10ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: simcast.com
URL: https://simcast.com/?d=vinpearll-resort.ph&pcid=48&rid=112&a=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 17:24:32 GMT
x-content-type-options: nosniff
server: cafe
age: 55120
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Tue, 12 Dec 2023 17:24:32 GMT

GET
H2 200 14765969140547304818
s0.2mdn.net/simgad/ Frame 215E 196 KB
196 KB 10ms
9ms Image
image/jpeg 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/14765969140547304818

Requested by

Host: simcast.com
URL: https://simcast.com/?d=vinpearll-resort.ph&pcid=48&rid=112&a=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7ef80a6d25b51b7cccf581448df94d5a3ef2897ba51bb11d1f070c91ecc5adb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 02:09:38 GMT
x-content-type-options: nosniff
age: 23614
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 200268
x-xss-protection: 0
last-modified: Wed, 29 Nov 2023 13:04:54 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 11 Dec 2024 02:09:38 GMT

GET
H2 200 10445506761871864519
s0.2mdn.net/simgad/ Frame 215E 5 KB
5 KB 37ms
36ms Image
image/png 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/10445506761871864519

Requested by

Host: simcast.com
URL: https://simcast.com/?d=vinpearll-resort.ph&pcid=48&rid=112&a=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9e95c8fe340de5f72262c9e050f89073e802a98abeed6c5570d0baa107df15a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 11:49:54 GMT
x-content-type-options: nosniff
age: 75198
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5193
x-xss-protection: 0
last-modified: Wed, 29 Nov 2023 13:04:58 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 10 Dec 2024 11:49:54 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 215E 0
0 16ms
15ms Image
text/html 2a00:1450:4001:802::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSg6Rq5mrWcseRUSLpWq_v2dM-xmtDYZgX8fIcPUUJas7PxmxiYXnJxIiBZ20u75BiTsVXIH_VS4CrVPVy9C0ThmijNSg
Requested by: Host: simcast.com
URL: https://simcast.com/?d=vinpearll-resort.ph&pcid=48&rid=112&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

GET
H2 200 container.html Show response
f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 3AFE 6 KB
3 KB 11ms
8ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 12 Dec 2023 08:43:11 GMT
expires: Wed, 11 Dec 2024 08:43:11 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 781F 6 KB
3 KB 8ms
8ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 12 Dec 2023 08:43:11 GMT
expires: Wed, 11 Dec 2024 08:43:11 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 6536 6 KB
3 KB 11ms
11ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 12 Dec 2023 08:43:11 GMT
expires: Wed, 11 Dec 2024 08:43:11 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame C329 6 KB
3 KB 14ms
14ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 12 Dec 2023 08:43:11 GMT
expires: Wed, 11 Dec 2024 08:43:11 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 215E 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0908ffa0053142bb7e06f66c809045214c4ba0458bae53275d700a644093e712

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

sid Show response
mug.criteo.com/ Frame A2CC
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=simcast.com&sn=ChromeSyncframe&so=3&topUrl=simcast.com&bundle=OhvzzV9GNVlYJTJGUGpsZGlEOUE5VGJDaEFyRlM5SmFFM0x0Z2ZoMmJPaG04dldUM0RrM0NHSkU1...
https://mug.criteo.com/sid?cpp=-fOJnnwwc253YldPZmt2OVhIMCt5cTZ3ZWJxOHpTS3J5K1NVcmpWUFRzeGpzcVdRbFdMdnVBS1EyeVMyb083SmMwdzVpbnplZ252OE9wN2VhdENPdUtCVjIvclhsaTREM29zZnBaNGh4Q2RETUJLbUNMdGdGaFBIYzNPZC...

433 B
652 B

19ms
15ms

Fetch
application/json

2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=-fOJnnwwc253YldPZmt2OVhIMCt5cTZ3ZWJxOHpTS3J5K1NVcmpWUFRzeGpzcVdRbFdMdnVBS1EyeVMyb083SmMwdzVpbnplZ252OE9wN2VhdENPdUtCVjIvclhsaTREM29zZnBaNGh4Q2RETUJLbUNMdGdGaFBIYzNPZCt0L3VNcVMxRW04Ni9qNitjRmdBTnJyNXduQnJ2OXZIQkZWMkRCMStYRkVITGlYc0FiSW9JNGJPYUlmeHl0ekpPWUJKN2FYaFZRS055RzlWMGhiQmVscVNaelJsdElBcVYvOWM5UW1NMUNMQ3h4bDA4YUsxVWlVNVZ5Zmc4MWpsWEp3QXRuWjRXWjJiS2RTZTJscUlZVlFydFErWWJKWHViRjEzdnhDbDVCNE8xenUxaTE3Zz18&cppv=2

Protocol

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

2bd7227951241868764ae2b048dffc8af5ed781882a24ec09bc0a4dda5816d14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1305096
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:11 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=-fOJnnwwc253YldPZmt2OVhIMCt5cTZ3ZWJxOHpTS3J5K1NVcmpWUFRzeGpzcVdRbFdMdnVBS1EyeVMyb083SmMwdzVpbnplZ252OE9wN2VhdENPdUtCVjIvclhsaTREM29zZnBaNGh4Q2RETUJLbUNMdGdGaFBIYzNPZCt0L3VNcVMxRW04Ni9qNitjRmdBTnJyNXduQnJ2OXZIQkZWMkRCMStYRkVITGlYc0FiSW9JNGJPYUlmeHl0ekpPWUJKN2FYaFZRS055RzlWMGhiQmVscVNaelJsdElBcVYvOWM5UW1NMUNMQ3h4bDA4YUsxVWlVNVZ5Zmc4MWpsWEp3QXRuWjRXWjJiS2RTZTJscUlZVlFydFErWWJKWHViRjEzdnhDbDVCNE8xenUxaTE3Zz18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 336562
content-length: 0
expires: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 8E85 624 B
242 B 49ms
48ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNUFJyjhBZyUAXgJlwb7NV21VfUnA3sDywfdOUEPTRJzhziYvy4PNX5-XxhF-66VYO_zcRJsBBKxKGUb4Zh_u43iyMsHrzzUrXk2G0Hen1HFWmO3TZYlXQ84Eg3R_fJtHiTS1movBRCYCLZA-qp1JzBobF8mKj25yHlsJ4GXn3gLIebVdz7XETmeke8iHFX2pAifBQhqqNL_cJ1AqKYY3VwvVCeAXg

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 12 Dec 2023 08:43:12 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 3AFE 89 KB
31 KB 57ms
57ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:12 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 08:43:12 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3AFE 42 B
63 B 42ms
41ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AUT3k-a6bZfa-9fVTwhBjwDYIenEx-SNAcJhJSluKbLi1iGkeJIQf955v12pHEIbobSkvu7geXeNvOnOyQsvSbDowKGsoJyV6OvbsjCwzHjRMHUwY

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 3AFE 3 KB
1 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 01:54:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24533
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Dec 2023 01:54:19 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 3AFE 20 KB
8 KB 12ms
11ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 01:54:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24533
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Dec 2023 01:54:19 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 3AFE 0
0 15ms
14ms Image
text/html 2a00:1450:4001:802::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQnjHlR4xRFlJgq3uHb5fsjrQGoWb104X9575KVtwpK8nSbdPqS-RG3hJrAToSVDG0IzcsOeOtmgt8Gr-uEA-FTwE6xxQ
Requested by: Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3AFE 203 KB
64 KB 100ms
75ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9129c3cb5b3b6d486d719614ef0e64508258a9d15de6c8bfab167e3da9dd87f3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65486
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702315402350014"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 12 Dec 2023 08:43:12 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 59CD 624 B
242 B 54ms
50ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKvU5fQCEMaIsIIEGJSMhfMBMAE&v=APEucNUttECls7EyeyDA7pWibIQ_xV_-XNVDS-n2NqbWKEj5aME2D2a_5FshWH9PivcXkRk3ViltHPpwGOZMNsY2NBR8V8j86_tzgk69hGbaxLneq_ucdGlnF2VfVpgD18-krBRi0srXsDm12TrGe0AJGYwizcT7oFa9FvhfgMNatzziKH8CkH2Fcykw_Fnht0pETArIZ-q-OXe2AVkslRdLYXRPYhK3SQ

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 12 Dec 2023 08:43:12 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 781F 89 KB
31 KB 51ms
49ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:12 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 08:43:12 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 781F 42 B
63 B 44ms
41ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-ChJH_J5qATfcU8L9qWafZbrQ9-KV96OGNmuUBusEXsJliKCszrXeE0VoMA870ZtIkkg8fF8ZFNP-Q6txwaELvFVoadRIxvVnX3W5Z5Wkzmb8aeIn0

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 781F 3 KB
1 KB 11ms
9ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 01:54:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24533
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Dec 2023 01:54:19 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 781F 20 KB
8 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 01:54:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24533
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Dec 2023 01:54:19 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 781F 0
0 16ms
15ms Image
text/html 2a00:1450:4001:802::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRJ4x-b8dJQLawTowpf3zCpN0ewZ8HK7_NFN-HZcCpq_YS2SzOIoMWlsjVI9oevOKua-AF2kKoPQJ11xogbq9hy1FS3IQ
Requested by: Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 781F 203 KB
65 KB 50ms
29ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9129c3cb5b3b6d486d719614ef0e64508258a9d15de6c8bfab167e3da9dd87f3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65486
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702315402350014"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 12 Dec 2023 08:43:12 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 17B6 640 B
262 B 55ms
50ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNXaa4EyvzzGAKA69gzob3AYewA4rbjpLvDzv1mn6FCGWrKg8a6T6lddsSawYpABF0n2eU9dsEw9TRrWXib1n0QZ_j5kdI6FcP3djhmFG-nX3iCNto_7p8i8Pd4c6v17McE69xd-lYzYiocrbJepWXbP6bigbhJdif62t02KouUVVnHaitExH9GBTez2onr-zV23p43IEzxw6cgvTD1kE7BPeRmGOQ

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 12 Dec 2023 08:43:12 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 6536 89 KB
31 KB 169ms
164ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:12 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 08:43:12 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6536 42 B
63 B 46ms
42ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DvXQnxsx_1gch_l_fw51f6xmdv1pYynWkSoOZEobNxFUHXXzahtJZGbgHIKziqDaT6ieozvomGeobXTkTCr_JNGyqtrxuaEAyydNEZuzev6MLmALo

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 6536 3 KB
1 KB 11ms
7ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 01:54:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24533
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Dec 2023 01:54:19 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 6536 20 KB
8 KB 11ms
7ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 01:54:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24533
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Dec 2023 01:54:19 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 6536 0
0 19ms
15ms Image
text/html 2a00:1450:4001:802::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQwjl4PEKAjT_vn0xyUgpBmr500nS6f1EVsgVt-bZ5sc3wwWQLtZ0s89ogwmgMJGuY5QG6IlAV8leRgYv74Wh38Hg7Iyw
Requested by: Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6536 203 KB
64 KB 97ms
77ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9129c3cb5b3b6d486d719614ef0e64508258a9d15de6c8bfab167e3da9dd87f3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65486
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702315402350014"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 12 Dec 2023 08:43:12 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 8951 624 B
242 B 53ms
51ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj5oLvGATAB&v=APEucNU5Jr-BVthd9AZ1vmh8WXhPc3IphJ-kfH5XcasiQC--3CbVkJWYzJC4GQcmq_n87B3drH-pSyjC0LZBhbP2x728laTieccCNDJHuLCLXiwi7yApdajhReMNfqbcrr6RtzmDEgRdVhGoAHT1LHKVRHVZfUc8WJ2UUoWQCnBY8OqliH0L0hEpklWWK1sOtJAaBG8_n18ZdM02oE7Q_2NR2-7PcuWoMQ

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 12 Dec 2023 08:43:12 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame C329 89 KB
31 KB 166ms
164ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:12 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 08:43:12 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame C329 42 B
63 B 43ms
41ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DCwQMWQZeF9GXcEWD_qoyibB490g1Ykuen3x1ukfp0dVIJOnOvyz-oh49FxSEPSMjOzZQLG2gpm9KxTtmhmxWsNhTVrS7MbJLu5nbnPoRIv9lKmJk

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame C329 3 KB
1 KB 11ms
9ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 01:54:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24533
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Dec 2023 01:54:19 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame C329 20 KB
8 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 01:54:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24533
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Dec 2023 01:54:19 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame C329 203 KB
64 KB 92ms
75ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9129c3cb5b3b6d486d719614ef0e64508258a9d15de6c8bfab167e3da9dd87f3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65486
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702315402350014"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 12 Dec 2023 08:43:12 GMT

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 215E
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

17ms
17ms

Image
text/html

2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by: Host: simcast.com
URL: https://simcast.com/?d=vinpearll-resort.ph&pcid=48&rid=112&a=0
Protocol: H3
Server: 2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Redirect headers

date: Tue, 12 Dec 2023 08:43:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 8E85
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMhkFemaZ878Y2oQclO86p0&google_cver=1

43 B
736 B

39ms
33ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMhkFemaZ878Y2oQclO86p0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNUFJyjhBZyUAXgJlwb7NV21VfUnA3sDywfdOUEPTRJzhziYvy4PNX5-XxhF-66VYO_zcRJsBBKxKGUb4Zh_u43iyMsHrzzUrXk2G0Hen1HFWmO3TZYlXQ84Eg3R_fJtHiTS1movBRCYCLZA-qp1JzBobF8mKj25yHlsJ4GXn3gLIebVdz7XETmeke8iHFX2pAifBQhqqNL_cJ1AqKYY3VwvVCeAXg
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G5hscPdkSWYzjivGrsBe2X%2BExq4Pu1ST5xYSimOtTrGoewQKHiT%2Fu8s55ZaYNsewwvRRb%2Fp5vADPJTwHgoWMKAljWOXerjFfnj%2Bn4vJ3ZX5Zqgn%2BS6R9WQ9B08mUboAP7snI5BWeSQZqcg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8344adab0eb91cc3-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMhkFemaZ878Y2oQclO86p0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 8E85
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZXgdIApTNrzIXldbGaOYSgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMhkFemaZ878Y2oQclO86p0&google_cver=1

43 B
730 B

24ms
24ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMhkFemaZ878Y2oQclO86p0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNUFJyjhBZyUAXgJlwb7NV21VfUnA3sDywfdOUEPTRJzhziYvy4PNX5-XxhF-66VYO_zcRJsBBKxKGUb4Zh_u43iyMsHrzzUrXk2G0Hen1HFWmO3TZYlXQ84Eg3R_fJtHiTS1movBRCYCLZA-qp1JzBobF8mKj25yHlsJ4GXn3gLIebVdz7XETmeke8iHFX2pAifBQhqqNL_cJ1AqKYY3VwvVCeAXg
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=71AU0N28lNd9rp8ngAQBEuQYmtG1J7rGJTwcaz8LD6xD53h8gt%2FJlzNzMNJ93jTPNlSZWtVgQpo8CBEcb0K5DicRIJb0mthVY5gUQ9YMZ3%2B0HfLL951lwH16MSWaim28ZTcPuyfdvH77bw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8344adab2efd1cc3-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMhkFemaZ878Y2oQclO86p0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 8E85
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEC6YSYoBYMCIFyH_EvudebY&google_cver=1

43 B
836 B

8ms
7ms

Image
image/gif

37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEC6YSYoBYMCIFyH_EvudebY&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNUFJyjhBZyUAXgJlwb7NV21VfUnA3sDywfdOUEPTRJzhziYvy4PNX5-XxhF-66VYO_zcRJsBBKxKGUb4Zh_u43iyMsHrzzUrXk2G0Hen1HFWmO3TZYlXQ84Eg3R_fJtHiTS1movBRCYCLZA-qp1JzBobF8mKj25yHlsJ4GXn3gLIebVdz7XETmeke8iHFX2pAifBQhqqNL_cJ1AqKYY3VwvVCeAXg

Protocol

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
an-x-request-uuid: 004e68c3-72c5-46db-8d64-45e733d604a1
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 81.95.5.37; 81.95.5.37; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEC6YSYoBYMCIFyH_EvudebY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 8E85
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDIyMzA5NTMzMDY5MDU2OTM5Mg%3D%3D

170 B
243 B

27ms
19ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDIyMzA5NTMzMDY5MDU2OTM5Mg%3D%3D

Requested by

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
an-x-request-uuid: d791dfb2-feee-46c5-98e0-c753377441f4
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDIyMzA5NTMzMDY5MDU2OTM5Mg%3D%3D
x-proxy-origin: 81.95.5.37; 81.95.5.37; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

1x1.gif
imagesrv.adition.com/ Frame 215E
Redirect Chain

https://ad4.adfarm1.adition.com/banner?sid=5152705&kid=6239006&bid=18925011&wpt=C&gdpr=&gdpr_consent=&cbvp=2
https://imagesrv.adition.com/1x1.gif

68 B
103 B

43ms
12ms

Image
image/gif

217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/1x1.gif
Requested by: Host: simcast.com
URL: https://simcast.com/?d=vinpearll-resort.ph&pcid=48&rid=112&a=0
Protocol: H2
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 5fb3bdb7f966c852579fb6b0574517445d5b2d171c804d66227ee67b1bffca9c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 12 Dec 2023 08:43:12 GMT
last-modified: Fri, 24 Jul 2009 13:46:10 GMT
accept-ranges: bytes
etag: "3122740758"
content-length: 68
content-type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 12 Dec 2023 09:43:12 +0100
server: ADITIONSERVER v1.0
etag: 7311626018327563274
content-type: text/plain
location: https://imagesrv.adition.com/1x1.gif
access-control-allow-origin: *
p3p: policyref="https://imagesrv.adition.com/w3c/p3p-ssl.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
cache-control: no-cache
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 ad
googleads.g.doubleclick.net/dbm/ Frame 215E 42 B
64 B 37ms
35ms Image
image/gif 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DMzKd32V_EepO28-WCjeoR_mPWfRpbDjsrB6G_HlYMfB9B9vRzZ1alY7DggndKjHl783Xp2iVUYjZBp6HwxG1btrZavQ0X5ZDOWv__90ekxP4xpEFt3e5OQNzC4Rm0rI_mbt1GLvStisUlWPsEShee4Q6zgYakW_FrFNECapP89zugQdo&cry=1&dbm_d=AKAmf-B-V40eeVsm0rO4rX34s-2Wa16UXaCiIw1-gKk5vsq4AmW250vHoApYgYIFjVVsPaXRP8RzkZRIG2NkzzQW8ikmymIp70z5EQEtREyc-HSMDOnbrkdXBDLLGaFw6FXqHMUuwXfQD9WH7Im4_ohsIlkzRAcHfzEFtE4PJzVG5hMOxFa6CR9nYZW3TfEWAoXs5MhRKLngvgD_SsPFzBOOyDjBXZLFv53FuMy01FXpOl9dslUlPj5qidiWr3zpHAohpSB54n4hyDbK6QP72BtexoXx5kADDPHLXY_Xx2VmL-umcvpcJxSkSLQ3P2u4Js7b-izBD5f7x3Egn7jrzdozK889KBWjHND4C0_tNlATOTKVErXBlMruJgBpA4TvVDwkjWj3Xe_6JmoiLAPW-lpzS9H8RzZ4aAi4Fn8mxQ3Iu9CyEM6xWoYqBsQ1KjuazxsCEjN2oUuilDjndbDyaZVr75UPcMgIbh52JHYnVNjQsapTCFRqfoL11c8UIHctU-wRmXBGcxcCxJCMVt1Eyue7yBRKQ5LiInpXqidEDmvg2VURXjVEvflHpWE1t8jBQeBuZXQQewR6i9zJ-NGsQ2lAqe4939wjNxRB8w_wpi919k9jdbV3aDzGxLb6Pe3ZVIalTXScj0PMOng6Oxd3CDfXim1esqpuOAHhxA6p48WHxYo8UKpwBEajYf6MksNgpz4hI3-TYp55MSeKBXNTTnLvWv-2GL8JMfp6liB7f0jzHFYeqYMbYkN-3_qpbkuzoCE9P7Fyc68uQ8dRPdeWc3_wzLEAwIJGer6zLUcSkVqzZ65P-bBq6jIcHVjWrQaqMapyLk6JIDX8rql1h31PoNDEbPulZrhxi2In-1wlviMcwuvyEuNAjGuqAJpzbs_ZDtBqxRANmdHRoEG9NN7jp2-d4QbCRHe5e-n7K5ah9l1Bf1jnwgizDgtzN43Dy2n78wil0whNsQrdVwM8Z_VvPHZxWQJhmafTuJ586JFRrBHjzBT9a70Et0IV3qI1CkkAgj_WNaBjpBGk9OKqEq0YlEXv19yEXArpy8T-KnhX7ZJanwp5AWteeb6S5YRnPoiaIloFCYrFGE8fV-gTWUnj5DeUiHogb-TBAMn5Xl0JU_KjJyoxq9QIOkkal-0DmmNqYFjnhmHBOzvukEhFeCFDylMBXUyZsItLP94q5cRg6fceVEVYwdVcp0lAkIGZ-LrQS9GKqncLMPNC0o_w5ce153LXySdV7zI8O7VdGjnDIoaPLLQhUhyKu56nxlCUex0DcfBy4raJpCMLuYqlzicAfGJq0g9E0Rdrq-Bvgsrw0YAEp2ImO1Od8QuDh91EA1wdO4INw1288JlrSTYVVIKQ2GqUe_2LKpABb4S2o23DnXZ2uHzEaE3oGxjOvarpcTI5Vno4On7xwaouQPdIV4Hh6U4NsvnkCcv_rBhwvDHvtP9f3yT3ID3lox_T6_x4HjVo1Y-IhgNNstg91KXmgFZdcJzL9-UplpkhYRQYyn2vANYjoxtSwFjudDjV69wi8hDyfgJDNabm4Ns8Wfl1deOjE_DGWngFOgSGkZYRDqEHexQa2AOJv1DtRbl8OxWk2SisKX3UwMulVS5A-JnnWlH_Vu3WvzxTiGLvuHJZERTErh85KAuUs9zBDc2xOZCGNxWysVlj5nBHEPP_z1cZGAgYUIreFgG6_SyBFzGzVq5VVdvdwbZr9w-YKvZg3MWz0rNxWnB_LsVUgaI-S3r1kfg_hQqMhOcvCIylddak7QNC1Meg-iSNW_xCsopfnawW17s8PK9TPwWUJW_FeTONj8_DsEUB5ebCParkRFBTy3jeUXL-1O33XMdbNo9IKAu0MsHPhF-Yc3IUlIQHfqB5qL4aZMEk0KqW84SFcVBhs6LCeZgW_Ty-twlCQIhW_-z95Z2-LoRnxsxTeDA8SJIdOFxyOPiffrv61HCS1QzziRpZpCeyPx7xNoj36cRcxfzrkD-DOJ8jN2AtEaFqxyfQ9nI1tdouvgNyV5KDbD_PyaPUQmWcyrBWbeOv_bnZmG1mKpKDb_jiDvqPgGsJZkmkdW7SltoMd7uffxUpAxVExUsrLya43IrQ4ZjwQDt-Guku4H-K3wuE8r3amU8ZCvO-t73nBtabixfx6l9UpKQTukrI_-KGrjUDc2UsU6N4MeHiEvu-xxY35VK9KSakX9jGI_unnMJTv8ZPcImlVLHLHfCX_SkrUOqn31ZXAiV0FLyd195gc2eV9mnXJ-xmzNK3SCmM0ujdcACSXOSFxXKqx8Umcm00c4tFfkhZYpZ32sENo091unADyAG127FbaCQ8Zw3u7Ldarm0-vIk0wjeJA5UszeY5xJfDAz8Wk6zfFkckO6bArlyana9l71Z0yC4yU0RRdNYcVu_R0d4s_r6sOwpcI84oOXSSQAXYTiU_FjECRjL_YIa35z_7iigKwqaiwxXK-OeSJ4ZlMqmGTgg0FrynubOtAODHiAfNih_-72ZVD6ml9SAso4MzG3mrLNW0y1n1r-K3qr9FF78H9NHZFkwFu5aRwxMoY2NoPS8D1VxG6OA9-t7eP1TrdDXlOIOvqQhGhRBl5ABxn7shOudAprLWZ7nSQ9nfo3d_tIb9GacyQRhvCNySFRAiBWEWIjqf_CnBNKWuRIu83tZw4z9Lj_Pj3erWj9n4RGJUz9Z8E0rMkj0ueXQ0sH9Ibkjt4d6E6pWoDucOL_OQWwndfbgV-WEHc09JP83TXN4DZZOGbtXAh8Gjtn7k3vzdq4v1N9LmcoAwEJN-4RCTOTX4XhK4IZIks2tBqYNzmERVJsfBhkN2B_lcyxhNMgxVWRQpqt33EzmF3az0hqtrdnU4gwW8iio7pPEd8ccXgy3uFiieIIj_aQn374J-DTRMfl4Ot1UuInOgII0kj9ISKaF19xeckTB7v8u1lB108cEiPrlNK5Q0R-kIeESl-CJN0Nx1abkrXc5JPqEwj2tVT_Zv2QvzEIVsRPziFKNfv7uz7TcDyTP44uLW12Fm1cSLTlddo1PwpsMVtfMGXkaHDauG-mEIZKbM77gCphwPXzgwQErPZpUMwAN1GdkUdgPGxLYhs_tvJjFaqEBZgbAMTY31imdD_vr_aXLiJq1gv8whdFowXthWq_VdfaLqlgvhB-ChN77bb8O2MXHsZwDmH2cfOZjqoJpjlAc4rV3xgjlP39927I_DoypNs7ZRjpw7sg27XeE56CPTGyJciLDHNG93e52NSrUUlg4MBYKUyDecEvmIQa7cU6odV7KH-ncs5j6ja5BbFNawXGKDC3vzWshjgXl-Ht1ZtGjWd42tjDIoCVXN-sfpODiTNypp3QEuTSr3JAV4t2m2oA1XtNegpXvEFLLvnKE9HdizGKOYwFJ8NEydbE0LV3r-TF96s2RbRq4zFj7xyalj83qzvjBoUQ5W7behl-R01PH1TOBOzh6RdG1fGjCVlP4oS0bwAC11ePQOVZmiCENZVdxAQH6OX5IPeIdUGRw-yTWnkyDrHBfpgac2r_hxfqlLd2hH2kTXYT1J4spBNLsvFizFQ57OwH3m6dAsRpfG7wC0B5jfSMUV4H_DxtzhxHQCUnJHwPL7oDszLDtE2dEyNiu2REzEz7TU_yd_tyv2iXbEMHoziB1qHNMRK1-caFFGCqWPtB0VZFd4_bZkO7mZufc7MMXXn65XnY71KcDgpGr-Qhz1ytzr7Wl7SLtf-X5JKqBc2ywCbvpGhdyhUUSwDEV2Qrgt-lTDf-mEEAt-0ysz9uQAmxwBSviyWxHQ5H5qqP-dQyotVwFbWE3vqQVc1xvpwYmExHtStqrPbinH4hju4TUuCSw9QBGBUm1SY-gKaoFaqP-uQxPc2SoXA8qSex6wtg7NAhHx-5AIak79VOhk8kXz3VGgrbJfkUP1XeBrOdU0pS4fkufjQbm5C2RmcyEnVl31SXoVZShV7VKIYOPp4lU5UGStnN7DVZ4NeLUWK6lA_HOLopul&cid=CAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE&dc_exteid=31403194633979805705691057537915250&dc_pubid=4&cbvp=2

Requested by

Host: simcast.com
URL: https://simcast.com/?d=vinpearll-resort.ph&pcid=48&rid=112&a=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

1x1.gif
imagesrv.adition.com/ Frame 215E
Redirect Chain

https://ad2.adfarm1.adition.com/banner?sid=5151015&gdpr=&gdpr_consent=&kid=6224115&bid=18905696&wpt=C&ts=[timestamp]&cbvp=2
https://imagesrv.adition.com/1x1.gif

68 B
178 B

36ms
11ms

Image
image/gif

217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/1x1.gif
Requested by: Host: simcast.com
URL: https://simcast.com/?d=vinpearll-resort.ph&pcid=48&rid=112&a=0
Protocol: H2
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 5fb3bdb7f966c852579fb6b0574517445d5b2d171c804d66227ee67b1bffca9c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 12 Dec 2023 08:43:12 GMT
last-modified: Fri, 24 Jul 2009 13:46:10 GMT
accept-ranges: bytes
etag: "3122740758"
content-length: 68
content-type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 12 Dec 2023 09:43:12 +0100
server: ADITIONSERVER v1.0
etag: 7311626018326973197
content-type: text/plain
location: https://imagesrv.adition.com/1x1.gif
access-control-allow-origin: *
p3p: policyref="https://imagesrv.adition.com/w3c/p3p-ssl.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
cache-control: no-cache
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 59CD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMhkFemaZ878Y2oQclO86p0&google_cver=1

43 B
733 B

33ms
30ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMhkFemaZ878Y2oQclO86p0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKvU5fQCEMaIsIIEGJSMhfMBMAE&v=APEucNUttECls7EyeyDA7pWibIQ_xV_-XNVDS-n2NqbWKEj5aME2D2a_5FshWH9PivcXkRk3ViltHPpwGOZMNsY2NBR8V8j86_tzgk69hGbaxLneq_ucdGlnF2VfVpgD18-krBRi0srXsDm12TrGe0AJGYwizcT7oFa9FvhfgMNatzziKH8CkH2Fcykw_Fnht0pETArIZ-q-OXe2AVkslRdLYXRPYhK3SQ
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Tk07eGnMQRS3vXhGuuK1QWG11euzXs0wjmkyyD1TNrvm3rHb18NWBLZjUqpQM73h2%2FLNqxeYyJ7Zaaut8%2FfZR4HejCa2vQkt2Ne%2FrE1rEyKCuCAoEj%2FW8sdFTpAdvea3nO2Lgk71DIJIzA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8344adaafea51cc3-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMhkFemaZ878Y2oQclO86p0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 59CD
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZXgdIDSKZ9pMrTI0RKXOdQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMhkFemaZ878Y2oQclO86p0&google_cver=1

43 B
736 B

28ms
26ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMhkFemaZ878Y2oQclO86p0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKvU5fQCEMaIsIIEGJSMhfMBMAE&v=APEucNUttECls7EyeyDA7pWibIQ_xV_-XNVDS-n2NqbWKEj5aME2D2a_5FshWH9PivcXkRk3ViltHPpwGOZMNsY2NBR8V8j86_tzgk69hGbaxLneq_ucdGlnF2VfVpgD18-krBRi0srXsDm12TrGe0AJGYwizcT7oFa9FvhfgMNatzziKH8CkH2Fcykw_Fnht0pETArIZ-q-OXe2AVkslRdLYXRPYhK3SQ
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cvaopPUwDaXT4bEf1jtl2oiVunXWy5bSaLkoIqananm6Y1YINRq%2F%2Fvp%2BH6S%2FhOkxXlLWGpGcFO0LQ%2B89lsDDuRmkWzOumgQ01MwUUiUJtkT4LPDd6MWDFa1aboe%2BHEtZXTjqq0L022LTdA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8344adab2efc1cc3-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMhkFemaZ878Y2oQclO86p0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 59CD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEC6YSYoBYMCIFyH_EvudebY&google_cver=1

43 B
836 B

7ms
3ms

Image
image/gif

37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEC6YSYoBYMCIFyH_EvudebY&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKvU5fQCEMaIsIIEGJSMhfMBMAE&v=APEucNUttECls7EyeyDA7pWibIQ_xV_-XNVDS-n2NqbWKEj5aME2D2a_5FshWH9PivcXkRk3ViltHPpwGOZMNsY2NBR8V8j86_tzgk69hGbaxLneq_ucdGlnF2VfVpgD18-krBRi0srXsDm12TrGe0AJGYwizcT7oFa9FvhfgMNatzziKH8CkH2Fcykw_Fnht0pETArIZ-q-OXe2AVkslRdLYXRPYhK3SQ

Protocol

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
an-x-request-uuid: c8b2870d-ebd7-42b0-a4c2-2debd5682e07
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 81.95.5.37; 81.95.5.37; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEC6YSYoBYMCIFyH_EvudebY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 59CD
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDIyMzA5NTMzMDY5MDU2OTM5Mg%3D%3D

170 B
232 B

18ms
18ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDIyMzA5NTMzMDY5MDU2OTM5Mg%3D%3D

Requested by

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
an-x-request-uuid: 81f41625-91cf-42f3-b543-01c41da01afa
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDIyMzA5NTMzMDY5MDU2OTM5Mg%3D%3D
x-proxy-origin: 81.95.5.37; 81.95.5.37; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 215E 0
0 53ms
52ms Image
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=Cab-yHx14Zem6MpWtjuwPt4ODwAae_qHCdI6P94f6EaOf3KWNAhABIIb3hiZglYKAgJgHyAEGqQKFLjNT9g-yPqgDAaoEmQJP0CSuGQqNkROZzlDpEfGKtaiYNk4DERin5KpZIsRdZm4UklNAE5WCJS0vg2h1OFQ1_74LPnrDDPby2E-kKMqVXDWGg_rkBwEqILWnwjrMh1UWCS5D5bghbXu84O4mQ4NvCzDCrIGcfg40OmhwaF--6EmnoDXcGiCx2CcScGfDMhCQlhul6M9yEfcJ4RmydAfDjf8eDt72c-zS5hXuRBTVyVyOOnOiczVEipeS11CQ9LEnTL7o4FNJzNPfrGnB-GGwnQM727oPOy2W9C9ysFJmBO8T1zm7RvBcDJiBU5BKq8Gp9_Jec4uIqLKvi-UMwgib9p54nWIFlqD9hCMsigZn4AfHCGdbZcVj_ymKpIPiOZdK2ZBQPnuBY8AE3dSymsUE4AQDiAXlj8jDTZIFCQgiGAFIqZSZApIFBggdEAQYAZIFBggdEAEYAZIFBggeEAEYAZAGAaAGN4AHnLGOtwSoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAfIHChCIlxUY-a73_wHSCB8IgOGAEBABGB0yAqoCOgKAQEi9_cE6WOGKmNPAiYMDmgl2aHR0cHM6Ly9hZDQuYWRmYXJtMS5hZGl0aW9uLmNvbS9yZWRpP3NpZD01MTUyNzA1JmtpZD02MjM5MDA2JmJpZD0xODkyNTAxMSZnZHByPSR7R0RQUn0mZ2Rwcl9jb25zZW50PSR7R0RQUl9DT05TRU5UXzM5fYAKA8gLAaIMECoOCgzktLEC7rWxArW4sQLiDRMIsuOY08CJgwMVlZaDBx23wQBosBPdgtkVyBPll_3jA9ATANgTCtgUAdAVAYAXAbIXHgocCAASFHB1Yi04NTg2MjY1MDExNjI0MTA3GIHUHOgXBQ&sigh=AuxhpYlISy4&uach_m=%5B%5D&ase=2&nis=5&cid=CAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE&template_id=509&vt=10&cbvp=2
Requested by: Host: simcast.com
URL: https://simcast.com/?d=vinpearll-resort.ph&pcid=48&rid=112&a=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 17B6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDQ1mHOY77_xDqGp_6yranM&google_cver=1

43 B
105 B

17ms
16ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDQ1mHOY77_xDqGp_6yranM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNXaa4EyvzzGAKA69gzob3AYewA4rbjpLvDzv1mn6FCGWrKg8a6T6lddsSawYpABF0n2eU9dsEw9TRrWXib1n0QZ_j5kdI6FcP3djhmFG-nX3iCNto_7p8i8Pd4c6v17McE69xd-lYzYiocrbJepWXbP6bigbhJdif62t02KouUVVnHaitExH9GBTez2onr-zV23p43IEzxw6cgvTD1kE7BPeRmGOQ
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDQ1mHOY77_xDqGp_6yranM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 17B6 43 B
210 B 24ms
17ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNXaa4EyvzzGAKA69gzob3AYewA4rbjpLvDzv1mn6FCGWrKg8a6T6lddsSawYpABF0n2eU9dsEw9TRrWXib1n0QZ_j5kdI6FcP3djhmFG-nX3iCNto_7p8i8Pd4c6v17McE69xd-lYzYiocrbJepWXbP6bigbhJdif62t02KouUVVnHaitExH9GBTez2onr-zV23p43IEzxw6cgvTD1kE7BPeRmGOQ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 17B6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEDGFqilRXKjBaXuYTSQ6bRQ&google_cver=1

23 B
163 B

42ms
33ms

Image
image/gif

23.218.209.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEDGFqilRXKjBaXuYTSQ6bRQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNXaa4EyvzzGAKA69gzob3AYewA4rbjpLvDzv1mn6FCGWrKg8a6T6lddsSawYpABF0n2eU9dsEw9TRrWXib1n0QZ_j5kdI6FcP3djhmFG-nX3iCNto_7p8i8Pd4c6v17McE69xd-lYzYiocrbJepWXbP6bigbhJdif62t02KouUVVnHaitExH9GBTez2onr-zV23p43IEzxw6cgvTD1kE7BPeRmGOQ
Protocol: H2
Server: 23.218.209.56 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-218-209-56.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

expires: Tue, 12 Dec 2023 08:43:12 GMT
pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEDGFqilRXKjBaXuYTSQ6bRQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 17B6 23 B
163 B 65ms
31ms Image
image/gif 23.218.209.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNXaa4EyvzzGAKA69gzob3AYewA4rbjpLvDzv1mn6FCGWrKg8a6T6lddsSawYpABF0n2eU9dsEw9TRrWXib1n0QZ_j5kdI6FcP3djhmFG-nX3iCNto_7p8i8Pd4c6v17McE69xd-lYzYiocrbJepWXbP6bigbhJdif62t02KouUVVnHaitExH9GBTez2onr-zV23p43IEzxw6cgvTD1kE7BPeRmGOQ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.218.209.56 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-218-209-56.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

expires: Tue, 12 Dec 2023 08:43:12 GMT
pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 781F 0
20 B 43ms
43ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=1203421645681&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 781F 0
20 B 47ms
47ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=1203421645681&version=m202309260101&ct=119&x=1&cor=2420888087035578400

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 781F 91 KB
38 KB 70ms
70ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Cm6d6skKuFiZaOfp3okhikJcyEPTsJ4m8KAJy7vHTXv7tgnV3FvrUuDXuMh7Ops8dGj1z1OyTqTesYmmyaKmbhgsi9tzjO3vsEMlkWGE8mF_Fnp-Wsz2X4EOr8EUBVe4jTJ6TKXwTJawEKIDcs9nZAKryyPVmrIXnvpwXsc4k6wzE8oPM&cry=1&dbm_d=AKAmf-Cnhgbk_-lgGipBrG2c_Q2E3SLquM2DyZ5YQBPZlUIqNY-HD8E5iBcEiqZ422R81QmySYms3xaNqVNt-douQDqQX5bdWKvCwKUDUIXp9DkIK95YQmq-Wy5lDkqflWIlFxDTlsTimObwYqsgRqWvyNyvu-RQkdWpofrqTPnuZHMFEi7AUlLke4kUdsDaSf5u9j8-XKDIbFDt3ssal66BpOV1NU_QNG21zQb2UldHCOY67s274OGD_cRDRLJahDqEy-76cwiLhxJ3HAbJ2pvjC7iRxKPjB5AInFA-Mf-9_Npag3VK1RyDpphdYg1ch_xqwdm0sKV3phkAy0S7bXf4Ap6W6sDA2FWFSs68p1uKjK_UoRknaS4Df-aJ4XZuln0krnB3ptnLJLpnrnMDBu2Yad6bPZbpaZdv0tRUMrjNG3kT8KngWhj_YQSvGSfg7X0dv5ZgoMqnLQM5C5YoRZt8e-EqZKFoFKewOMi_l_zUODOs8AkdZR4OGqB3FTt8n1AecRRsLHJ4v69sSz_SvHrux8d1HdwKXhZS4lsaUp_OTWaiGb4tpKobrE5L0kiHd4W0nMP0yFiZtmkIqRibLOngGKzBWHbSzculrdldOEHxb4VWzNUrwMhd7_ciJc9WDDBfuZiGQsHfJBEQBlJb-_kvW4pMfrgteBwOx8GwzbHis9bdM_w3dJB7DE5qzAFeMlFerRqPRwVKnBjCkeVExdNpPnyIoxIxRuy0G5Njp1KkXF9b9iUXKsJCDCWGQ8_szVZ3-gI-ivV26rb_0fzYCypH4qLlDGEnm48Q1QQhuUHR5TdVczunX8CBOVqnbDZ7Lx420c0GI6W9P3JozMLDf-HffGsd0jPSglBIV7nAKk24k4Z-zhLZRAlgqkrc8UCvXwk0M9gr_k_f53IMUVKJwaTP7faDXir6rhzYDwcnSDaWlqRnI-tsFASvPIC3fV0wOEbV36B1eU2nhhLSvPOSrUNEtkNmE0cnVvYbqeaLhvBLVI-5nbyBdtL-8-jEN3qiDs_RbA4RIEOnjXJI6k5gH4fVhrl61KQGgZk0uztCkLIKEhCGQAllht1HI5ZEYy05DJmPBrUhLIuGJLTISkU8X7fWsxzaR1f0JajtX9eZDqGGYM_klvnozGzl79iqzllBs9Crmk8ZUCwO7dlHbZ0Ez80uVTPiJlRKpI4QOO_VOFSGpwV6JbmVmoB6EMqmk0C5-Ew0fih6rdCaKxoRI3Kh7yTvAGFUyrCr2Ohqm2T6DqJPV1kL7f4Y5zIwOZ4m1TNwBMe7R4HOQpx4SA3PU2W8OWYSzqXYNG3sdPwPrXeAf3eNh0JkfIknGw139QlgkKW9krx54DoaB0DZxW_SVlQ6IQSqOLDT01i6tibQVnPKsCZd6Rt6dLC19ewkV1vg2ipz70y-KxhGJwIPpzzqq5ZLyp908itlcEjRW_q8UvCcnJeawvTYWPg38dlPLGD8UO__8vM58ZUNLFLBBkTxWrQhO1GB2x6ywij38IKny2UK_N4fCweY85XLiTvSmAslMWOhE6ggmVZBp4mxZvXVqQlyDGDsiNE-xsBsT8tvIhufHLBNVZv33wpt2cDJcqFDuLje8t9wtYrb4fI-Y-NjIU7usXbiaJaJE0Ss8z1vNszBEj0yzewzuxvxxXjeSGpwp33jRzVqWF8PtvGcnJRt5h4Feng0aGItMHelk2cM-RwIsHNV_br5sUvDmobaNeB1KSeJNSEZJOrjNaiCM9uRw86KN1Kvcb1Sp6sM1ZQUTw7hxl1MFpJh4V-E9hJGLfta4MGm8Xu6bw3tLHLa-bBVIAqOZbVHgjmId-MPi31ZAT2zIGrX7GsypB4AuSDnsGlp6QlMdOXVcLUrIFKEI1bhg5aBSCQPJhhS5Cgwml5YQAHVv36W0hLgP0v283qX_yCM6Xcq7Rft1G9nAJHiqsEJZY6HrKXQFHnqdTxwp6ntHhQkRBfxvGQDsXklStKTbZxnt36dE8xFMuW5mXfdCVrQ7VZUye5GtlUTMfobvwIcXMy6BYC7dy4rUPaiuakqWMdT2iADq0B_02CfrSIBPcQbK4PN_-L6AhH0LurlS2iJoxflpZvju-G3tQKPCKN5iqdQoHAca6Rn_U6nQl5Qh9Ajtr_QjR35bIF-OUEGUcFF2zneJpnwo2QhQpTaFVvWV9PPR4HmefAoE85TUv8hHeqPl20bMVBf1A1NPEYHn0g5LDeP_YC83PQFzCIMosor16_GQALRn13BPIr606pRWW82TlvTJT77PNJQjNq8aFcdKDn9MbjcRFgWxSMJ3XOtzoSeVFq_2Zb5jD_IqYOw8wfb5eecCziDrw8Yn8wLJBEcWyx_MG9O5Lkn1nmq_FB06pv_ZCADkB3VlP6kc1ynohG7dCpjHDWyxfEtUxmSgt6nwUFUG3vx2Q64xQY8TeKG6j7qhd9t8QXhPEiIEobuM3oKl83Upv0H_reAcNSe-UbR4ElCYDxRGVQI2EBpGjhf1bmO6CYp4WopvhY1ZkjNNvW7Z6ovSDgPvhIUSIGQ-RhrOCaUyrl1-jBi3pnoBBe1Rf3rDWXE8GxvDZSpy1YPV6lSa7KOpHlP-aJrTk6LsW4HVkLE3h-O4tkiWglhFK1U8wvFd5E-R0WloBfLJ75BsboVD4J7LU4xeY1hQoQBoGy7G5cc7lPwGrksqFf3Eiz1SmHuT-f_8W68hmtTjw_Lv0FyNiXvHq_By5-yx--omO9TmYFMWOjrr--4jynJFr2miIrdBs3qcZXkrj2w_PopN8N9UmNyqWsTRgZJprqZjW4-86g29p9KOgUpgcn2o4HJ_r-kGs-nr2XCLcUP4U8EQ3OJFUFj9ADSdRJWPcHrJ92VxV2OCJx5Mwn-iqI7acgu3T9oSowwQ705MYqUR3oTQpvRaOIylZ35qcBiaFtgIZ1OF-1H9x1CT2s82cOy9_ibMSP0w-8zWyvJD9HZcuZh8dzQn8HqxpkjAK1yGDuBJAoxms84jaMSjRM1Doc25TApGB2WbtiQ3nFomtXW_YH5b63s2TdJzhV7Oe4f8s8o2YPlevPI6EsO80u_IQBB6AL41l30C-DzLDHheDdrxlfXJbeMIsS5O8Q1Rf7ZFnX7u0Ky3IsuenxrGxEnffOXKOEN8wjoZ4OPlHINYLMk7pgwkebZGPRNjwNMf7qSxttq2Tk-zpkS4XY3Bf70kQkty7ctYtN-Rx0Nh_h1J7dQuvFKXLg_ZJI5t71SCnVUS4yRuw-iBhmiKF7f3YdLt_COpBnXN-ivwvrLFCMnFiIjNGRNaWaAmD711RQa2A5mshEXt_bxxowjFnZVyv2XzAm8SyFTY7oaRMSoI-JsiSSDZDzhytg6K8NSOmLVfmfNk1nu-QqmDetOvL6pKm7ixi6RQPwd0GLUcK3k4nMw3qo7alGgDnZaG0XK49f4r98wTGYF6bhg4bRIWaWKBOOO-alkOhySn3xkHDecihMNNVt6Jug6Bywrw52MT5p8Oqm5losdIXOCJRe4g6xVF-qVH097Ed3t5uHnpvAEBii50Ff0juIM6SKFFuHlAeOOKO8StfEOpQ2LzoMTHCxxgYLFE8X1YjI4VcuVD-Kg0CP3YdaM4vObAxwntySC5P6u8s63wc8_tamAcwiAourRrJXSfpJXN5BEaHv88ORv3fYMlkYTYCx-KWeST4dh9PkXlttfK1tTVO41KksNaqTtjG-xTTcfTrOkb76pQV8G0Hustl9379LcANfJEx-RahbhoNEtvoze0Yi5XdMwuLalv97d_0NO0_gT39ZCGthRN0rHFlYrMI1iJn_R1eIAmJG5pV1DQCsyYtXI_nJ49n_0sy9yblZB7YBrcKzXP9hfoxyvZLuYdYEOy52U5i-30pnhqFQr6HsMyStMyXqGX3QJXf8WyeyGP3iOtfsSQ6KvIORILuSjnOXfhx06Uc37rdsw1bR_MqLzoftu4Y08OxkyuwRCwtWurUusLYBYei_IiT_FxTKiFKm7Yc3TvehpgxGsB8_0FBitheoVVLx8-O-FJ8yYDcFvm6-SlLxI77pSV2Z0PyMQIG9LkqlhD6N_0JTJflNYHnrqX6uAjtwrSVGCfqbeK9-VsAdvPDbpD-0Wh4Zp4UBkTYCT_a1TBZeFpMyHODkqlZkrJP4L1LWUF-8iv1KnWI8h3Jw&cid=CAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=2420888087035578400&adk=1033480540&idt=61&cac=0&dtd=12

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

623b2d86cddbd85c215c3cd927cef38af0828e090b308b4da926496a6346e953

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38657
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 8951
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMhkFemaZ878Y2oQclO86p0&google_cver=1

43 B
732 B

37ms
31ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMhkFemaZ878Y2oQclO86p0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj5oLvGATAB&v=APEucNU5Jr-BVthd9AZ1vmh8WXhPc3IphJ-kfH5XcasiQC--3CbVkJWYzJC4GQcmq_n87B3drH-pSyjC0LZBhbP2x728laTieccCNDJHuLCLXiwi7yApdajhReMNfqbcrr6RtzmDEgRdVhGoAHT1LHKVRHVZfUc8WJ2UUoWQCnBY8OqliH0L0hEpklWWK1sOtJAaBG8_n18ZdM02oE7Q_2NR2-7PcuWoMQ
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EseBk2ExYRd6ORZLqL75hs6KiS2dktwRijl%2BFxy6s5VoDe8iIOAl96PybLurl6KVLOcbow8aOZYYWBp%2F2aLhZTU9wyMdVTmZUSKjzWXuG08H1lxncrVjoTykfheule%2FwKIIz64LRTtl30g%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8344adab0eba1cc3-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMhkFemaZ878Y2oQclO86p0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 8951
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZXgdIDSKZ9pMrTI0RKXOdQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMhkFemaZ878Y2oQclO86p0&google_cver=1

43 B
733 B

25ms
25ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMhkFemaZ878Y2oQclO86p0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj5oLvGATAB&v=APEucNU5Jr-BVthd9AZ1vmh8WXhPc3IphJ-kfH5XcasiQC--3CbVkJWYzJC4GQcmq_n87B3drH-pSyjC0LZBhbP2x728laTieccCNDJHuLCLXiwi7yApdajhReMNfqbcrr6RtzmDEgRdVhGoAHT1LHKVRHVZfUc8WJ2UUoWQCnBY8OqliH0L0hEpklWWK1sOtJAaBG8_n18ZdM02oE7Q_2NR2-7PcuWoMQ
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yQdKSqUuTjaW4ZbCh9swH8YmLMZqnLZR7dlq7y0PYK2fnb46dPNaRjCiW%2B9vsf4AL42PGz1Bi0FaILS3xVJ%2Fe5TnaLgdCD2byOrjrgSaDlsLm%2FVg8kbnahreiBpm40k%2BL08pK824NA5Y1w%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8344adab5f3b1cc3-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMhkFemaZ878Y2oQclO86p0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 8951
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEC6YSYoBYMCIFyH_EvudebY&google_cver=1

43 B
836 B

9ms
8ms

Image
image/gif

37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEC6YSYoBYMCIFyH_EvudebY&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj5oLvGATAB&v=APEucNU5Jr-BVthd9AZ1vmh8WXhPc3IphJ-kfH5XcasiQC--3CbVkJWYzJC4GQcmq_n87B3drH-pSyjC0LZBhbP2x728laTieccCNDJHuLCLXiwi7yApdajhReMNfqbcrr6RtzmDEgRdVhGoAHT1LHKVRHVZfUc8WJ2UUoWQCnBY8OqliH0L0hEpklWWK1sOtJAaBG8_n18ZdM02oE7Q_2NR2-7PcuWoMQ

Protocol

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
an-x-request-uuid: f972bb20-ebf6-426f-a0a1-9c4468cfd25a
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 81.95.5.37; 81.95.5.37; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEC6YSYoBYMCIFyH_EvudebY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 8951
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDIyMzA5NTMzMDY5MDU2OTM5Mg%3D%3D

170 B
232 B

24ms
17ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDIyMzA5NTMzMDY5MDU2OTM5Mg%3D%3D

Requested by

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
an-x-request-uuid: 449694fc-2796-4d82-95e2-c459c8f2f412
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDIyMzA5NTMzMDY5MDU2OTM5Mg%3D%3D
x-proxy-origin: 81.95.5.37; 81.95.5.37; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3AFE 0
20 B 42ms
42ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=2342535617085&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3AFE 0
20 B 43ms
43ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=2342535617085&version=m202309260101&ct=77&x=1&cor=10169969901019320000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 3AFE 20 KB
14 KB 79ms
78ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DnntuXARKkY4uHp51qVIv7fK49YWGwVKxg96oz3fSlhUJvaDvs86HlHYiDkSGCWbNZh4wVDe5GjTd3H_auIaVZYMzQmcX41ILLYs543tW59lO8LXSqpXMqGQb40_B-WPmZGWBQVzUUcj1MbSA5r2IwVRnkR9YZ3wdqN7RYeROpPLIakcY&cry=1&dbm_d=AKAmf-BOCAPryG7nT_tsKfHJLlN69rRI1TiRZhbDqtjTs3C-HJvk891JplJly2NkvgzNXMFfjH5rHFDSQeYfzBLdrbdDyWW5tGeWCo5QiwHMO-iQaf8pvEWx87EZdnlXq_5UzVdwS4oT26Go-6bBqAHDVQaJg2_ZO7ZDFuF5lxouKaLGKbaZxMRky-ttdQI6FBC-uxXf--re3i3xoo6YwT9Z1Y6Vb7R4_UzRjz6IGH50q85LNb-QaGZQJGEpwAz7sSX9y0ouBHVf_XV17TA6xhH5syvfapUpzc-ec8ugJlqe3xNihq2NEkeHUzTNINsVvoX_I3NcPH5z-sXtAl81ZFFkOh06AcCX_EYGGSfg-t5bCSkZyelgXnrgKxPlR9uNWABJLn15Wp1GQr2DPkUaR0Qmtwo8rU2CNBQvsk6kPCl2oLqm6igyZ47AXGVd9KPm6CQFm3xbAZ3w9x34w4LkcpaQ6D_HZJKQxCD6MwlcXUC99VmwRj_wkVk_n9-_76WHZ_AglMyrl25Q6QlTb7nInSoxo43VEzGarCEtJkHwe-7w530_g18ZKIJTFIZZBYhidvjezXV1QHzyQQcKLgT-MTEI3bwyWwwmkepAs9kBcXDggdD7EdDwHDRMmuU5I2ftOuC9LlRk1phy9L8RBvqo970L0sanUbFrCK9CHHUF1q_bWLWG09og5tg9N68VsBUyawySIyy-KE_hvH4mBP1PAtyKj-mX-NikMj5PybVULzKRmmrltqH5R6e6y2AA8EhO1edBdtfSSFF46zqBPulqWp5hnC8eIY76KLwzRixG8wJ6z60unqGG68PMNh31Ckd9bmXDa_mAfGXi-dLzbur4arldXt63E5ULfgwGS5l3bCy59tuTI735BYa4Y9x28m3OmQ3snRv9NjLgR-b_h0WJOkAgY6hDYDCdBbNYUxs_65b173qnxIgwegOSj-_VThY3cFpVWmDWAuwvc7RjCamqzh-13c_hdbLe5_ztshxDMz7gAW2N1M6ccQbWuAfay5YIyeTxAah5DsxAosW8U5ODVibe7dYLcPHWcc5-4zxG54ux6MKoB1_tvGJMOf1VQvqQojFh-krZInzJh6IM2qOWlDXkBVtfNXb1LHnd7Ma1RfneYI2k4zkS2hoY5TSKxoDAqOfBTgwsYVBTk_Qu_VYHrXGjQP9As3sxOiEI5mBPc_yRgWwR7FWCGW7HQC7zXzI5m_iHTPYbpJXJAuc3BJPXtDj2Ol7ZwaTgG-IgTK6v9NN1aD9fcdG6Caz-gPLWocIMEQKSRJe11v8WUn1djC9SBUh3ta8idHHUQRAMBa0pHCU0-r6TmUi2DBNj_DCklFtOuA8pcDHWtj2KImOlg9DqIecRNLWUZFVkjvhAPgiTOe4KvdPYdsJrkK_kYeUGdbstn8m2aIRRGfWFc-s32IMDqeI7zk9_OszWXjrkC6InQIleNMuW7xf1ibzdZIUay8w-obNPOv9n5hv3rMKy0NJCC8S_MxUIgqSCWWybzTlkauP9dMbOwmaw5lHtgs9HtKGV3KDW3WO10NMp2ijNkoFbhzhbdu5TEhjt56imov477iLLZRqE6y_YPVoZMmhgefAwYVABlb-jTN9RaRhmbaUmmLylweiHA6X4dtOEsgCEZswz9eqbFu7hA4Z9afCo7BK6MAX2PiMMXPx_QYYLkv3Qsfqm2QGWTqfABs9tiEeYrH99dNRlyW3Xipi-C8FvZNsMYWqYn2qDIlf6YxfJ8cEsSr-YF-mFGDWOJMnak2V1KEN4WPEsH2pWIQMFodqGslCacLOfr-ng0PGdl9geLR6vemT5QoPPRJGYAyTMVm22XiPgwgVh1pDmvLNLwaQrSuIWonILVVuBzy4brpZMOC24o1EnQsvaeCx2Q5cD27RC71QnzUzjB4tx_BT1W4Jle-T_NVeDcNMOEgiveHeenFydkGrXBT6wQMgiyIizfxD1IcheVXV_LC-SiTAJ7B4xy5FsUdVJW101H-oWsX4f1P3PSR55D7hxN5FsjFqBFyXpLdhPbgtF7hhxsVFThlD-u1xKnnP63xa_BAMKRKrceVqHTROuZcHVf90_psx50vADd_La50jtayd7tiDmxnqYkIgay8_zZVZ3PaDw_V_px_RxgCuFfI1oBt6lFCgXPCBvfWT4R1rVH064R4K44_D66cLoAl01L2M6-mye6DSNVbvS2bQRMtwCKCUJJPOsY6SMe3jw_9yuVrb2k1RShNJm9dSwbFQ66Ml_gCXPzWsQemgHjh-HrU28z3JBRWFoSanO5CW-zdt_swYdrvA_5DFspb6AB7eLXGg7oTVWZlGC1Ujw-HYoHQ-1Bj9lYVX6SGa3WSvmyF3DoSYM7J0keh0tRhcNTJe_Ol-PtFo2ql2sEgBnEeiz9XYSRZmDlSF6N143zd_-ElkiqKErkuXS0uazpNqjWayHZY3rZmHorruwEGYxqvFxdkbRycoq6btNvzDdNLEhSFEQaU4SENUMQcAC6YY5bqhHeLEivXe2j_op7_cjM81PezzSrF2eQcQ9gsPh63mKzVWLFSt_3jCSah_WLKcviVO1IwZb__SyK7yg6OCQBBvJzm5hC--lfRop2Mv3RA1mOE-g49r_wTxTTphC5AFq-1iQxKaL9A-4i7QCUx_WtX4PYeoql5eTGfO289H1VqDbYDiZCDloaaWusoiy8Ww5lOWIwmJnzlnxCKjKluY4MmSRljz71ciOYB9RVxVpB0KE7KVAleCLvMHhyA2H4crKeoxnJDvU2wLrtcxo3N_9HH3vTngjyWcUCzIZDWO6RrgtWAR06EkucgqHKecfiLr0sjkh0TZIRgtlx9N0SPaOF6tILFljvXW8qtkmfcTEEKgXEwObsfciCQluvmDSYXQe0LHukRbUxigK2gf943jDyjjahM3QzjdB9fLBz53HECVgcTTHAo--9Lh6XynNUM4KK5yzv6ErGCBCK7FyEpc2jLwJS9OMwOUtl0t89G09gvpaSlcYiEjk477ZgtSzvkriKDVkRKJTlODja3WKISZgRWsHOCg7NiGc2FISfGKxTK5U5B1b2Ih-iUkRjA9jnD7AKlEFG8E81Fp_J74p4bitaCPjUvHdm0nNM1YByQw5JDYHS_NGOCfuzUv0WmjG_AdPJgWX8XZTXxyUke2e9FDvTe_qjhhtosdS47VEBmSpcxZAcboIRIgQV2nCvc1MMpT2OwNrmQshVMvMU44_zxH1Vn44LxcOek1KSmW6EHlbSQoyXzeEz6WoYth1m6VkECxmLy4tdALBlOJ83kfU7xbwVmWtQ_lIfrdpA_3FzqKsjQ8Q0JaAsvsXQR2aI6bHyZtiifHVRvsymP3XqtvqfvaBHzAUdjVHlRF8nYfkUTFIGGEwZg_jyody-_OZDCRm3Qwv-kvrESQGErTjxU3uWgPOWef-XgXgUupZS8z5wLFdPqXdBEgXNuUU1RRNOzzCBGvYPALS5klm4To7DUI9gpfHnPru5nMYf4RHr2c_7_sRaE2qNN3eiD92DQMaG8gUrStzK-UYKQ_i_6cyYIV99dj7_7RG-0btB_jnGVsLyh1crYH6gIri1q5284tl3oOqajV4s1hjDh-EXUjVrF1uEjdrrwPwjwKKsPNpGBM8kOD6ZloIunxUlZBdwfyw0zmgNZw0PMaFkm3UYPVN_f5Deeg-9lJ_1dOl1Anf06xHeLzLcK1zzFJg8T35c1enDouucQxeesOEHcg8z1a-zGN9ryOgVYpgZxOYdIMTyPfjsw0JB003ETgiHVKLFRVqfkOHuNblVBDxOXkm2kAiGm8Ut0r7oEnrjNrifb1On5187ynoPQ9O2_605oTAnF4EkXKte0B4DCaohz5xA_3qvcBOeJouc3en9tmnMzmuW_IUUeMYl5mTg5OnuApaO_1ThGaa9aBSh4UVA0cuVD_qeyd0VNdPwhTVq_LikYBbDglgNNolJhnWBF9m28VrgBG_ONSWfhKBkZFIqIeaS5EItCp653ybS-4HPbRGaFehqY1b3pDRrwObZjAGcRFnwW3969XIABDUiKQuEyYTWjCqtb75PzPYC_El2k0LCOwpfjE2OYEH7p58-zzhk_D9LKs&cid=CAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=10169969901019320000&adk=3690638928&idt=66&cac=0&dtd=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

23b78b1379ec77b59966ad0a79e1d3e19dd3d10699e0ba4ad6fadcb0cf259760

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13904
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 781F 111 KB
39 KB 22ms
7ms Script
text/javascript 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: www.vinpearll-resort.ph
URL: http://www.vinpearll-resort.ph/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Origin: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 06:30:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7982
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 13 Dec 2023 06:30:10 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/ Frame 781F 11 KB
4 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Cm6d6skKuFiZaOfp3okhikJcyEPTsJ4m8KAJy7vHTXv7tgnV3FvrUuDXuMh7Ops8dGj1z1OyTqTesYmmyaKmbhgsi9tzjO3vsEMlkWGE8mF_Fnp-Wsz2X4EOr8EUBVe4jTJ6TKXwTJawEKIDcs9nZAKryyPVmrIXnvpwXsc4k6wzE8oPM&cry=1&dbm_d=AKAmf-Cnhgbk_-lgGipBrG2c_Q2E3SLquM2DyZ5YQBPZlUIqNY-HD8E5iBcEiqZ422R81QmySYms3xaNqVNt-douQDqQX5bdWKvCwKUDUIXp9DkIK95YQmq-Wy5lDkqflWIlFxDTlsTimObwYqsgRqWvyNyvu-RQkdWpofrqTPnuZHMFEi7AUlLke4kUdsDaSf5u9j8-XKDIbFDt3ssal66BpOV1NU_QNG21zQb2UldHCOY67s274OGD_cRDRLJahDqEy-76cwiLhxJ3HAbJ2pvjC7iRxKPjB5AInFA-Mf-9_Npag3VK1RyDpphdYg1ch_xqwdm0sKV3phkAy0S7bXf4Ap6W6sDA2FWFSs68p1uKjK_UoRknaS4Df-aJ4XZuln0krnB3ptnLJLpnrnMDBu2Yad6bPZbpaZdv0tRUMrjNG3kT8KngWhj_YQSvGSfg7X0dv5ZgoMqnLQM5C5YoRZt8e-EqZKFoFKewOMi_l_zUODOs8AkdZR4OGqB3FTt8n1AecRRsLHJ4v69sSz_SvHrux8d1HdwKXhZS4lsaUp_OTWaiGb4tpKobrE5L0kiHd4W0nMP0yFiZtmkIqRibLOngGKzBWHbSzculrdldOEHxb4VWzNUrwMhd7_ciJc9WDDBfuZiGQsHfJBEQBlJb-_kvW4pMfrgteBwOx8GwzbHis9bdM_w3dJB7DE5qzAFeMlFerRqPRwVKnBjCkeVExdNpPnyIoxIxRuy0G5Njp1KkXF9b9iUXKsJCDCWGQ8_szVZ3-gI-ivV26rb_0fzYCypH4qLlDGEnm48Q1QQhuUHR5TdVczunX8CBOVqnbDZ7Lx420c0GI6W9P3JozMLDf-HffGsd0jPSglBIV7nAKk24k4Z-zhLZRAlgqkrc8UCvXwk0M9gr_k_f53IMUVKJwaTP7faDXir6rhzYDwcnSDaWlqRnI-tsFASvPIC3fV0wOEbV36B1eU2nhhLSvPOSrUNEtkNmE0cnVvYbqeaLhvBLVI-5nbyBdtL-8-jEN3qiDs_RbA4RIEOnjXJI6k5gH4fVhrl61KQGgZk0uztCkLIKEhCGQAllht1HI5ZEYy05DJmPBrUhLIuGJLTISkU8X7fWsxzaR1f0JajtX9eZDqGGYM_klvnozGzl79iqzllBs9Crmk8ZUCwO7dlHbZ0Ez80uVTPiJlRKpI4QOO_VOFSGpwV6JbmVmoB6EMqmk0C5-Ew0fih6rdCaKxoRI3Kh7yTvAGFUyrCr2Ohqm2T6DqJPV1kL7f4Y5zIwOZ4m1TNwBMe7R4HOQpx4SA3PU2W8OWYSzqXYNG3sdPwPrXeAf3eNh0JkfIknGw139QlgkKW9krx54DoaB0DZxW_SVlQ6IQSqOLDT01i6tibQVnPKsCZd6Rt6dLC19ewkV1vg2ipz70y-KxhGJwIPpzzqq5ZLyp908itlcEjRW_q8UvCcnJeawvTYWPg38dlPLGD8UO__8vM58ZUNLFLBBkTxWrQhO1GB2x6ywij38IKny2UK_N4fCweY85XLiTvSmAslMWOhE6ggmVZBp4mxZvXVqQlyDGDsiNE-xsBsT8tvIhufHLBNVZv33wpt2cDJcqFDuLje8t9wtYrb4fI-Y-NjIU7usXbiaJaJE0Ss8z1vNszBEj0yzewzuxvxxXjeSGpwp33jRzVqWF8PtvGcnJRt5h4Feng0aGItMHelk2cM-RwIsHNV_br5sUvDmobaNeB1KSeJNSEZJOrjNaiCM9uRw86KN1Kvcb1Sp6sM1ZQUTw7hxl1MFpJh4V-E9hJGLfta4MGm8Xu6bw3tLHLa-bBVIAqOZbVHgjmId-MPi31ZAT2zIGrX7GsypB4AuSDnsGlp6QlMdOXVcLUrIFKEI1bhg5aBSCQPJhhS5Cgwml5YQAHVv36W0hLgP0v283qX_yCM6Xcq7Rft1G9nAJHiqsEJZY6HrKXQFHnqdTxwp6ntHhQkRBfxvGQDsXklStKTbZxnt36dE8xFMuW5mXfdCVrQ7VZUye5GtlUTMfobvwIcXMy6BYC7dy4rUPaiuakqWMdT2iADq0B_02CfrSIBPcQbK4PN_-L6AhH0LurlS2iJoxflpZvju-G3tQKPCKN5iqdQoHAca6Rn_U6nQl5Qh9Ajtr_QjR35bIF-OUEGUcFF2zneJpnwo2QhQpTaFVvWV9PPR4HmefAoE85TUv8hHeqPl20bMVBf1A1NPEYHn0g5LDeP_YC83PQFzCIMosor16_GQALRn13BPIr606pRWW82TlvTJT77PNJQjNq8aFcdKDn9MbjcRFgWxSMJ3XOtzoSeVFq_2Zb5jD_IqYOw8wfb5eecCziDrw8Yn8wLJBEcWyx_MG9O5Lkn1nmq_FB06pv_ZCADkB3VlP6kc1ynohG7dCpjHDWyxfEtUxmSgt6nwUFUG3vx2Q64xQY8TeKG6j7qhd9t8QXhPEiIEobuM3oKl83Upv0H_reAcNSe-UbR4ElCYDxRGVQI2EBpGjhf1bmO6CYp4WopvhY1ZkjNNvW7Z6ovSDgPvhIUSIGQ-RhrOCaUyrl1-jBi3pnoBBe1Rf3rDWXE8GxvDZSpy1YPV6lSa7KOpHlP-aJrTk6LsW4HVkLE3h-O4tkiWglhFK1U8wvFd5E-R0WloBfLJ75BsboVD4J7LU4xeY1hQoQBoGy7G5cc7lPwGrksqFf3Eiz1SmHuT-f_8W68hmtTjw_Lv0FyNiXvHq_By5-yx--omO9TmYFMWOjrr--4jynJFr2miIrdBs3qcZXkrj2w_PopN8N9UmNyqWsTRgZJprqZjW4-86g29p9KOgUpgcn2o4HJ_r-kGs-nr2XCLcUP4U8EQ3OJFUFj9ADSdRJWPcHrJ92VxV2OCJx5Mwn-iqI7acgu3T9oSowwQ705MYqUR3oTQpvRaOIylZ35qcBiaFtgIZ1OF-1H9x1CT2s82cOy9_ibMSP0w-8zWyvJD9HZcuZh8dzQn8HqxpkjAK1yGDuBJAoxms84jaMSjRM1Doc25TApGB2WbtiQ3nFomtXW_YH5b63s2TdJzhV7Oe4f8s8o2YPlevPI6EsO80u_IQBB6AL41l30C-DzLDHheDdrxlfXJbeMIsS5O8Q1Rf7ZFnX7u0Ky3IsuenxrGxEnffOXKOEN8wjoZ4OPlHINYLMk7pgwkebZGPRNjwNMf7qSxttq2Tk-zpkS4XY3Bf70kQkty7ctYtN-Rx0Nh_h1J7dQuvFKXLg_ZJI5t71SCnVUS4yRuw-iBhmiKF7f3YdLt_COpBnXN-ivwvrLFCMnFiIjNGRNaWaAmD711RQa2A5mshEXt_bxxowjFnZVyv2XzAm8SyFTY7oaRMSoI-JsiSSDZDzhytg6K8NSOmLVfmfNk1nu-QqmDetOvL6pKm7ixi6RQPwd0GLUcK3k4nMw3qo7alGgDnZaG0XK49f4r98wTGYF6bhg4bRIWaWKBOOO-alkOhySn3xkHDecihMNNVt6Jug6Bywrw52MT5p8Oqm5losdIXOCJRe4g6xVF-qVH097Ed3t5uHnpvAEBii50Ff0juIM6SKFFuHlAeOOKO8StfEOpQ2LzoMTHCxxgYLFE8X1YjI4VcuVD-Kg0CP3YdaM4vObAxwntySC5P6u8s63wc8_tamAcwiAourRrJXSfpJXN5BEaHv88ORv3fYMlkYTYCx-KWeST4dh9PkXlttfK1tTVO41KksNaqTtjG-xTTcfTrOkb76pQV8G0Hustl9379LcANfJEx-RahbhoNEtvoze0Yi5XdMwuLalv97d_0NO0_gT39ZCGthRN0rHFlYrMI1iJn_R1eIAmJG5pV1DQCsyYtXI_nJ49n_0sy9yblZB7YBrcKzXP9hfoxyvZLuYdYEOy52U5i-30pnhqFQr6HsMyStMyXqGX3QJXf8WyeyGP3iOtfsSQ6KvIORILuSjnOXfhx06Uc37rdsw1bR_MqLzoftu4Y08OxkyuwRCwtWurUusLYBYei_IiT_FxTKiFKm7Yc3TvehpgxGsB8_0FBitheoVVLx8-O-FJ8yYDcFvm6-SlLxI77pSV2Z0PyMQIG9LkqlhD6N_0JTJflNYHnrqX6uAjtwrSVGCfqbeK9-VsAdvPDbpD-0Wh4Zp4UBkTYCT_a1TBZeFpMyHODkqlZkrJP4L1LWUF-8iv1KnWI8h3Jw&cid=CAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=2420888087035578400&adk=1033480540&idt=61&cac=0&dtd=12

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

712bf11a3755c81fa1ce57249e7a61f6845b843b84aea09889a11478515234ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 23:43:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 32356
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 14415875674906819925
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 25 Dec 2023 23:43:56 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/ Frame 781F 31 KB
12 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f6cbe31747c16c069d861a8ed01b15186eaee8c381f74ca1712087811c39f4d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 01:43:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25162
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11943
x-xss-protection: 0
server: cafe
etag: 4141415479739543000
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Dec 2023 01:43:50 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 781F 41 KB
14 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: www.vinpearll-resort.ph
URL: http://www.vinpearll-resort.ph/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 311884
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Dec 2024 18:05:08 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 2069 1 KB
643 B 8ms
7ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 59102
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 11 Dec 2023 16:18:10 GMT
etag: 48472445140208031
expires: Tue, 12 Dec 2023 16:18:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 781F 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dd95b22aa51e953bdd77186f33c86a1cb68e53bf66c1f692a89f8bf19da2fdc1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 3AFE 41 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DnntuXARKkY4uHp51qVIv7fK49YWGwVKxg96oz3fSlhUJvaDvs86HlHYiDkSGCWbNZh4wVDe5GjTd3H_auIaVZYMzQmcX41ILLYs543tW59lO8LXSqpXMqGQb40_B-WPmZGWBQVzUUcj1MbSA5r2IwVRnkR9YZ3wdqN7RYeROpPLIakcY&cry=1&dbm_d=AKAmf-BOCAPryG7nT_tsKfHJLlN69rRI1TiRZhbDqtjTs3C-HJvk891JplJly2NkvgzNXMFfjH5rHFDSQeYfzBLdrbdDyWW5tGeWCo5QiwHMO-iQaf8pvEWx87EZdnlXq_5UzVdwS4oT26Go-6bBqAHDVQaJg2_ZO7ZDFuF5lxouKaLGKbaZxMRky-ttdQI6FBC-uxXf--re3i3xoo6YwT9Z1Y6Vb7R4_UzRjz6IGH50q85LNb-QaGZQJGEpwAz7sSX9y0ouBHVf_XV17TA6xhH5syvfapUpzc-ec8ugJlqe3xNihq2NEkeHUzTNINsVvoX_I3NcPH5z-sXtAl81ZFFkOh06AcCX_EYGGSfg-t5bCSkZyelgXnrgKxPlR9uNWABJLn15Wp1GQr2DPkUaR0Qmtwo8rU2CNBQvsk6kPCl2oLqm6igyZ47AXGVd9KPm6CQFm3xbAZ3w9x34w4LkcpaQ6D_HZJKQxCD6MwlcXUC99VmwRj_wkVk_n9-_76WHZ_AglMyrl25Q6QlTb7nInSoxo43VEzGarCEtJkHwe-7w530_g18ZKIJTFIZZBYhidvjezXV1QHzyQQcKLgT-MTEI3bwyWwwmkepAs9kBcXDggdD7EdDwHDRMmuU5I2ftOuC9LlRk1phy9L8RBvqo970L0sanUbFrCK9CHHUF1q_bWLWG09og5tg9N68VsBUyawySIyy-KE_hvH4mBP1PAtyKj-mX-NikMj5PybVULzKRmmrltqH5R6e6y2AA8EhO1edBdtfSSFF46zqBPulqWp5hnC8eIY76KLwzRixG8wJ6z60unqGG68PMNh31Ckd9bmXDa_mAfGXi-dLzbur4arldXt63E5ULfgwGS5l3bCy59tuTI735BYa4Y9x28m3OmQ3snRv9NjLgR-b_h0WJOkAgY6hDYDCdBbNYUxs_65b173qnxIgwegOSj-_VThY3cFpVWmDWAuwvc7RjCamqzh-13c_hdbLe5_ztshxDMz7gAW2N1M6ccQbWuAfay5YIyeTxAah5DsxAosW8U5ODVibe7dYLcPHWcc5-4zxG54ux6MKoB1_tvGJMOf1VQvqQojFh-krZInzJh6IM2qOWlDXkBVtfNXb1LHnd7Ma1RfneYI2k4zkS2hoY5TSKxoDAqOfBTgwsYVBTk_Qu_VYHrXGjQP9As3sxOiEI5mBPc_yRgWwR7FWCGW7HQC7zXzI5m_iHTPYbpJXJAuc3BJPXtDj2Ol7ZwaTgG-IgTK6v9NN1aD9fcdG6Caz-gPLWocIMEQKSRJe11v8WUn1djC9SBUh3ta8idHHUQRAMBa0pHCU0-r6TmUi2DBNj_DCklFtOuA8pcDHWtj2KImOlg9DqIecRNLWUZFVkjvhAPgiTOe4KvdPYdsJrkK_kYeUGdbstn8m2aIRRGfWFc-s32IMDqeI7zk9_OszWXjrkC6InQIleNMuW7xf1ibzdZIUay8w-obNPOv9n5hv3rMKy0NJCC8S_MxUIgqSCWWybzTlkauP9dMbOwmaw5lHtgs9HtKGV3KDW3WO10NMp2ijNkoFbhzhbdu5TEhjt56imov477iLLZRqE6y_YPVoZMmhgefAwYVABlb-jTN9RaRhmbaUmmLylweiHA6X4dtOEsgCEZswz9eqbFu7hA4Z9afCo7BK6MAX2PiMMXPx_QYYLkv3Qsfqm2QGWTqfABs9tiEeYrH99dNRlyW3Xipi-C8FvZNsMYWqYn2qDIlf6YxfJ8cEsSr-YF-mFGDWOJMnak2V1KEN4WPEsH2pWIQMFodqGslCacLOfr-ng0PGdl9geLR6vemT5QoPPRJGYAyTMVm22XiPgwgVh1pDmvLNLwaQrSuIWonILVVuBzy4brpZMOC24o1EnQsvaeCx2Q5cD27RC71QnzUzjB4tx_BT1W4Jle-T_NVeDcNMOEgiveHeenFydkGrXBT6wQMgiyIizfxD1IcheVXV_LC-SiTAJ7B4xy5FsUdVJW101H-oWsX4f1P3PSR55D7hxN5FsjFqBFyXpLdhPbgtF7hhxsVFThlD-u1xKnnP63xa_BAMKRKrceVqHTROuZcHVf90_psx50vADd_La50jtayd7tiDmxnqYkIgay8_zZVZ3PaDw_V_px_RxgCuFfI1oBt6lFCgXPCBvfWT4R1rVH064R4K44_D66cLoAl01L2M6-mye6DSNVbvS2bQRMtwCKCUJJPOsY6SMe3jw_9yuVrb2k1RShNJm9dSwbFQ66Ml_gCXPzWsQemgHjh-HrU28z3JBRWFoSanO5CW-zdt_swYdrvA_5DFspb6AB7eLXGg7oTVWZlGC1Ujw-HYoHQ-1Bj9lYVX6SGa3WSvmyF3DoSYM7J0keh0tRhcNTJe_Ol-PtFo2ql2sEgBnEeiz9XYSRZmDlSF6N143zd_-ElkiqKErkuXS0uazpNqjWayHZY3rZmHorruwEGYxqvFxdkbRycoq6btNvzDdNLEhSFEQaU4SENUMQcAC6YY5bqhHeLEivXe2j_op7_cjM81PezzSrF2eQcQ9gsPh63mKzVWLFSt_3jCSah_WLKcviVO1IwZb__SyK7yg6OCQBBvJzm5hC--lfRop2Mv3RA1mOE-g49r_wTxTTphC5AFq-1iQxKaL9A-4i7QCUx_WtX4PYeoql5eTGfO289H1VqDbYDiZCDloaaWusoiy8Ww5lOWIwmJnzlnxCKjKluY4MmSRljz71ciOYB9RVxVpB0KE7KVAleCLvMHhyA2H4crKeoxnJDvU2wLrtcxo3N_9HH3vTngjyWcUCzIZDWO6RrgtWAR06EkucgqHKecfiLr0sjkh0TZIRgtlx9N0SPaOF6tILFljvXW8qtkmfcTEEKgXEwObsfciCQluvmDSYXQe0LHukRbUxigK2gf943jDyjjahM3QzjdB9fLBz53HECVgcTTHAo--9Lh6XynNUM4KK5yzv6ErGCBCK7FyEpc2jLwJS9OMwOUtl0t89G09gvpaSlcYiEjk477ZgtSzvkriKDVkRKJTlODja3WKISZgRWsHOCg7NiGc2FISfGKxTK5U5B1b2Ih-iUkRjA9jnD7AKlEFG8E81Fp_J74p4bitaCPjUvHdm0nNM1YByQw5JDYHS_NGOCfuzUv0WmjG_AdPJgWX8XZTXxyUke2e9FDvTe_qjhhtosdS47VEBmSpcxZAcboIRIgQV2nCvc1MMpT2OwNrmQshVMvMU44_zxH1Vn44LxcOek1KSmW6EHlbSQoyXzeEz6WoYth1m6VkECxmLy4tdALBlOJ83kfU7xbwVmWtQ_lIfrdpA_3FzqKsjQ8Q0JaAsvsXQR2aI6bHyZtiifHVRvsymP3XqtvqfvaBHzAUdjVHlRF8nYfkUTFIGGEwZg_jyody-_OZDCRm3Qwv-kvrESQGErTjxU3uWgPOWef-XgXgUupZS8z5wLFdPqXdBEgXNuUU1RRNOzzCBGvYPALS5klm4To7DUI9gpfHnPru5nMYf4RHr2c_7_sRaE2qNN3eiD92DQMaG8gUrStzK-UYKQ_i_6cyYIV99dj7_7RG-0btB_jnGVsLyh1crYH6gIri1q5284tl3oOqajV4s1hjDh-EXUjVrF1uEjdrrwPwjwKKsPNpGBM8kOD6ZloIunxUlZBdwfyw0zmgNZw0PMaFkm3UYPVN_f5Deeg-9lJ_1dOl1Anf06xHeLzLcK1zzFJg8T35c1enDouucQxeesOEHcg8z1a-zGN9ryOgVYpgZxOYdIMTyPfjsw0JB003ETgiHVKLFRVqfkOHuNblVBDxOXkm2kAiGm8Ut0r7oEnrjNrifb1On5187ynoPQ9O2_605oTAnF4EkXKte0B4DCaohz5xA_3qvcBOeJouc3en9tmnMzmuW_IUUeMYl5mTg5OnuApaO_1ThGaa9aBSh4UVA0cuVD_qeyd0VNdPwhTVq_LikYBbDglgNNolJhnWBF9m28VrgBG_ONSWfhKBkZFIqIeaS5EItCp653ybS-4HPbRGaFehqY1b3pDRrwObZjAGcRFnwW3969XIABDUiKQuEyYTWjCqtb75PzPYC_El2k0LCOwpfjE2OYEH7p58-zzhk_D9LKs&cid=CAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=10169969901019320000&adk=3690638928&idt=66&cac=0&dtd=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 311884
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Dec 2024 18:05:08 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMjM3MDU5MjQ3NzUwOQogIHNlcnZlcl9pcDogMTI2MDY1Mjg0CiAgcHJvY2Vzc19pZDogMzcyNTQ1ODYwNgp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame 3AFE 0
866 B 83ms
46ms Image
image/png 142.250.181.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMjM3MDU5MjQ3NzUwOQogIHNlcnZlcl9pcDogMTI2MDY1Mjg0CiAgcHJvY2Vzc19pZDogMzcyNTQ1ODYwNgp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiA2MDczNDY3MDA3MzQxMjMyNjM1CmRlYnVnX2tleTogMjc2MTY3NDYwNjkwNjcxOTQyMgppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QUk9EVUNUX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9EQVRFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIjIwMjMtMTItMTIiCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0ZMT09ETElHSFRfQ09ORklHX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxMTg2ODk0MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9DT1JFX1BMQVRGT1JNX1NFUlZJQ0UKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBVEZPUk1fVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9RVUVSWV9DT1VOVFJZCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIlVTIgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QTEFDRU1FTlRfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMzMjI1OTc0MQogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQURWRVJUSVNFUl9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogODc4MjQzNjk2CiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19MSU5FX0lURU1fSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDE2NjYwMTQyMDYzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19DUkVBVElWRV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogNDE2MjEyMzIwCiAgfQp9CmFyY2hldHlwZV9pZDogMTIKYXJjaGV0eXBlX2lkOiAxMwphcmNoZXR5cGVfaWQ6IDE0CmFyY2hldHlwZV9pZDogMTUKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL3JlZGludGVsbGlnZW5jZS5uZXQiCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9hZC1zcnYubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8va2xpY2std2VsdC5kZSIKaW1wcmVzc2lvbl9ldmVudF9yZXBvcnRpbmdfd2luZG93X2RheXM6IDQKYnJvd3Nlcl9hdHRyaWJ1dGlvbl9hcGlfcmVxdWVzdF9wcm9jZXNzaW5nX2JpdHM6IDczODE5NzUwNAo

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f6.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0xb8cb997a900210840000000000000000","13":"0x8708305654ac1f4a0000000000000000","14":"0x576e292b2a001ab20000000000000000","15":"0x70fe8dae4ca9472f0000000000000000"},"debug_key":"2761674606906719422","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"21":[],"8":["11868943"]},"priority":"0","source_event_id":"6073467007341232635"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6536 0
20 B 42ms
42ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=248623719153&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6536 0
20 B 42ms
42ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=248623719153&version=m202309260101&ct=77&x=1&cor=10254026097930027000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 6536 20 KB
14 KB 59ms
59ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CgonhzAR5EzU_lV2P7tvsf0YS690YNogIfMDNxLZgAwB-vsIidspsKiCiuxzaqPzz7BdIOEcz5DPsrDKI95SIW70m5th34rMPXUICFAGCrioymEzHVBnK5qbK94GH5fuYJU2hyT6qjiDpZ-Cza8-IRsypDc-6AOGgjgdVZJ3FcGUDfXno&cry=1&dbm_d=AKAmf-DweTQTGTctvpsfMxe5cpkAnzbyjE25KbhOrxml1Ls8mIFi8GhBaTrXZZRUgxo0R1Aau841i7WtzfXT-s14gnDubZ0U-VKnPIDeIQrOceEmj4BYoSmgP2abOTBE2dOGtqd4Mbc50Mzz4nIQgm3O0iSnk0eQufJnVlzw5sED_uWq1DgSxv0pJh0xveue0vy1CanyndwpquoZRVirfjAGZy_qpe8ogTSzGYpUwBGP-NESde0Ao5r1Dko7SR0EdohGpTZKnUVriBNBR9SzQQDOYATw-cZdfZBq3exFoYc7HfpsBBy_n-0vdF5j3lDDIqG8s7Tzp7EMnY5MX2-JH-UypHa9jl5qEp0DGqdkAlCkvdk9MM1uF3WcwMbigxoRUXZjlaNBKlWF4lXgqANyWYxtIoIYk5HSw0gE5vDWmG8qXpLxBbuvsIsVOzapdP9lVCI4NyI8JGS2CFf3WXXJBJzfijisQnbbxlUA5lyHB3LkZipIW_HCnngkuCaw2LIw1onVP4SLc4kODwaN-N9vXbkw40-UTAe08nP0EFdZvL12o8YhTAHIc9sRmWRauDH1XxP5jUe_46BY27zevpaSkfRelV1DPKafIzkxjratErjLop-d87K8WKUheqH6Fkg80FMtgPaoxRtEbnnDpsEp29PzhAXYFqHgkUQSHbIOGVtzb96aXHRIA1eJdPuQ3QvUwdfWQWS5gIjLsF-y-4MVccKbT2cWXU9rREsa3XmdNXI3Q6CzIRt_4bWr0WU6IGvL8hP6H90WgiR-eRZ6J0TopsPEYdH3a3Mg0MaZGCfk4U5qmNpQ_tOtxWxW9lmATEHV2lGhQz08g4pYqAB6zCJyu27RZR52k8ZmuCw6Zhmx3hYhYwejsxLO9A4wbClyl8tnYL7W1hlCy4ZaPSy92EejctMPzUGGhmNiV1TvXKCxtwpMdgrfXCpoVbct38F2L40T3R8fKVyQD5T7a0fpsoLGfKquP0uM1cEyld8rf2kRcyelHV0Dmy0sl261MCrjOscA-diUsCunzA2HhVeGSKtiqOkUm10MvAcydaQXsgtTOyhIW-VCn6SNd06zEe7vMzgxtJH3qxwWbv1G2NlvWnrK5JyMNWHsJSOlb3XVoFcXp4mVqY9WNIeJ01z8kFbmPGYhbBRV87540QnmMfHlusnB8BzV2S7w6dyrHGM80O8dUgiZiV3li_oMgGyzsyi03FOmwIgGDSk_l1dwu02aLlF6TVcBXcIkpTdAivRqSvG5JmRb4YCsoAzb8Hhf8dmXkVkOhS1aufs6OAo9UN3BsnLg_D3zR78qzRmUSEQCcd-FzihQHCYoRo9hLi6UCtRVoN2h_QIIgqLBXAG38VOEb5CY-9z1MtUabeefCu2huHQp60ctxbHLz-WPIG5jszQshI76HpDfO-DtNcOEl8P2QPJ-ozpQAIOacRFeKC09FfZcOr6eF2jjtqZpfhBmBLE9288WM1Z7tDdRmmgIr2O48hkL15r1bSAzinoND8-27_R_JaZ04vnNGMX_QfwzuiYzXKXJrtekH4gW1NwpsUWsHzSZBoUVsEyZ3Cyv3uCIjlcwVDBXc1DuLLEcael4v5NTEh4A4sKfVuDV5OkR6JC7GIUy_Rnpr9XMhXPWx1M-IiRvJBgUTuX-YbcXG08jkp1NqlW_d-5bjBMnTdBxWEke6gDHShyoU50_pMlEUI4t6aBpZxMW2Cu1bvmivK3ggiliPIRA1ROTjnIKfJROYJoNcqNdXofDnbk6Fn9aqqrrUtVc6dUfQ83fcoXy364AzxZB_YPYS0dtt_Qn2pV7eszrjWSOXhxhp-V1qfIrHaet4DEg2QKj9EYFfnjcWlIPsfcteLhmmFDZ6ExKlUx3j7pOebvR0DjTDY52y7YDYczBZXL-afWDibb_MViNvakETJ7YtmloSDlpulnB_nWvIQ6g8BbN7jLnZTxfNx0XugrJqEwP5j_EB5H0GOad3W20M2GfOU1EO8bTH4JJThRRRrzIeM0UnBvkJ-Wn6ZRKKJSC79aMjf1rTA9xHbOWjyo4mEEAMbCi2wAr5vF1fKVhk2VrY1irarNuGDIcYM61fPnwBbbRomO2xUdFjT5HHgUXua2Bv2TkVvYUUHoIU0yiSDq0JGjajbJTQEECHOj5I6QbFP7pOcNkhfZ8qbuLMk86CUNPiMuXtpz8u5bH5w8q2XkDGufSKrRmpGUpLbGM382TpX7SfG-dNnHxTMRyzlZYv_fkXU4p2PQ7rts4cqYjIo2dYyne593_SSog4xQ3rmN3HabYjhaL41hrhdwRR1Hg3jlaoEv9a7-3SLa29cNZK3XCiXR2_eMJq8AfhT0UZ3lDzK35kfs7BtMKP0psqkE895YKIj9125FxzeW0h109Xf1N-mZUN5AWvz1mf21w9LoqveGgIUUfZNn7J6vNzkbh3D7VZufFD8cV98DkrGhmYIQyHjPx2aPswK1__PXtpMw3lIUEOBqDnOTGgLskMLb6Sbn_gUoZ21afoANDpLSQf5ZVj288gLdajQiuhWFdcui71gZ1bJQgJGZkOBUSUqORCdBOdWJFNoaslqwwQ89GOtX5TR1o8Iu4ek9RMPblEov6V16w-CCacyfiBf4dEJdwNPuQ4maagODfmpOwX9OMDT-7-KQ1ZvCRZ0TP1oWn1kMFGw6B_SDXBBY7ZPlPnc3JFLe-laMtW5aUH9szj9FttTn7datKLV3y-nmIp6RDBSFJy9zZIvPAai-K1gHtsqcdeL1KVqhFb1CkE7wanOTyuC5dYTsI2KoYGfsaqMeDudclwjClaoIu7TaoLifWVgDJhcFGJdQgVknPDYjFe0qwJtkbUZTADSSEkRDoTdMf3kMDJz8R5aui_vKZSfvrysaAXCU6ayocrKjlwyxcaNd2_4jubC1Wesw22nS33iEwyLvQf0GlLoeCUwQLR23nc9NCmtUF27ETyNotBryoOCaMZkLREn_PMy09nwDcc1Yi0YGzLYOEi21lJKpyCPSiXIbEv7QO4CtcboA9PBnmNq15mu1Ri-R8OacKXxIJC219DU1AFljFj1GI6HV5Oxki8wOA3JWPqf5vkF2dhdvL9lp0wzbXN47-sbtJ4T-9YUSKQvWoc4ogBJdCfuH2NP0mVmODN508wuzTEOOTcOGSs2gD03su14zCdNicgW8pMReYm_uf3_FbvWDaKX5S3Qmmf4kj0jiBOjtF_l6tC-cCa8P7RnJo4qIpliMjW2xya5nBaDAaR1kQfa0IsQT-NAAFjp15ZUu54LKuY5VNAfzEwmrxJ0M4kpKlF8yGPMVsZ2r-Dl6Gaaudp7oH5_GPGt6X5QgV21w9cvruMxfm7KqVaCYd4YRH7o7Mf_Md8pHPQQbi2X4c0a78KrUxMk5lcn2gPIkcbUDy9n5vpKpXrmGYSZbSb5IpLY92x08aNxTupyMywEjBnyyp6kNq5Q8CJZYwRZtvINKpofHOitwncBx1yq8hEyxxx4xDxiptnxKwoKCozqk-K1M2Q5kGCdR24AnTGI-9qNB3CSNKlucFJSPLb4HWRWum2N6gQbPeSheJqIQKwcEDxpMS8RXF_AzO2627jcV16x1AzeJsivVrgB1j0PYmpqaZsAAbfTSHVEgl9tTKtyvLtmYCLWJRMLOKGu5sOOfPzTCdYVRBs_kUsVvtfx6h8b-bjKvu_EXckSa_3vhOzfZEsdMs1V3McH1pOWlQ3ukRTGix0K9BYxXNAsNlFYtydW8jUKugROhFaeDoHTUD_IrHhsJVjgiy59cVcKuzTXig5c1FxqDSDToPFjftMVfAOB9WmkQMyt68152sj5dqoklt8t4qTfAQnCMBzz6902EybNslcoDqXrSy2byEOQiFpQXeAE2_pzu15fuwk5IpNekB2H6HBKax1vrnyNXhJPjTNgyHE_dwJki8wJOYRd89Rq6-xDUNTWgve2l3OzdA7FC5vtqHYLKy5a3Ulj1FywPGrKXP3dd1I7sgQbjstGGJfLmP3At_fLOuYNBoGiSsM3lrwfRmkC8KkJ2gT5ppwbLOD-qrDmMzC3rr-d_t6BijoURqaaCrnYgfIgLxWpTI9g&cid=CAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=10254026097930027000&adk=4188270524&idt=175&cac=0&dtd=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

388b59238612b3777d56d8d224604f434384c2f88d6dad72034b40088dc5aca4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13820
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C329 0
20 B 43ms
43ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=8310565416545&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C329 0
20 B 42ms
42ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=8310565416545&version=m202309260101&ct=77&x=1&cor=826161166376599700

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame C329 20 KB
14 KB 86ms
86ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AaxvbLF_aP0xOIMHPMh2QL2hsD1KYNzPfbQYHNaFOpMrz7s2Fy9Mz46KvsHipvJ9nA5TrFGg3JpIZAyur7x34X6muXKhryPy0b49vCLOt2uFrkvVwHQ18L8IRBzBkYGyyiTYWcxEubatJKHWlhbxnZJ5H1GYnl7ueNAONZZ9jEIc2QWnk&cry=1&dbm_d=AKAmf-CtK5Mv1AiDWKs-zgwG5loUDx2qepi5P43nXcsEHz5ylppVwZQHYSNbE7-h_nCvXLg8-V_GfwVptQjtYicYpJkellIyil4QqIdI6s0mljOiof_DA2tBKgIV9r0iJNZLOkJrFpBMY971l17XY2JVA8ukuN2D-hOt5mRbwPlinsWYvotYfkCOfuzurHhlUszDqTJCDXKx0bwjvYU67-ne5KCpAL8DlAQognp622aCS7PdYaNL7MSJl6c7TSf3SN1hWWXlbj6jRDNtbyZemgHjBoJ8Fmi4n-1rkG5prvlX9br3CXTWCb3324Z9hDhQ0mrsgWWgEcq6Y4F3CN38fOFnFuX5LqGmjF8Y33FbhAWo70_zUB9_MUtGYHBVLkuJ8qTEWZjbtOBsk4W0h3hD5kXGRQbIWfukxTmcCdOSbn9f3xzXLAIrwV1_1KJplT7Sukuh2oF--Y0qz6vT2sK18BBCz09RcqhWJqOLjieKrX8ejzOdaspOwI83qO58VkWfGk-iI_FSu2sJ_jJnuN0ikUsWE6nvHW_-rboDVzZQB-Os3a4xGt2lvs6PJFsflObxj0uX2bzeVKEMqlO8icJGUsM19oMLsO-LuJm-9gGZrk0B_3seXQinioTfR6pj4zPknHit4XC-AUU53X_9cccwG-V0NPBGyfXfxl3OiFUlpq1Ny-q7f5aIEPCs8YRRuiuljsq5uEdnofEopALR74iRa7nJ-tQsCdklIeT4Cd9H0idc4qooE4ID2rHZcoPCMlYbfijf6o526cklByjuWSLPIzkfulSqXyKGQ_4G-r9XgfgfnFvsjL6hIRH-A-RzBMLoBI2Qd2F0Mg3ntUQjaefn9gnuH7ajWbbagslDD4sX8iMib39JZ-ASvBtMpskIwqmlwRNb3fCQrQRSj9Mj-CctORbXcnWW4D-r_H4IPIXTzlk6eyJTAnZ4jh0PrJa5ThljfYaGXMSfQccipa-SuxpGw7saqj3c3PUCFpZuRiPeNjQGNGBq2vE21qb7npy_NFh02tJH1rpOMVYKlVKR9ID3mqjwBVASS3undkHRTr07_fFW8WmzejU15aCIr1uPz3IHOfPW5N33XE7dL1ZOFt9Mnt5O03Fto9Xgn7UALhcm9JpGQLVnj1BI7YXa0HQyzczJ_y_XlHrqXm7js9fnJvCDT4tQTfNzcvY9O58Ve23YPut1-lLlT07gLZ8VBrsGrxQ9H4YXnnQvngiAnkoXRJyx6sPedyUkI1sD6ovCXu1BMUxneEm-R4iZ725vw11HzGUdUcGkLUPqDe_iLXxnZCPmA2rbOL453EsS1zb8CYRN3mY78CcfJy0E9WHNcMNcDjp69cC7T05cCcD4UgpfRZoW9wJxgVlU4EpGE0NwvpL3BQ8eXqrtyGOdE5oD1zLm97g5YfC83XKph6TtqLKVQ3tB1OE3KPeSPO-P7tZanOSlI-Ka3HfdzmdjeqxfHnrfm81tXFjxuEVN2PRDe5qYd-X16fy3LKdRCXsmoa0mmJ3Mwh3jZwVpfsgki3IeK2cwE-FM5nIqB3g3M1MBG_vE84liCAzPZzE4gsh-Rrl36UwpzahDLIennVuRg42vvGs45ETzE1mtxp8usmDzTqL-J-_4C7IOzinKXQtOsaNNwyyucCpsMR3kR_RnLG1qUczvAQ8SipT2ljw9S0VLvqCHY3KOe1nwHb2WulQ0d6b2OUzfxd_B0liJAbToj6OYVF_0FkE0HuYe0Jr46FolErM-WbzJEQ5MjxuMo8RrVcLmfVudXJMbT5hXjHwSBrGdS327i_rG9LJwQHzjPUZ7_rLmu5wPKYupXRhbyfWP2rGtj-rbUyNwiEMEzJCEFu-hwF7_bv5rI68UjkBNfU_cK8s_bOcz5qss3KMGkw7hO45L2UJGYBeVN2m4z9JX1ITCJc52oQ84Sr89oRlsjAxrHeFcwYeWjq1-TBr5N13MOSox3KDWw50ZZZkoPxtApNs0cg95UPgAqfkjeRFshyHIDucMayr6xNp2iEjRBRRtIae9W4ocvf78aP2emhsoGurjN-GnZ1QZLsWWxQFobpkrgYwRBEcJIGZlkgZ_l2AbrnU7ROX7EiXeRQ-ekFg3baWmbVigEs-UQab6rlx9VFOgq3MZfLx2jUxxIyr6_3WgsPHM_gU6jT_AFExlxIFhXZXfNcKtaIYva4tuN-BRk_89E47Lg_F4H3Vsp2iFGpgEPfVVJ_Hi_gyHX8-V5PGrPJuwJwVgLjlK6NqnftgsYcQUfMcYN3kaIrB4GlMsRANgRgFtCq21VCwzRbJoZQxCihV-FjW6ATXKiQ4ymB5WBYTsOK5hrerlPVJIRVHqR6BPa07uw46Kpba2Irbnm54tyR939RiDOETSWoGoawO7wwPB4iUfBBRxAELE0ODBO87mTyQD9ItO8vyiLuiUf6o1QjPsQ2HC_vNNV36JCJ9UYGskOkPz-qX-MKuCJ7a0q5eOKlq0o8JueekpcvFyzOx-E93kX8lb8bsuOzbTdcFuccyeAQmvv2naRI0SrzV8TArUuHT7Z0TKL0l-GCQfCIcIuaWnDgR2Z5a8G_XfNHZHcx1aZ5ODySJlox2xvE7--L8BDlC8ch_xiNb-V-qFMuGr8FWYA5Psme2HcKpUx0i_EvfQu6BDLqWgDrJqQ8k3vapcHqAaScQRbfukC5KljYz5EZwiU4tuc2gpd9G75AXhx_lmMmcKZdP_AJgRFrRoScEcQGpbMtX_7nkGKgtOkzHThgyvBHa8ckI6jCo-SJn8Ud7u3yqamQS--tX5Hec0U7RU6uhXX1JjkOvTkQHPPZwNCNWqEFy19WmAKbHm0AMcCwUdRYgFgSomoxaq46O4VI3ms8mMAQAfk_GSDRK3bh4mDs7pS2idIqvkZ1MLRxOu3Xr3vFSYobOGQPYFrq0dfeFJn6gAdR2GIdLqQgYvjLdW5xd8guWf_LqsWWJQcKZ7USYkji1oTMRiwGSbwXN80ppqmjfeB53_fPS9PvAJ3ozUHr2ntgk6NUs2fVZmPoR2zUMOXXt9L6mupwjfU3Wynq5-LmOLjI_P68aFCSrqfMovKcwP9BsoWbFmBbU5XqQg2CgI_VKbzh2GXU-sGPCbwuzexPgzmyUNYpjMQ8CPZLycIvXeqn6XgiuOies1FlZ_NHp3uueEoHy6GEXR1hCr2yjh2rSuXu1NN1vBiRQB5Lf1j3xuzwKyDnBDa2sLLEY14euYKWjIy6d4mUy2vB3EZGLd6ZdqpLsjQneiZG2Bd2aM9kkI7xGLNTg_x9dpk-Ogb23dk7o_XpPuplHoCBtevr1sLrt2G4vpGKSnW3JG75CfOj2WLYGvVa0WBOR7aL58PkMHHiKXV6SZF9AyHZCwm-KBQcYiu7APD6sQTVkl5YJAOJ8kul301hDe3p5y0eSc0RRZuIobWorzt3E8yR7X1_VF7G1tLLLTeP7iaa8rQbh4mzcMCd6N1Sw5SVynpmcGK2O9Vk5cp-h3V0prfQAtdXYOhrZhwZPl4L4Lo7lT79vksvE6xkqMkDX-RCQQWT0k5WzS8maLBBdztm7iyX7o_97JG-LY0ftyawQ-te3PentE5Sm46S7GEKoL9Q4j-oilZTnn8f5J_fcMo_uqQGhHng6MJk3dYty9cGB8LfhKEdxslqf3bea6FLoOIfkoT-XhrjwXM2rtsCJdNiuO4HOU-ya8E0Bnjpr3Phok464yAftwqhTox4gWcec-CA4Z5Er9aG-loURdS3rTR-gZM1RIRy7aBhmxN6cKKkn0kd4B-mak7mwovovXg0wWadKF6t0DxIzrVdyN0bpT8VAIFt9WwkVBErJU1uVJJeDJ658260ouD_QDsNGjzhKmNsoawBzvWzHdJ-1j9CJWLJw3US3KBtjr9VC1YfhaYY7SHbw_1PyCDyD9yrBpl-tqRGj733Svpa9Nt6HTOh8ZU2R6Cv29wUVS2BG7zQjh7zO7s75VsXAMec3kv-eMPHvh7-RHXF4wjpNcaZzLM6hULsPCYI1JOeO3J1N_b_TnnPapAsniLTE93OqgZ3UIHAtWOXp2_bWJnPein8py65jwaoC8MN5OswlT8A&cid=CAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=826161166376599700&adk=3037181501&idt=174&cac=0&dtd=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

696bbdfd4d1c98c1dc671945fa4f2be72dc949a2ca19d038ffa430917eecc38c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13940
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK wmoiqux43uzw Show response
hal9000.redintelligence.net/zone/ Frame 3AFE 12 KB
4 KB 30ms
8ms Script
text/html 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/wmoiqux43uzw?subid=&gdpr=&gdpr_consent=&rnd=1702370591826730&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCqgElHx14Zeq6MpWtjuwPt4ODwAam5b2gab2TnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAoUuM1P2D7I-qAMByAObBKoEogJP0Brl8u6yICIfWFz3vUgpiFGox7tXFGxqiHw6WSSMQ6pmhvX4GCGtxUhiDoK2eVA9lcVywFhGxmPlvTOnJrCEJciCRV7FXeAu4rEUmWInFi10sdmz_lJKg79MvZKEKtvVgx8Wq5xrOVy42C8Lo_fNsKKAC22eoJXi9Up1o7Td5_RqMSWiGMFgC2ESUH2ibVHPe4WlKqhqYkKU6XBvk6Mp391cS1tCBWNnpyp3RNhJmWDZ1ffMMNwM1FpY2fKd9W5ULjJh3U17Jd0RwhOm-i81oMQ_6bWSblUOgu_NanXgOQeKK4vAtsQWqq1l_9L6agu-DAWLVlEtd6umdOlfxgOG6CqIDArztuTRipExkQLazNfzHNEpM0Q4OFRmUVqIuj5vY8AE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggfCIDhgBAQARgdMgKqAjoCgEBIvf3BOljhipjTwImDA4AKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwiz45jTwImDAxWVloMHHbfBAGiwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE%26sig%3DAOD64_3VzKQJgiyuASd1ZnrUoUc6o3X6Pw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-CIVeR__uaBsS_3d-QW4988WBBL4H2Q_zpCkHp8s4ayl_emoH3jg-Ri4YfiDZmDm60hVTTyl1xQ2-xcFwHSK45OCtp3R16TbsERC1M2RzMQ6by7bm8Fh0xFgXb_ITmKLfRutkTIg_wOxVZMXItdCH3LUZQtwSOIxIu95tZ99SWxh5-OUv4%26cry%3D1%26dbm_d%3DAKAmf-AclAIkfwEWckXOw0z5ZxByty_5Np6rFAUW8dIn9ZUA3VyNkEHRMHWnG3v_JogA2szYuZ9LuUe1d2jnsT8GntsCKvoan6N-5iXBV3PDSipU0nNN6gp3QorAoly4NwqygO1VQRPLBEFy_lLQv8lL9_x9yxKIq4-g_fK6H1o1mEfAfDX5pJe-PYDgH17cQ7UhQA71rOGUIVtON8V9CXCDW9gpHknM2u0FUAE6R8iEcB8CoHUTVP86hJrwAe2I_id1BIkoWB4NWpX6FQd0M1wp44mjdfMP7zrEKB_LifT212yjTyps8p76Rwf64MlPWdTCNwhikBMWIJJAL-_6-AZWgVM0QPrb8AaCBkBV-xvpNucUox8hk_2pte7hP-xkav0jq8TZ24dHLAmqnOaqJ7e2t05xta4e-2Hw1_BFK4XNyHgtfGogakKbUT3KE8dr0zzy58c579PZzgfZ5X6OL_4XyVtHHVRXCYGOpy2GZerhawbuAVEuy10QqDbKZBV37n2A2IqsZygUdVlojiouwgDg7sSfzygPCK18I5bAeKXNmvpUEPqqmKP7XXBIsq3eXWs-uUNMkMY4rw2CjIJC8u9B5ZaSMKrgww%26adurl%3D
Requested by: Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 912df6a18b73fa0faeddb470a37dea0098dd42f0d1d9f954cf680005d3e99b0a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Tue, 12 Dec 2023 08:43:12 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4264
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 91CA 38 KB
13 KB 7ms
7ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 78672
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 11 Dec 2023 10:52:00 GMT
expires: Tue, 10 Dec 2024 10:52:00 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 2069 0
104 B 127ms
68ms Image
text/plain 2a02:fa8:8806:20::2010
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEERxFhwH2dx-a97-MuxlwW8&google_cver=1&google_push=AXcoOmT2XNnIUFkD17eafWKdS4GkwuBF8NJAAdAhToeK6-Met-_5zczdEQYyu7qmFL4Iwvj8dT98wdc8zgrtFUEOD8xDMkq4eGXzIQ
Requested by: Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:20::2010 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2 200 dds
rtb.openx.net/sync/ Frame 2069 43 B
236 B 71ms
16ms Image
image/gif 35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEJKXz7o7UMHOyBpCmpj4A2U&google_cver=1&google_push=AXcoOmQOpGvnWPqhOB8EMh8UreasixDBseHWEinBolfWIQ1Kq5h3SUiMoWTRtyGC3oM14kadH4NkhAdoHkF-KxQRjFKKLeweC2XF
Requested by: Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43

GET
H2 200 UCookieSetPug
image6.pubmatic.com/AdServer/ Frame 2069 0
166 B 51ms
12ms Image
text/html 198.47.127.19
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEN2M7_Z37pmvazPyS7_UtzA&google_cver=1&google_push=AXcoOmScwkV-2r3lIcXsDXDhbwbgvEE5wPwhnwf4nyr_GjI8H1vbmVBkU0bqac49KmKslJ2IJM5-MPpUZVGTOr0JKJac10XbkFh6jw
Requested by: Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.47.127.19 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Tue, 12 Dec 2023 08:43:11 GMT
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2069
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEGXXUVARHK1f7gYxZl4gPCA&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEGXXUVARHK1f7gYxZl4gPCA&google_hm=ZXgdIApTNrzIXldbGaOYSgAAFCoAAAIB&google_nid=index&google_push=AXcoOmTZ3JMOQQnLHl8sKOJnhw7OqO-HfizlR...

170 B
188 B

18ms
18ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEGXXUVARHK1f7gYxZl4gPCA&google_hm=ZXgdIApTNrzIXldbGaOYSgAAFCoAAAIB&google_nid=index&google_push=AXcoOmTZ3JMOQQnLHl8sKOJnhw7OqO-HfizlRy6hBftZ1rEtdWRQtNg_PcEeNVTvJ1tynoQAXjKZ8Nw16zB0S-T81KSbuSouQIZtcA

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wlX6lSnpYzQjzj%2FNitk3n4%2BfncPf0LpSTt2NR6qU69h9OL9rcZIUqTnY7lC8S%2BO0%2FBw0%2FO%2FFV1%2F3QEAMEczLYHNDssazbcJXrvDNPsS6YUwIh3a3AZrFT2gPt826MsXZWrEMMpcnU5t86w%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEGXXUVARHK1f7gYxZl4gPCA&google_hm=ZXgdIApTNrzIXldbGaOYSgAAFCoAAAIB&google_nid=index&google_push=AXcoOmTZ3JMOQQnLHl8sKOJnhw7OqO-HfizlRy6hBftZ1rEtdWRQtNg_PcEeNVTvJ1tynoQAXjKZ8Nw16zB0S-T81KSbuSouQIZtcA
cache-control: no-cache
cf-ray: 8344adabaee44d7f-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2069
Redirect Chain

https://tg.socdm.com/rtb/sync_before?proto=google_ebda&google_gid=CAESEAg1gpxW_6ZzftQEMrKkz1c&google_cver=1&google_push=AXcoOmQYgM99XZ6Ek2YsNZpXHlxXfhjKAPjFqS9rlTgKCXWbfDn5X4qoZdA3fULRWmWLuhp38GTZ_...
https://cm.g.doubleclick.net/pixel?google_nid=ad_generation_eb&google_push=AXcoOmQYgM99XZ6Ek2YsNZpXHlxXfhjKAPjFqS9rlTgKCXWbfDn5X4qoZdA3fULRWmWLuhp38GTZ_LyfxdRhohGTluzFMpwsu1BW&google_hm=WlhnZEljQ28...

170 B
188 B

18ms
17ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ad_generation_eb&google_push=AXcoOmQYgM99XZ6Ek2YsNZpXHlxXfhjKAPjFqS9rlTgKCXWbfDn5X4qoZdA3fULRWmWLuhp38GTZ_LyfxdRhohGTluzFMpwsu1BW&google_hm=WlhnZEljQ284WUFBQURNVm83MEFBQUFB

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

X-SO-Cluster-ID: 0
Date: Tue, 12 Dec 2023 08:43:13 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/rtb\/sync_before?google_cver=1&google_gid=CAESEAg1gpxW_6ZzftQEMrKkz1c&google_push=AXcoOmQYgM99XZ6Ek2YsNZpXHlxXfhjKAPjFqS9rlTgKCXWbfDn5X4qoZdA3fULRWmWLuhp38GTZ_LyfxdRhohGTluzFMpwsu1BW&proto=google_ebda","cluster_id":0,"gdpr":true,"ipv4":"0.0.0.0","key":"ZXgdIcCo8YAAADMVo70AAAAA","privacy_sensitive":true,"uid":"","upstream_id":"a-ad40230"}
X-SO-Key: ZXgdIcCo8YAAADMVo70AAAAA
Server: nginx
X-SO-Upstream-ID: a-ad40230
P3P: CP="See also http://www.scaleout.jp/privacy/"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ad_generation_eb&google_push=AXcoOmQYgM99XZ6Ek2YsNZpXHlxXfhjKAPjFqS9rlTgKCXWbfDn5X4qoZdA3fULRWmWLuhp38GTZ_LyfxdRhohGTluzFMpwsu1BW&google_hm=WlhnZEljQ284WUFBQURNVm83MEFBQUFB
Cache-Control: private
X-SO-HostName: a-ad40230.dc2p.scaleout.jp
Connection: keep-alive
X-SO-Ads-Time: 4
Content-Length: 0
X-SO-LB-Hostname: m-tgng28.dc4p.scaleout.jp
X-SO-IP: 81.95.5.37

GET
H2

200

report
sync.teads.tv/um/ Frame 2069
Redirect Chain

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEE6EDXoimmjm...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=AXcoOmTdGfYpxeMFDZAH3EMkzkhwrn1o_0gNq6mzjEWiBKRkFZpr0JMr3HoE0iEXZH3TfF8IkU-d1jd6PMIs8A0SW8EOeg-oZgQJYto
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
163 B

34ms
34ms

Image
image/gif

23.218.209.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Protocol: H2
Server: 23.218.209.56 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-218-209-56.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

expires: Tue, 12 Dec 2023 08:43:12 GMT
pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25
x.bidswitch.net/check_uuid/ Frame 2069 43 B
146 B 243ms
8ms Image
image/gif 3.73.141.43
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25?google_gid=CAESEDIw9jMmpTXJFuwtGR3jF00&google_cver=1&google_push=AXcoOmTzuz0XyRPyPBdWlVrbu1G2pWLDvkx1cLFrIt0JuyP4nc-b2tEBZp6DGMVeyUxnqZtrQLD99MubctKvoejFxKvLDGRod8jFbA
Requested by: Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.73.141.43 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-73-141-43.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:12 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 2069 0
12 B 14ms
14ms Image
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LfPUFgS9va0tVkv2QEEFv4Qiq4RdTEn7NqQEyNkSu-qDaZ4guzKvpHOwxbz1k_zq7waGed-4g

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a104-102-45-165.deploy.static.akamaitechnologies.com

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:12 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 781F 0
0 83ms
54ms Fetch
image/gif 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuAKhSUseyij2ToKgLffPpxIO88Z-S4Y1jivm65hQNKf7v1jpCdJzMpVJqUwrIKfkt_U6siIItlf3KSvYZqRP_6EYGgu7y8q0zwyBKx8IOORMqJE_SRbVWvWsWJLF-xkeptRVGyA9dUBhrn_pKLOKY2X2PXKBFYwgwJSRyJFMh7XPXf-r9SGk6UtzxVLOpb8NL_0b-6sOOjdF6RkArFzbkegPShxVdfMS64qoWZWRJZzV2cEw_yH36Oh7WgEr9HSoJztoFjlkQxrN5wu8mfHVoTM14fixWRBu5WDttQ-XCLP_eT6vRdrWtW7sc66pHVPJyVQB0g-PHVY3iO0rk_xIP1u3WUV_C1A3sqDszdj6Vmcbbdcwx_WnmwF-Ubb8oahHRehjCRsLzu22e1oy8qM63DKqfLyrx1RRln8-zrJDYBMnmI1XeoJ8muI_CaDaf3SmTyxQBt1ZzSkgbxlPOpJsranTRniHUczBIl5s6gdEC0EOn8bQm6W6SGkRicNdTHOTeVbZMZWxv772gTfc7ULr9hel9GeQVlIhvzEh_5aIf0Iod1lcSQJMJREO9j3hKTqWYfP_sm4YhVGi5W4BDgdxiEwyGgBSQryY_VN53yJZ1rgFBSaB5ZFcUfGMGwk_x0CMENxhQHuY3G9c2YllU029wvfz9fcYS3xB1prfWpOKfyF_h1kIxdGuYN9WBk5JN0xr4-NDsE-20hyyYid9NtPACeqMJDhcXo-f-lnOLaTzTG2Hhfajv-lP9M5-a7XC5IyzB1fqlRBuxb54exszgeFLdw4r0Oyr78eOjys9x5W60EOq1-Z_FxY1qBEcLMY67dsZ4cRL2P0SaaZOeoHSoLPfjV0FvbxqFAAVphIvEQiWMDpG6637bbBLHerKhDGymJLUq4M-1Qjflkd00TQxeIw0jOVXPhUPopVSx7_KFHVEAzJWNsBluGbT3oj_wWIEyELwI2RrD2zkFlzhTHEUP2mME73abVpg7sNj46es_1goSBuVtEK8-bWapXaL8yoF_HJ7WR_2e44-yLqUxGp-cWfY6KIXca41OX3xRHXJC0JJ-5PMkA_iPUbJBmxsMdA--Hkj11tH5IHXrmOZtbuqZ8MK6b5ymoWgb3kTDS-F6nZvyZ6KKzmHTrQ1uxVva5iOUAVBcJu-JBDrnG0oH2IOf-OR0yM8cCFWyvCAE-4CsKVRnhzjwol5KWRXWQIFcX1OGD9UdLKnnjgcruJ8WReTtWNXlYSE2kx4tAEuOkDyDuTPtHz0nNnd8NHNlUvY76QSV4dQNkG7BXnj5oP7lTNGMU40RIdrG35rWC1hlfHofAaKoXCt_UjOB0XZ4dNCqajjkPzajksOT98YBRAY8LnzeagP-b2gLTg5p-jcUVe3pFsqgWrLKGb-VRHYZsJKIJaQ4wjs8SuC8aYHpsbVn1tDKowNapnMMIfCp5zQ&sai=AMfl-YSNVI32b6btmtddK_EEGsgQttU6GsPlE5zNbu7n7ybkkzzeZ2e0OBvRJnLR-JCb0RsHbYhhXkeTinNb0tNPF-_5STw9OJDczc8oHZAMHLVJCXLhcOU6AK9SltehYZz9jEko2UAhIdNcv_WvEvhxjctBJKyTr5e7WJe36-XPnOgyxEJqyk49fpCdr8qMddEa69DXdUiXD4WBI3MfGnclSGJoCS2kJPnFPdRWpE8sKIZvJkNFkccpD3CDgJ2iJdwVwOku&sig=Cg0ArKJSzLuGabz96xzOEAE&uach_m=%5BUACH%5D&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=58&cbvp=1&cisv=r20231207.39542&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: www.vinpearll-resort.ph
URL: http://www.vinpearll-resort.ph/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s65-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 12 Dec 2023 08:43:12 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 9150291078721736478
s0.2mdn.net/simgad/ Frame 781F 8 KB
8 KB 7ms
7ms Image
image/png 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/9150291078721736478

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8098f89873bf6b58ca48a2797fc926f133e128a251c9c66578ef0f8695597899

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 21:04:38 GMT
x-content-type-options: nosniff
age: 473914
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8106
x-xss-protection: 0
last-modified: Wed, 09 Aug 2023 12:45:56 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 05 Dec 2024 21:04:38 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame CEA4 38 KB
13 KB 7ms
7ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 78672
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 11 Dec 2023 10:52:00 GMT
expires: Tue, 10 Dec 2024 10:52:00 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 781F 0
0 60ms
46ms Fetch
image/gif 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuAKhSUseyij2ToKgLffPpxIO88Z-S4Y1jivm65hQNKf7v1jpCdJzMpVJqUwrIKfkt_U6siIItlf3KSvYZqRP_6EYGgu7y8q0zwyBKx8IOORMqJE_SRbVWvWsWJLF-xkeptRVGyA9dUBhrn_pKLOKY2X2PXKBFYwgwJSRyJFMh7XPXf-r9SGk6UtzxVLOpb8NL_0b-6sOOjdF6RkArFzbkegPShxVdfMS64qoWZWRJZzV2cEw_yH36Oh7WgEr9HSoJztoFjlkQxrN5wu8mfHVoTM14fixWRBu5WDttQ-XCLP_eT6vRdrWtW7sc66pHVPJyVQB0g-PHVY3iO0rk_xIP1u3WUV_C1A3sqDszdj6Vmcbbdcwx_WnmwF-Ubb8oahHRehjCRsLzu22e1oy8qM63DKqfLyrx1RRln8-zrJDYBMnmI1XeoJ8muI_CaDaf3SmTyxQBt1ZzSkgbxlPOpJsranTRniHUczBIl5s6gdEC0EOn8bQm6W6SGkRicNdTHOTeVbZMZWxv772gTfc7ULr9hel9GeQVlIhvzEh_5aIf0Iod1lcSQJMJREO9j3hKTqWYfP_sm4YhVGi5W4BDgdxiEwyGgBSQryY_VN53yJZ1rgFBSaB5ZFcUfGMGwk_x0CMENxhQHuY3G9c2YllU029wvfz9fcYS3xB1prfWpOKfyF_h1kIxdGuYN9WBk5JN0xr4-NDsE-20hyyYid9NtPACeqMJDhcXo-f-lnOLaTzTG2Hhfajv-lP9M5-a7XC5IyzB1fqlRBuxb54exszgeFLdw4r0Oyr78eOjys9x5W60EOq1-Z_FxY1qBEcLMY67dsZ4cRL2P0SaaZOeoHSoLPfjV0FvbxqFAAVphIvEQiWMDpG6637bbBLHerKhDGymJLUq4M-1Qjflkd00TQxeIw0jOVXPhUPopVSx7_KFHVEAzJWNsBluGbT3oj_wWIEyELwI2RrD2zkFlzhTHEUP2mME73abVpg7sNj46es_1goSBuVtEK8-bWapXaL8yoF_HJ7WR_2e44-yLqUxGp-cWfY6KIXca41OX3xRHXJC0JJ-5PMkA_iPUbJBmxsMdA--Hkj11tH5IHXrmOZtbuqZ8MK6b5ymoWgb3kTDS-F6nZvyZ6KKzmHTrQ1uxVva5iOUAVBcJu-JBDrnG0oH2IOf-OR0yM8cCFWyvCAE-4CsKVRnhzjwol5KWRXWQIFcX1OGD9UdLKnnjgcruJ8WReTtWNXlYSE2kx4tAEuOkDyDuTPtHz0nNnd8NHNlUvY76QSV4dQNkG7BXnj5oP7lTNGMU40RIdrG35rWC1hlfHofAaKoXCt_UjOB0XZ4dNCqajjkPzajksOT98YBRAY8LnzeagP-b2gLTg5p-jcUVe3pFsqgWrLKGb-VRHYZsJKIJaQ4wjs8SuC8aYHpsbVn1tDKowNapnMMIfCp5zQ&sai=AMfl-YSNVI32b6btmtddK_EEGsgQttU6GsPlE5zNbu7n7ybkkzzeZ2e0OBvRJnLR-JCb0RsHbYhhXkeTinNb0tNPF-_5STw9OJDczc8oHZAMHLVJCXLhcOU6AK9SltehYZz9jEko2UAhIdNcv_WvEvhxjctBJKyTr5e7WJe36-XPnOgyxEJqyk49fpCdr8qMddEa69DXdUiXD4WBI3MfGnclSGJoCS2kJPnFPdRWpE8sKIZvJkNFkccpD3CDgJ2iJdwVwOku&sig=Cg0ArKJSzLuGabz96xzOEAE&uach_m=%5BUACH%5D&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=74&vt=11&dtpt=16&dett=3&cstd=72&cisv=r20231207.39542&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: www.vinpearll-resort.ph
URL: http://www.vinpearll-resort.ph/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s65-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:12 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/641018540181893391/ Frame EF22 75 KB
20 KB 7ms
7ms Document
text/html 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/641018540181893391/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ea732f76376c1f93798e4ff7078477a9121323b1930e474836f07cbce1f1df29

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 473964
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 20055
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 21:03:48 GMT
expires: Thu, 05 Dec 2024 21:03:48 GMT
last-modified: Wed, 09 Aug 2023 12:42:11 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 91CA 39 KB
15 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 12:33:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 72577
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 10 Dec 2024 12:33:35 GMT

GET
H/1.1

200
OK

request.php Show response
hal900021.redintelligence.net/ Frame 3AFE
Redirect Chain

https://hal900021.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=0027442e58&subid=&uid=fa4ae058d6ad0856&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900021.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=0027442e58&subid=&uid=fa4ae058d6ad0856&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

4 KB
2 KB

87ms
74ms

Script
application/x-javascript

144.76.238.55
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900021.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=0027442e58&subid=&uid=fa4ae058d6ad0856&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCqgElHx14Zeq6MpWtjuwPt4ODwAam5b2gab2TnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAoUuM1P2D7I-qAMByAObBKoEogJP0Brl8u6yICIfWFz3vUgpiFGox7tXFGxqiHw6WSSMQ6pmhvX4GCGtxUhiDoK2eVA9lcVywFhGxmPlvTOnJrCEJciCRV7FXeAu4rEUmWInFi10sdmz_lJKg79MvZKEKtvVgx8Wq5xrOVy42C8Lo_fNsKKAC22eoJXi9Up1o7Td5_RqMSWiGMFgC2ESUH2ibVHPe4WlKqhqYkKU6XBvk6Mp391cS1tCBWNnpyp3RNhJmWDZ1ffMMNwM1FpY2fKd9W5ULjJh3U17Jd0RwhOm-i81oMQ_6bWSblUOgu_NanXgOQeKK4vAtsQWqq1l_9L6agu-DAWLVlEtd6umdOlfxgOG6CqIDArztuTRipExkQLazNfzHNEpM0Q4OFRmUVqIuj5vY8AE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggfCIDhgBAQARgdMgKqAjoCgEBIvf3BOljhipjTwImDA4AKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwiz45jTwImDAxWVloMHHbfBAGiwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE%26sig%3DAOD64_3VzKQJgiyuASd1ZnrUoUc6o3X6Pw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-CIVeR__uaBsS_3d-QW4988WBBL4H2Q_zpCkHp8s4ayl_emoH3jg-Ri4YfiDZmDm60hVTTyl1xQ2-xcFwHSK45OCtp3R16TbsERC1M2RzMQ6by7bm8Fh0xFgXb_ITmKLfRutkTIg_wOxVZMXItdCH3LUZQtwSOIxIu95tZ99SWxh5-OUv4%26cry%3D1%26dbm_d%3DAKAmf-AclAIkfwEWckXOw0z5ZxByty_5Np6rFAUW8dIn9ZUA3VyNkEHRMHWnG3v_JogA2szYuZ9LuUe1d2jnsT8GntsCKvoan6N-5iXBV3PDSipU0nNN6gp3QorAoly4NwqygO1VQRPLBEFy_lLQv8lL9_x9yxKIq4-g_fK6H1o1mEfAfDX5pJe-PYDgH17cQ7UhQA71rOGUIVtON8V9CXCDW9gpHknM2u0FUAE6R8iEcB8CoHUTVP86hJrwAe2I_id1BIkoWB4NWpX6FQd0M1wp44mjdfMP7zrEKB_LifT212yjTyps8p76Rwf64MlPWdTCNwhikBMWIJJAL-_6-AZWgVM0QPrb8AaCBkBV-xvpNucUox8hk_2pte7hP-xkav0jq8TZ24dHLAmqnOaqJ7e2t05xta4e-2Hw1_BFK4XNyHgtfGogakKbUT3KE8dr0zzy58c579PZzgfZ5X6OL_4XyVtHHVRXCYGOpy2GZerhawbuAVEuy10QqDbKZBV37n2A2IqsZygUdVlojiouwgDg7sSfzygPCK18I5bAeKXNmvpUEPqqmKP7XXBIsq3eXWs-uUNMkMY4rw2CjIJC8u9B5ZaSMKrgww%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=7078904564244&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 144.76.238.55 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.55.238.76.144.clients.your-server.de
Software: Apache /
Resource Hash: 07216c1de64ed19793544b4e6a0c391ebccdd70751ffab46999791fd70d8f82f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 12 Dec 2023 08:43:12 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 69274600041506204444994012536021
Connection: close
Content-Length: 1368
Expires: Tue, 12 Dec 2023 08:43:12 +0100

Redirect headers

Pragma: no-cache
Date: Tue, 12 Dec 2023 08:43:12 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=0027442e58&subid=&uid=fa4ae058d6ad0856&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCqgElHx14Zeq6MpWtjuwPt4ODwAam5b2gab2TnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAoUuM1P2D7I-qAMByAObBKoEogJP0Brl8u6yICIfWFz3vUgpiFGox7tXFGxqiHw6WSSMQ6pmhvX4GCGtxUhiDoK2eVA9lcVywFhGxmPlvTOnJrCEJciCRV7FXeAu4rEUmWInFi10sdmz_lJKg79MvZKEKtvVgx8Wq5xrOVy42C8Lo_fNsKKAC22eoJXi9Up1o7Td5_RqMSWiGMFgC2ESUH2ibVHPe4WlKqhqYkKU6XBvk6Mp391cS1tCBWNnpyp3RNhJmWDZ1ffMMNwM1FpY2fKd9W5ULjJh3U17Jd0RwhOm-i81oMQ_6bWSblUOgu_NanXgOQeKK4vAtsQWqq1l_9L6agu-DAWLVlEtd6umdOlfxgOG6CqIDArztuTRipExkQLazNfzHNEpM0Q4OFRmUVqIuj5vY8AE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggfCIDhgBAQARgdMgKqAjoCgEBIvf3BOljhipjTwImDA4AKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwiz45jTwImDAxWVloMHHbfBAGiwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE%26sig%3DAOD64_3VzKQJgiyuASd1ZnrUoUc6o3X6Pw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-CIVeR__uaBsS_3d-QW4988WBBL4H2Q_zpCkHp8s4ayl_emoH3jg-Ri4YfiDZmDm60hVTTyl1xQ2-xcFwHSK45OCtp3R16TbsERC1M2RzMQ6by7bm8Fh0xFgXb_ITmKLfRutkTIg_wOxVZMXItdCH3LUZQtwSOIxIu95tZ99SWxh5-OUv4%26cry%3D1%26dbm_d%3DAKAmf-AclAIkfwEWckXOw0z5ZxByty_5Np6rFAUW8dIn9ZUA3VyNkEHRMHWnG3v_JogA2szYuZ9LuUe1d2jnsT8GntsCKvoan6N-5iXBV3PDSipU0nNN6gp3QorAoly4NwqygO1VQRPLBEFy_lLQv8lL9_x9yxKIq4-g_fK6H1o1mEfAfDX5pJe-PYDgH17cQ7UhQA71rOGUIVtON8V9CXCDW9gpHknM2u0FUAE6R8iEcB8CoHUTVP86hJrwAe2I_id1BIkoWB4NWpX6FQd0M1wp44mjdfMP7zrEKB_LifT212yjTyps8p76Rwf64MlPWdTCNwhikBMWIJJAL-_6-AZWgVM0QPrb8AaCBkBV-xvpNucUox8hk_2pte7hP-xkav0jq8TZ24dHLAmqnOaqJ7e2t05xta4e-2Hw1_BFK4XNyHgtfGogakKbUT3KE8dr0zzy58c579PZzgfZ5X6OL_4XyVtHHVRXCYGOpy2GZerhawbuAVEuy10QqDbKZBV37n2A2IqsZygUdVlojiouwgDg7sSfzygPCK18I5bAeKXNmvpUEPqqmKP7XXBIsq3eXWs-uUNMkMY4rw2CjIJC8u9B5ZaSMKrgww%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=7078904564244&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Tue, 12 Dec 2023 08:43:12 +0100

GET
H3 200 DcmEnabler_01_250.js Show response
s0.2mdn.net/879366/ Frame EF22 32 KB
11 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/641018540181893391/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc9fe8ec0612072dc6d3b4acd268e09d28c253807f47846a5f70dd8360d1a0d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/641018540181893391/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 19:18:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48285
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11558
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 12 Dec 2023 19:18:27 GMT

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 101ms
101ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8344adabdc2892a8-FRA
date: Tue, 12 Dec 2023 08:43:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0wSbNU6N5kY8DAwJQPkxppc%2FeXpNoP67D7pRGzxVFMV4bAmZhfXJPb6ZiDL2Q4dmRbBW269oSLgeepcsNjvmbHxacWXCxa0bigJSDBBRFpO1qeCIC7z15m5OAjyyfvuLymFagBZYho%2B7s%2B3axMg%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
261 B 110ms
110ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-92cafdd1.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Dec 2023 08:43:12 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vHqepMVcrgqJ6KAQP2A6t2GQJI6Ygwgu6dB081o99KnYUbS6lOznkt2%2B%2F2eMvBtZN%2FFeZ%2FHDz7neMmx9jmfsT3bWN6bBTFFv0umwr72iogm7TpRM9ZCZLi%2FFI1n7eAT0SPWAu2U39srIrtM9wc4%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8344adac8c9d92a8-FRA
content-length: 0

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame CEA4 39 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 12:33:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 72577
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 10 Dec 2024 12:33:35 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 6536 41 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CgonhzAR5EzU_lV2P7tvsf0YS690YNogIfMDNxLZgAwB-vsIidspsKiCiuxzaqPzz7BdIOEcz5DPsrDKI95SIW70m5th34rMPXUICFAGCrioymEzHVBnK5qbK94GH5fuYJU2hyT6qjiDpZ-Cza8-IRsypDc-6AOGgjgdVZJ3FcGUDfXno&cry=1&dbm_d=AKAmf-DweTQTGTctvpsfMxe5cpkAnzbyjE25KbhOrxml1Ls8mIFi8GhBaTrXZZRUgxo0R1Aau841i7WtzfXT-s14gnDubZ0U-VKnPIDeIQrOceEmj4BYoSmgP2abOTBE2dOGtqd4Mbc50Mzz4nIQgm3O0iSnk0eQufJnVlzw5sED_uWq1DgSxv0pJh0xveue0vy1CanyndwpquoZRVirfjAGZy_qpe8ogTSzGYpUwBGP-NESde0Ao5r1Dko7SR0EdohGpTZKnUVriBNBR9SzQQDOYATw-cZdfZBq3exFoYc7HfpsBBy_n-0vdF5j3lDDIqG8s7Tzp7EMnY5MX2-JH-UypHa9jl5qEp0DGqdkAlCkvdk9MM1uF3WcwMbigxoRUXZjlaNBKlWF4lXgqANyWYxtIoIYk5HSw0gE5vDWmG8qXpLxBbuvsIsVOzapdP9lVCI4NyI8JGS2CFf3WXXJBJzfijisQnbbxlUA5lyHB3LkZipIW_HCnngkuCaw2LIw1onVP4SLc4kODwaN-N9vXbkw40-UTAe08nP0EFdZvL12o8YhTAHIc9sRmWRauDH1XxP5jUe_46BY27zevpaSkfRelV1DPKafIzkxjratErjLop-d87K8WKUheqH6Fkg80FMtgPaoxRtEbnnDpsEp29PzhAXYFqHgkUQSHbIOGVtzb96aXHRIA1eJdPuQ3QvUwdfWQWS5gIjLsF-y-4MVccKbT2cWXU9rREsa3XmdNXI3Q6CzIRt_4bWr0WU6IGvL8hP6H90WgiR-eRZ6J0TopsPEYdH3a3Mg0MaZGCfk4U5qmNpQ_tOtxWxW9lmATEHV2lGhQz08g4pYqAB6zCJyu27RZR52k8ZmuCw6Zhmx3hYhYwejsxLO9A4wbClyl8tnYL7W1hlCy4ZaPSy92EejctMPzUGGhmNiV1TvXKCxtwpMdgrfXCpoVbct38F2L40T3R8fKVyQD5T7a0fpsoLGfKquP0uM1cEyld8rf2kRcyelHV0Dmy0sl261MCrjOscA-diUsCunzA2HhVeGSKtiqOkUm10MvAcydaQXsgtTOyhIW-VCn6SNd06zEe7vMzgxtJH3qxwWbv1G2NlvWnrK5JyMNWHsJSOlb3XVoFcXp4mVqY9WNIeJ01z8kFbmPGYhbBRV87540QnmMfHlusnB8BzV2S7w6dyrHGM80O8dUgiZiV3li_oMgGyzsyi03FOmwIgGDSk_l1dwu02aLlF6TVcBXcIkpTdAivRqSvG5JmRb4YCsoAzb8Hhf8dmXkVkOhS1aufs6OAo9UN3BsnLg_D3zR78qzRmUSEQCcd-FzihQHCYoRo9hLi6UCtRVoN2h_QIIgqLBXAG38VOEb5CY-9z1MtUabeefCu2huHQp60ctxbHLz-WPIG5jszQshI76HpDfO-DtNcOEl8P2QPJ-ozpQAIOacRFeKC09FfZcOr6eF2jjtqZpfhBmBLE9288WM1Z7tDdRmmgIr2O48hkL15r1bSAzinoND8-27_R_JaZ04vnNGMX_QfwzuiYzXKXJrtekH4gW1NwpsUWsHzSZBoUVsEyZ3Cyv3uCIjlcwVDBXc1DuLLEcael4v5NTEh4A4sKfVuDV5OkR6JC7GIUy_Rnpr9XMhXPWx1M-IiRvJBgUTuX-YbcXG08jkp1NqlW_d-5bjBMnTdBxWEke6gDHShyoU50_pMlEUI4t6aBpZxMW2Cu1bvmivK3ggiliPIRA1ROTjnIKfJROYJoNcqNdXofDnbk6Fn9aqqrrUtVc6dUfQ83fcoXy364AzxZB_YPYS0dtt_Qn2pV7eszrjWSOXhxhp-V1qfIrHaet4DEg2QKj9EYFfnjcWlIPsfcteLhmmFDZ6ExKlUx3j7pOebvR0DjTDY52y7YDYczBZXL-afWDibb_MViNvakETJ7YtmloSDlpulnB_nWvIQ6g8BbN7jLnZTxfNx0XugrJqEwP5j_EB5H0GOad3W20M2GfOU1EO8bTH4JJThRRRrzIeM0UnBvkJ-Wn6ZRKKJSC79aMjf1rTA9xHbOWjyo4mEEAMbCi2wAr5vF1fKVhk2VrY1irarNuGDIcYM61fPnwBbbRomO2xUdFjT5HHgUXua2Bv2TkVvYUUHoIU0yiSDq0JGjajbJTQEECHOj5I6QbFP7pOcNkhfZ8qbuLMk86CUNPiMuXtpz8u5bH5w8q2XkDGufSKrRmpGUpLbGM382TpX7SfG-dNnHxTMRyzlZYv_fkXU4p2PQ7rts4cqYjIo2dYyne593_SSog4xQ3rmN3HabYjhaL41hrhdwRR1Hg3jlaoEv9a7-3SLa29cNZK3XCiXR2_eMJq8AfhT0UZ3lDzK35kfs7BtMKP0psqkE895YKIj9125FxzeW0h109Xf1N-mZUN5AWvz1mf21w9LoqveGgIUUfZNn7J6vNzkbh3D7VZufFD8cV98DkrGhmYIQyHjPx2aPswK1__PXtpMw3lIUEOBqDnOTGgLskMLb6Sbn_gUoZ21afoANDpLSQf5ZVj288gLdajQiuhWFdcui71gZ1bJQgJGZkOBUSUqORCdBOdWJFNoaslqwwQ89GOtX5TR1o8Iu4ek9RMPblEov6V16w-CCacyfiBf4dEJdwNPuQ4maagODfmpOwX9OMDT-7-KQ1ZvCRZ0TP1oWn1kMFGw6B_SDXBBY7ZPlPnc3JFLe-laMtW5aUH9szj9FttTn7datKLV3y-nmIp6RDBSFJy9zZIvPAai-K1gHtsqcdeL1KVqhFb1CkE7wanOTyuC5dYTsI2KoYGfsaqMeDudclwjClaoIu7TaoLifWVgDJhcFGJdQgVknPDYjFe0qwJtkbUZTADSSEkRDoTdMf3kMDJz8R5aui_vKZSfvrysaAXCU6ayocrKjlwyxcaNd2_4jubC1Wesw22nS33iEwyLvQf0GlLoeCUwQLR23nc9NCmtUF27ETyNotBryoOCaMZkLREn_PMy09nwDcc1Yi0YGzLYOEi21lJKpyCPSiXIbEv7QO4CtcboA9PBnmNq15mu1Ri-R8OacKXxIJC219DU1AFljFj1GI6HV5Oxki8wOA3JWPqf5vkF2dhdvL9lp0wzbXN47-sbtJ4T-9YUSKQvWoc4ogBJdCfuH2NP0mVmODN508wuzTEOOTcOGSs2gD03su14zCdNicgW8pMReYm_uf3_FbvWDaKX5S3Qmmf4kj0jiBOjtF_l6tC-cCa8P7RnJo4qIpliMjW2xya5nBaDAaR1kQfa0IsQT-NAAFjp15ZUu54LKuY5VNAfzEwmrxJ0M4kpKlF8yGPMVsZ2r-Dl6Gaaudp7oH5_GPGt6X5QgV21w9cvruMxfm7KqVaCYd4YRH7o7Mf_Md8pHPQQbi2X4c0a78KrUxMk5lcn2gPIkcbUDy9n5vpKpXrmGYSZbSb5IpLY92x08aNxTupyMywEjBnyyp6kNq5Q8CJZYwRZtvINKpofHOitwncBx1yq8hEyxxx4xDxiptnxKwoKCozqk-K1M2Q5kGCdR24AnTGI-9qNB3CSNKlucFJSPLb4HWRWum2N6gQbPeSheJqIQKwcEDxpMS8RXF_AzO2627jcV16x1AzeJsivVrgB1j0PYmpqaZsAAbfTSHVEgl9tTKtyvLtmYCLWJRMLOKGu5sOOfPzTCdYVRBs_kUsVvtfx6h8b-bjKvu_EXckSa_3vhOzfZEsdMs1V3McH1pOWlQ3ukRTGix0K9BYxXNAsNlFYtydW8jUKugROhFaeDoHTUD_IrHhsJVjgiy59cVcKuzTXig5c1FxqDSDToPFjftMVfAOB9WmkQMyt68152sj5dqoklt8t4qTfAQnCMBzz6902EybNslcoDqXrSy2byEOQiFpQXeAE2_pzu15fuwk5IpNekB2H6HBKax1vrnyNXhJPjTNgyHE_dwJki8wJOYRd89Rq6-xDUNTWgve2l3OzdA7FC5vtqHYLKy5a3Ulj1FywPGrKXP3dd1I7sgQbjstGGJfLmP3At_fLOuYNBoGiSsM3lrwfRmkC8KkJ2gT5ppwbLOD-qrDmMzC3rr-d_t6BijoURqaaCrnYgfIgLxWpTI9g&cid=CAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=10254026097930027000&adk=4188270524&idt=175&cac=0&dtd=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 311884
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Dec 2024 18:05:08 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMjM3MDU5MjU4MzY3NwogIHNlcnZlcl9pcDogMTI2MDY4MjAyCiAgcHJvY2Vzc19pZDogMjM1ODk2MDc1Cn0KZmxvb2RsaWdodF9jb25maWdfaWQ6IDExODY4OTQz...
ad.doubleclick.net/ddm/activity/ Frame 6536 0
506 B 45ms
45ms Image
image/png 142.250.181.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMjM3MDU5MjU4MzY3NwogIHNlcnZlcl9pcDogMTI2MDY4MjAyCiAgcHJvY2Vzc19pZDogMjM1ODk2MDc1Cn0KZmxvb2RsaWdodF9jb25maWdfaWQ6IDExODY4OTQzCmFkdmVydGlzZXJfZG9tYWluOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0Igp4ZmFfYXR0cmlidXRpb25faW50ZXJhY3Rpb25fdHlwZTogVklFVwppbXByZXNzaW9uX3ByaW9yaXR5OiAwCmltcHJlc3Npb25fZXhwaXJ5X2luX2RheXM6IDMwCmV2ZW50X2ltcHJlc3Npb25faWQ6IDEyOTM1NTc4NTM0MTc5OTE4MjM5CmRlYnVnX2tleTogNzIzMjA5MTIwNzQyNzEyNDgzNQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QUk9EVUNUX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9EQVRFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIjIwMjMtMTItMTIiCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0ZMT09ETElHSFRfQ09ORklHX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxMTg2ODk0MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9DT1JFX1BMQVRGT1JNX1NFUlZJQ0UKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBVEZPUk1fVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9RVUVSWV9DT1VOVFJZCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIlVTIgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QTEFDRU1FTlRfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMzMjE3NDg0MAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQURWRVJUSVNFUl9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogODc4MjQzNjk2CiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19MSU5FX0lURU1fSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDE2NjYwMTQyMDYzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19DUkVBVElWRV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogNDE2MjA4NjM4CiAgfQp9CmFyY2hldHlwZV9pZDogMTIKYXJjaGV0eXBlX2lkOiAxMwphcmNoZXR5cGVfaWQ6IDE0CmFyY2hldHlwZV9pZDogMTUKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL3JlZGludGVsbGlnZW5jZS5uZXQiCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9hZC1zcnYubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8va2xpY2std2VsdC5kZSIKaW1wcmVzc2lvbl9ldmVudF9yZXBvcnRpbmdfd2luZG93X2RheXM6IDQKYnJvd3Nlcl9hdHRyaWJ1dGlvbl9hcGlfcmVxdWVzdF9wcm9jZXNzaW5nX2JpdHM6IDczODE5NzUwNAo

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f6.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0xb8cb997a900210840000000000000000","13":"0x8708305654ac1f4a0000000000000000","14":"0x576e292b2a001ab20000000000000000","15":"0x53020e65036f9c470000000000000000"},"debug_key":"7232091207427124835","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"21":[],"8":["11868943"]},"priority":"0","source_event_id":"12935578534179918239"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK g72h7lz2c4az Show response
hal9000.redintelligence.net/zone/ Frame 6536 12 KB
4 KB 22ms
8ms Script
text/html 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/g72h7lz2c4az?subid=&gdpr=&gdpr_consent=&rnd=1702370591826732&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCV8xDHx14Zey6MpWtjuwPt4ODwAam5b2gaYWVnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAoUuM1P2D7I-qAMByAObBKoEoQJP0AlIqICRquBqaoi4iWD8GmY68-pHrMd_GT6DROFSudQ6VW6gD4rxHvQO47SnCD0iSlGzZ9swulG0CH7khnaTd6f-FyI7GmjOaEJ2QKCnDsik9Z_WiYfo18rBFZh-4_FGEzsX8sjrsWswz0yQNJ6SDnGlFiMWShv7M6p75A337mc3SJO63v16wdT3uHuSGmacROiI98Ls2AOTprs2pnoViyk9J_wiGcKPhT3FI-3e3mlFKo18x4anR46QG2A6ZA3jTdf20y2dJ8SuS9HBXoiJQAD53ZBEaLLi3dRn4opuuD8vOYk6aW0sryZB4FLc43gt-EjMYCXMUAeu9rniuFwnuegONQA91jJ4OK-XgF1KEmrVDdJAnQaEF6my6-LBukomwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB0yAqoCOgKAQEi9_cE6WOGKmNPAiYMDgAoDmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRF4g0TCLXjmNPAiYMDFZWWgwcdt8EAaLATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE%26sig%3DAOD64_0wsKVTamJ4BRwlByguW2MrrYj3sQ%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-BRuRKJn9aCu1uGxhyQGGn5hj7w7r_XTY27McErsmWGK4TAiJ9Qu0tAt0FFE2DLdhFGGutIhFiP1tSQbOJWVr6Wk328URx6GYqPcxy7enL_-6bjs4epKWXW_lHxD5VjZHNpqkWTPbncFPUeJQ82I4w6DYrfjcCayClb24Wg12HumwK2vZI%26cry%3D1%26dbm_d%3DAKAmf-CgOECBy6ajciMYkH7Rs74IhCkvYYMNaD47IytXwG2LkIljLErXPX2jxdAMDX3i3TuU5Nw1hcvanL62uIr9YanzwYuNTOksdfHTNXZz8jDUe6fuady7IC5QsH9_wDV2F3pj7wR672p6p7S6JDcNYtu0JPxvGuAoAU-sJQwcwklx3S-8RebCTS57qjuEnFVfL7VTaf2PA1cNY9fiptd-N6t_nbLjBItytolUgwhMCkU4V-NR4NXJge5QlGuTECbXdbet5WLoic9X4lwSvTikl_uiw9q5OJ0f6Qh4ttRSdwz0AIluc8MI9xtX3RNAzKfskY2nZxNLB3YJT1QreTYLcaprEEU-7_RlmqfkygD1bNMoIXgMkzC5MrEt7tN16j4MQcEOc5sjb8j0f7Fvpf7oIFpvJCtgSvqSIE5Ey5kFiu_8AVbSDlYu5qDMhUQGFBqdeo0GzvuDLzbe_SZaYFnRPR_NxgJMKUPuFeoFDRLyP-IS5fmfiR220gzZxVzI8EP5msjcWkqwTN8h3pwd0gx_ahLpHTsO1HbVEimoupSg3jOysC37-_kcxLwJn4pJwqhFIetM1xv-qHPvMZuAvfWpjNlDLpZyLw%26adurl%3D
Requested by: Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 337a7698dd21b1f7602a2b24a2b0596961c7154a8ebd8f989d4e2ebfec02a278

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Tue, 12 Dec 2023 08:43:12 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4257
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame C329 41 KB
14 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AaxvbLF_aP0xOIMHPMh2QL2hsD1KYNzPfbQYHNaFOpMrz7s2Fy9Mz46KvsHipvJ9nA5TrFGg3JpIZAyur7x34X6muXKhryPy0b49vCLOt2uFrkvVwHQ18L8IRBzBkYGyyiTYWcxEubatJKHWlhbxnZJ5H1GYnl7ueNAONZZ9jEIc2QWnk&cry=1&dbm_d=AKAmf-CtK5Mv1AiDWKs-zgwG5loUDx2qepi5P43nXcsEHz5ylppVwZQHYSNbE7-h_nCvXLg8-V_GfwVptQjtYicYpJkellIyil4QqIdI6s0mljOiof_DA2tBKgIV9r0iJNZLOkJrFpBMY971l17XY2JVA8ukuN2D-hOt5mRbwPlinsWYvotYfkCOfuzurHhlUszDqTJCDXKx0bwjvYU67-ne5KCpAL8DlAQognp622aCS7PdYaNL7MSJl6c7TSf3SN1hWWXlbj6jRDNtbyZemgHjBoJ8Fmi4n-1rkG5prvlX9br3CXTWCb3324Z9hDhQ0mrsgWWgEcq6Y4F3CN38fOFnFuX5LqGmjF8Y33FbhAWo70_zUB9_MUtGYHBVLkuJ8qTEWZjbtOBsk4W0h3hD5kXGRQbIWfukxTmcCdOSbn9f3xzXLAIrwV1_1KJplT7Sukuh2oF--Y0qz6vT2sK18BBCz09RcqhWJqOLjieKrX8ejzOdaspOwI83qO58VkWfGk-iI_FSu2sJ_jJnuN0ikUsWE6nvHW_-rboDVzZQB-Os3a4xGt2lvs6PJFsflObxj0uX2bzeVKEMqlO8icJGUsM19oMLsO-LuJm-9gGZrk0B_3seXQinioTfR6pj4zPknHit4XC-AUU53X_9cccwG-V0NPBGyfXfxl3OiFUlpq1Ny-q7f5aIEPCs8YRRuiuljsq5uEdnofEopALR74iRa7nJ-tQsCdklIeT4Cd9H0idc4qooE4ID2rHZcoPCMlYbfijf6o526cklByjuWSLPIzkfulSqXyKGQ_4G-r9XgfgfnFvsjL6hIRH-A-RzBMLoBI2Qd2F0Mg3ntUQjaefn9gnuH7ajWbbagslDD4sX8iMib39JZ-ASvBtMpskIwqmlwRNb3fCQrQRSj9Mj-CctORbXcnWW4D-r_H4IPIXTzlk6eyJTAnZ4jh0PrJa5ThljfYaGXMSfQccipa-SuxpGw7saqj3c3PUCFpZuRiPeNjQGNGBq2vE21qb7npy_NFh02tJH1rpOMVYKlVKR9ID3mqjwBVASS3undkHRTr07_fFW8WmzejU15aCIr1uPz3IHOfPW5N33XE7dL1ZOFt9Mnt5O03Fto9Xgn7UALhcm9JpGQLVnj1BI7YXa0HQyzczJ_y_XlHrqXm7js9fnJvCDT4tQTfNzcvY9O58Ve23YPut1-lLlT07gLZ8VBrsGrxQ9H4YXnnQvngiAnkoXRJyx6sPedyUkI1sD6ovCXu1BMUxneEm-R4iZ725vw11HzGUdUcGkLUPqDe_iLXxnZCPmA2rbOL453EsS1zb8CYRN3mY78CcfJy0E9WHNcMNcDjp69cC7T05cCcD4UgpfRZoW9wJxgVlU4EpGE0NwvpL3BQ8eXqrtyGOdE5oD1zLm97g5YfC83XKph6TtqLKVQ3tB1OE3KPeSPO-P7tZanOSlI-Ka3HfdzmdjeqxfHnrfm81tXFjxuEVN2PRDe5qYd-X16fy3LKdRCXsmoa0mmJ3Mwh3jZwVpfsgki3IeK2cwE-FM5nIqB3g3M1MBG_vE84liCAzPZzE4gsh-Rrl36UwpzahDLIennVuRg42vvGs45ETzE1mtxp8usmDzTqL-J-_4C7IOzinKXQtOsaNNwyyucCpsMR3kR_RnLG1qUczvAQ8SipT2ljw9S0VLvqCHY3KOe1nwHb2WulQ0d6b2OUzfxd_B0liJAbToj6OYVF_0FkE0HuYe0Jr46FolErM-WbzJEQ5MjxuMo8RrVcLmfVudXJMbT5hXjHwSBrGdS327i_rG9LJwQHzjPUZ7_rLmu5wPKYupXRhbyfWP2rGtj-rbUyNwiEMEzJCEFu-hwF7_bv5rI68UjkBNfU_cK8s_bOcz5qss3KMGkw7hO45L2UJGYBeVN2m4z9JX1ITCJc52oQ84Sr89oRlsjAxrHeFcwYeWjq1-TBr5N13MOSox3KDWw50ZZZkoPxtApNs0cg95UPgAqfkjeRFshyHIDucMayr6xNp2iEjRBRRtIae9W4ocvf78aP2emhsoGurjN-GnZ1QZLsWWxQFobpkrgYwRBEcJIGZlkgZ_l2AbrnU7ROX7EiXeRQ-ekFg3baWmbVigEs-UQab6rlx9VFOgq3MZfLx2jUxxIyr6_3WgsPHM_gU6jT_AFExlxIFhXZXfNcKtaIYva4tuN-BRk_89E47Lg_F4H3Vsp2iFGpgEPfVVJ_Hi_gyHX8-V5PGrPJuwJwVgLjlK6NqnftgsYcQUfMcYN3kaIrB4GlMsRANgRgFtCq21VCwzRbJoZQxCihV-FjW6ATXKiQ4ymB5WBYTsOK5hrerlPVJIRVHqR6BPa07uw46Kpba2Irbnm54tyR939RiDOETSWoGoawO7wwPB4iUfBBRxAELE0ODBO87mTyQD9ItO8vyiLuiUf6o1QjPsQ2HC_vNNV36JCJ9UYGskOkPz-qX-MKuCJ7a0q5eOKlq0o8JueekpcvFyzOx-E93kX8lb8bsuOzbTdcFuccyeAQmvv2naRI0SrzV8TArUuHT7Z0TKL0l-GCQfCIcIuaWnDgR2Z5a8G_XfNHZHcx1aZ5ODySJlox2xvE7--L8BDlC8ch_xiNb-V-qFMuGr8FWYA5Psme2HcKpUx0i_EvfQu6BDLqWgDrJqQ8k3vapcHqAaScQRbfukC5KljYz5EZwiU4tuc2gpd9G75AXhx_lmMmcKZdP_AJgRFrRoScEcQGpbMtX_7nkGKgtOkzHThgyvBHa8ckI6jCo-SJn8Ud7u3yqamQS--tX5Hec0U7RU6uhXX1JjkOvTkQHPPZwNCNWqEFy19WmAKbHm0AMcCwUdRYgFgSomoxaq46O4VI3ms8mMAQAfk_GSDRK3bh4mDs7pS2idIqvkZ1MLRxOu3Xr3vFSYobOGQPYFrq0dfeFJn6gAdR2GIdLqQgYvjLdW5xd8guWf_LqsWWJQcKZ7USYkji1oTMRiwGSbwXN80ppqmjfeB53_fPS9PvAJ3ozUHr2ntgk6NUs2fVZmPoR2zUMOXXt9L6mupwjfU3Wynq5-LmOLjI_P68aFCSrqfMovKcwP9BsoWbFmBbU5XqQg2CgI_VKbzh2GXU-sGPCbwuzexPgzmyUNYpjMQ8CPZLycIvXeqn6XgiuOies1FlZ_NHp3uueEoHy6GEXR1hCr2yjh2rSuXu1NN1vBiRQB5Lf1j3xuzwKyDnBDa2sLLEY14euYKWjIy6d4mUy2vB3EZGLd6ZdqpLsjQneiZG2Bd2aM9kkI7xGLNTg_x9dpk-Ogb23dk7o_XpPuplHoCBtevr1sLrt2G4vpGKSnW3JG75CfOj2WLYGvVa0WBOR7aL58PkMHHiKXV6SZF9AyHZCwm-KBQcYiu7APD6sQTVkl5YJAOJ8kul301hDe3p5y0eSc0RRZuIobWorzt3E8yR7X1_VF7G1tLLLTeP7iaa8rQbh4mzcMCd6N1Sw5SVynpmcGK2O9Vk5cp-h3V0prfQAtdXYOhrZhwZPl4L4Lo7lT79vksvE6xkqMkDX-RCQQWT0k5WzS8maLBBdztm7iyX7o_97JG-LY0ftyawQ-te3PentE5Sm46S7GEKoL9Q4j-oilZTnn8f5J_fcMo_uqQGhHng6MJk3dYty9cGB8LfhKEdxslqf3bea6FLoOIfkoT-XhrjwXM2rtsCJdNiuO4HOU-ya8E0Bnjpr3Phok464yAftwqhTox4gWcec-CA4Z5Er9aG-loURdS3rTR-gZM1RIRy7aBhmxN6cKKkn0kd4B-mak7mwovovXg0wWadKF6t0DxIzrVdyN0bpT8VAIFt9WwkVBErJU1uVJJeDJ658260ouD_QDsNGjzhKmNsoawBzvWzHdJ-1j9CJWLJw3US3KBtjr9VC1YfhaYY7SHbw_1PyCDyD9yrBpl-tqRGj733Svpa9Nt6HTOh8ZU2R6Cv29wUVS2BG7zQjh7zO7s75VsXAMec3kv-eMPHvh7-RHXF4wjpNcaZzLM6hULsPCYI1JOeO3J1N_b_TnnPapAsniLTE93OqgZ3UIHAtWOXp2_bWJnPein8py65jwaoC8MN5OswlT8A&cid=CAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=826161166376599700&adk=3037181501&idt=174&cac=0&dtd=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 311884
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Dec 2024 18:05:08 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMjM3MDU5MjYwMDM5NAogIHNlcnZlcl9pcDogMTI2MDY0NzI2CiAgcHJvY2Vzc19pZDogMTY3Nzk1OTM5OAp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame C329 0
505 B 47ms
46ms Image
image/png 142.250.181.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMjM3MDU5MjYwMDM5NAogIHNlcnZlcl9pcDogMTI2MDY0NzI2CiAgcHJvY2Vzc19pZDogMTY3Nzk1OTM5OAp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiAxODM2MjQ5NDEyNDAwMDY5NzQyOQpkZWJ1Z19rZXk6IDkyMjU4MDMzMzg2MDMxNjc3OQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QUk9EVUNUX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9EQVRFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIjIwMjMtMTItMTIiCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0ZMT09ETElHSFRfQ09ORklHX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxMTg2ODk0MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9DT1JFX1BMQVRGT1JNX1NFUlZJQ0UKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBVEZPUk1fVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9RVUVSWV9DT1VOVFJZCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIlVTIgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QTEFDRU1FTlRfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMzMjE3NDg0OQogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQURWRVJUSVNFUl9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogODc4MjQzNjk2CiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19MSU5FX0lURU1fSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDE2NjYwMTQyMDYzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19DUkVBVElWRV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogNDE2MjA2OTY5CiAgfQp9CmFyY2hldHlwZV9pZDogMTIKYXJjaGV0eXBlX2lkOiAxMwphcmNoZXR5cGVfaWQ6IDE0CmFyY2hldHlwZV9pZDogMTUKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL3JlZGludGVsbGlnZW5jZS5uZXQiCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9hZC1zcnYubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8va2xpY2std2VsdC5kZSIKaW1wcmVzc2lvbl9ldmVudF9yZXBvcnRpbmdfd2luZG93X2RheXM6IDQKYnJvd3Nlcl9hdHRyaWJ1dGlvbl9hcGlfcmVxdWVzdF9wcm9jZXNzaW5nX2JpdHM6IDczODE5NzUwNAo

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f6.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0xb8cb997a900210840000000000000000","13":"0x8708305654ac1f4a0000000000000000","14":"0x576e292b2a001ab20000000000000000","15":"0xb3d8ef5c56a74bf60000000000000000"},"debug_key":"922580333860316779","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"21":[],"8":["11868943"]},"priority":"0","source_event_id":"18362494124000697429"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK request.php Show response
hal90002.redintelligence.net/ Frame 6536 4 KB
2 KB 113ms
85ms Script
application/x-javascript 46.4.10.47
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90002.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=521027e4f6&subid=&uid=d94421509a5a6413&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCV8xDHx14Zey6MpWtjuwPt4ODwAam5b2gaYWVnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAoUuM1P2D7I-qAMByAObBKoEoQJP0AlIqICRquBqaoi4iWD8GmY68-pHrMd_GT6DROFSudQ6VW6gD4rxHvQO47SnCD0iSlGzZ9swulG0CH7khnaTd6f-FyI7GmjOaEJ2QKCnDsik9Z_WiYfo18rBFZh-4_FGEzsX8sjrsWswz0yQNJ6SDnGlFiMWShv7M6p75A337mc3SJO63v16wdT3uHuSGmacROiI98Ls2AOTprs2pnoViyk9J_wiGcKPhT3FI-3e3mlFKo18x4anR46QG2A6ZA3jTdf20y2dJ8SuS9HBXoiJQAD53ZBEaLLi3dRn4opuuD8vOYk6aW0sryZB4FLc43gt-EjMYCXMUAeu9rniuFwnuegONQA91jJ4OK-XgF1KEmrVDdJAnQaEF6my6-LBukomwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB0yAqoCOgKAQEi9_cE6WOGKmNPAiYMDgAoDmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRF4g0TCLXjmNPAiYMDFZWWgwcdt8EAaLATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE%26sig%3DAOD64_0wsKVTamJ4BRwlByguW2MrrYj3sQ%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-BRuRKJn9aCu1uGxhyQGGn5hj7w7r_XTY27McErsmWGK4TAiJ9Qu0tAt0FFE2DLdhFGGutIhFiP1tSQbOJWVr6Wk328URx6GYqPcxy7enL_-6bjs4epKWXW_lHxD5VjZHNpqkWTPbncFPUeJQ82I4w6DYrfjcCayClb24Wg12HumwK2vZI%26cry%3D1%26dbm_d%3DAKAmf-CgOECBy6ajciMYkH7Rs74IhCkvYYMNaD47IytXwG2LkIljLErXPX2jxdAMDX3i3TuU5Nw1hcvanL62uIr9YanzwYuNTOksdfHTNXZz8jDUe6fuady7IC5QsH9_wDV2F3pj7wR672p6p7S6JDcNYtu0JPxvGuAoAU-sJQwcwklx3S-8RebCTS57qjuEnFVfL7VTaf2PA1cNY9fiptd-N6t_nbLjBItytolUgwhMCkU4V-NR4NXJge5QlGuTECbXdbet5WLoic9X4lwSvTikl_uiw9q5OJ0f6Qh4ttRSdwz0AIluc8MI9xtX3RNAzKfskY2nZxNLB3YJT1QreTYLcaprEEU-7_RlmqfkygD1bNMoIXgMkzC5MrEt7tN16j4MQcEOc5sjb8j0f7Fvpf7oIFpvJCtgSvqSIE5Ey5kFiu_8AVbSDlYu5qDMhUQGFBqdeo0GzvuDLzbe_SZaYFnRPR_NxgJMKUPuFeoFDRLyP-IS5fmfiR220gzZxVzI8EP5msjcWkqwTN8h3pwd0gx_ahLpHTsO1HbVEimoupSg3jOysC37-_kcxLwJn4pJwqhFIetM1xv-qHPvMZuAvfWpjNlDLpZyLw%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=8731175614677&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/g72h7lz2c4az?subid=&gdpr=&gdpr_consent=&rnd=1702370591826732&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCV8xDHx14Zey6MpWtjuwPt4ODwAam5b2gaYWVnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAoUuM1P2D7I-qAMByAObBKoEoQJP0AlIqICRquBqaoi4iWD8GmY68-pHrMd_GT6DROFSudQ6VW6gD4rxHvQO47SnCD0iSlGzZ9swulG0CH7khnaTd6f-FyI7GmjOaEJ2QKCnDsik9Z_WiYfo18rBFZh-4_FGEzsX8sjrsWswz0yQNJ6SDnGlFiMWShv7M6p75A337mc3SJO63v16wdT3uHuSGmacROiI98Ls2AOTprs2pnoViyk9J_wiGcKPhT3FI-3e3mlFKo18x4anR46QG2A6ZA3jTdf20y2dJ8SuS9HBXoiJQAD53ZBEaLLi3dRn4opuuD8vOYk6aW0sryZB4FLc43gt-EjMYCXMUAeu9rniuFwnuegONQA91jJ4OK-XgF1KEmrVDdJAnQaEF6my6-LBukomwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB0yAqoCOgKAQEi9_cE6WOGKmNPAiYMDgAoDmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRF4g0TCLXjmNPAiYMDFZWWgwcdt8EAaLATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE%26sig%3DAOD64_0wsKVTamJ4BRwlByguW2MrrYj3sQ%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-BRuRKJn9aCu1uGxhyQGGn5hj7w7r_XTY27McErsmWGK4TAiJ9Qu0tAt0FFE2DLdhFGGutIhFiP1tSQbOJWVr6Wk328URx6GYqPcxy7enL_-6bjs4epKWXW_lHxD5VjZHNpqkWTPbncFPUeJQ82I4w6DYrfjcCayClb24Wg12HumwK2vZI%26cry%3D1%26dbm_d%3DAKAmf-CgOECBy6ajciMYkH7Rs74IhCkvYYMNaD47IytXwG2LkIljLErXPX2jxdAMDX3i3TuU5Nw1hcvanL62uIr9YanzwYuNTOksdfHTNXZz8jDUe6fuady7IC5QsH9_wDV2F3pj7wR672p6p7S6JDcNYtu0JPxvGuAoAU-sJQwcwklx3S-8RebCTS57qjuEnFVfL7VTaf2PA1cNY9fiptd-N6t_nbLjBItytolUgwhMCkU4V-NR4NXJge5QlGuTECbXdbet5WLoic9X4lwSvTikl_uiw9q5OJ0f6Qh4ttRSdwz0AIluc8MI9xtX3RNAzKfskY2nZxNLB3YJT1QreTYLcaprEEU-7_RlmqfkygD1bNMoIXgMkzC5MrEt7tN16j4MQcEOc5sjb8j0f7Fvpf7oIFpvJCtgSvqSIE5Ey5kFiu_8AVbSDlYu5qDMhUQGFBqdeo0GzvuDLzbe_SZaYFnRPR_NxgJMKUPuFeoFDRLyP-IS5fmfiR220gzZxVzI8EP5msjcWkqwTN8h3pwd0gx_ahLpHTsO1HbVEimoupSg3jOysC37-_kcxLwJn4pJwqhFIetM1xv-qHPvMZuAvfWpjNlDLpZyLw%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.47 Rostock, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.47.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: 5cea97635879aa8d22cd50d9e45432fdbda9be2ef13e6699ddcc808f9071c6fa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 12 Dec 2023 08:43:12 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 41235600036525004444550012536002
Connection: close
Content-Length: 1339
Expires: Tue, 12 Dec 2023 08:43:12 +0100

GET
H/1.1 200
OK 5zyrr3xpcfb3 Show response
hal9000.redintelligence.net/zone/ Frame C329 12 KB
4 KB 22ms
9ms Script
text/html 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/5zyrr3xpcfb3?subid=&gdpr=&gdpr_consent=&rnd=1702370591826733&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCeJDAHx14Ze26MpWtjuwPt4ODwAam5b2gaZ2XnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAoUuM1P2D7I-qAMByAObBKoEoQJP0DMg0QMAlOZjpdnCUVlALT0XlNT0U2xfg_Gvlwk_Yc2mYocM7OUR-uYUzQQfZyMF1bqln1WTtOG1LDz6mms2fO7gH8lT9uUultRULlcvhKt0IDVV3uZpxWw4IFx9MayZL88Bc37T-UlFTeAe7p0c94NvVSmeMj7dHVNZ3M9yPxrhOu30VuH4ajsTWLY_xMyQ6uF-YiFXgKCfm0pLnZ3s2VEoPw5Pg2lKV71av1ozLI9n6jpjfnjEyOJZUFSxp9Kk3d-Jw34lzQ0PSpLJHIxxyQBznB__S1koiP_kAun2jjcWomqj-T6CF4CHYLEz0dmIOeD8qoVfj0D1vkTWOw7LT66H081jtfbIjTMW4S1wQqMmePMOueRCW8AkM6vLw3VYwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB0yAqoCOgKAQEi9_cE6WOGKmNPAiYMDgAoDmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRF4g0TCLbjmNPAiYMDFZWWgwcdt8EAaLATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE%26sig%3DAOD64_2Pk8u7zC-j30m0yrUvfwB0Xcfdfg%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AE0sni8xp3MpesblZHF917Ov9CCc1l9Na7IFyb7jUtWYqdlXRnn06JVjlooOSzQF8aCLatJoFvJLSvmCNQK8dhP7o3gptXk3DZg3iEzcZVu9eZY8kwhzqYApXCW3HuWUm1y8QZ-Og2D4xSzE07lsh0h29lFYXGi0wRYuVAP1twDU3OkD4%26cry%3D1%26dbm_d%3DAKAmf-BTEodPzrPidW1BkCf5vcpi6tho64d8Y7aALyHGZ5E3P3UJ6356mahcXV25dSKZ6AQnMT89vjTWiNgz-UE9vP1PzH49karnHeDQPSrfyXGjnXXL0W4QNVIi1QCx4nymd7d-ZvF0wa935yADza7ovJP7jyMIx79b2-dgEbW4l4zrS4j__N45qgPJBBimpkKlMMgdcb7jFQ9THBc1cbv-cfDB2-NKaeBmx8zNjgS5nKVLrW6L95d7yRt8CTomdOd9enu7jP56gCquY5kX7Zkwx37upYiIb1eOYq-PcUBOZoYP3YhPxSjACNDUSoU1O3UReA5jedMLLEMAoyiMncScCYPp685cY4wCxY9UIb1yS5qt0P77lYKPtV8eWtUOLJ9Z33y18ph8zwzH17q61bmK0K-UisT1asOoFLAiapRai-SqVac8zUV8HNlPNGrtJXIUU6OJNAfPYB08Nra1JKX465QI6AfiD-4JxqCZ0YD5fR4DfwcCfibK10lDOWS_g0-bPoa27D3SZXjgGh6xir3F_9BxqoeMDrK76z5PZs6wEuyJdyGRc8bCj-eqJOamNdH2TvRpmyJDIrxCQo0F51dJPZt8-GP66g%26adurl%3D
Requested by: Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 831971612ff76150eef4c0013842bbace4aff8b515847f346a82fd365b87b520

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Tue, 12 Dec 2023 08:43:12 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4262
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 5247 38 KB
13 KB 7ms
7ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 78672
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 11 Dec 2023 10:52:00 GMT
expires: Tue, 10 Dec 2024 10:52:00 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 300x250-frame3.png
s0.2mdn.net/sadbundle/641018540181893391/ Frame EF22 8 KB
8 KB 10ms
10ms Image
image/png 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/641018540181893391/300x250-frame3.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8098f89873bf6b58ca48a2797fc926f133e128a251c9c66578ef0f8695597899

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/641018540181893391/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 02:09:49 GMT
x-content-type-options: nosniff
age: 23603
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8106
x-xss-protection: 0
last-modified: Wed, 09 Aug 2023 12:42:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 11 Dec 2024 02:09:49 GMT

GET
H3 200 300x250-frame2-iban.png
s0.2mdn.net/sadbundle/641018540181893391/ Frame EF22 13 KB
13 KB 18ms
17ms Image
image/png 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/641018540181893391/300x250-frame2-iban.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f1c34e6838e66bdeb8deeb506d6d9c52e3eaafd7e572136976c8064d625ffc66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/641018540181893391/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 23:29:41 GMT
x-content-type-options: nosniff
age: 378811
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13183
x-xss-protection: 0
last-modified: Wed, 09 Aug 2023 12:42:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 06 Dec 2024 23:29:41 GMT

GET
H3 200 300x250-frame2-phone.png
s0.2mdn.net/sadbundle/641018540181893391/ Frame EF22 32 KB
32 KB 11ms
10ms Image
image/png 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/641018540181893391/300x250-frame2-phone.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0c7cf8c8994757bcd770db5e1ab5bb2023ca625d16262d67a178fe32cfce24e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/641018540181893391/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 02:09:49 GMT
x-content-type-options: nosniff
age: 23603
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32603
x-xss-protection: 0
last-modified: Wed, 09 Aug 2023 12:42:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 11 Dec 2024 02:09:49 GMT

GET
H3 200 300x250-frame2-card.png
s0.2mdn.net/sadbundle/641018540181893391/ Frame EF22 33 KB
33 KB 14ms
14ms Image
image/png 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/641018540181893391/300x250-frame2-card.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3172d72fc88492eede463818ef095356e52a4350a052b866eb311bca2ba6ee19

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/641018540181893391/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 23:02:16 GMT
x-content-type-options: nosniff
age: 34856
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33399
x-xss-protection: 0
last-modified: Wed, 09 Aug 2023 12:42:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 10 Dec 2024 23:02:16 GMT

GET
H3 200 300x250-frame2-bg.png
s0.2mdn.net/sadbundle/641018540181893391/ Frame EF22 2 KB
2 KB 19ms
19ms Image
image/png 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/641018540181893391/300x250-frame2-bg.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d09b7f91ebcaceef1376fb04de6c7d9977118bfbe313ade191c684ac80c91fab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/641018540181893391/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 14:44:15 GMT
x-content-type-options: nosniff
age: 64737
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2411
x-xss-protection: 0
last-modified: Wed, 09 Aug 2023 12:42:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 10 Dec 2024 14:44:15 GMT

GET
H3 200 300x250-frame1_2.png
s0.2mdn.net/sadbundle/641018540181893391/ Frame EF22 8 KB
8 KB 13ms
13ms Image
image/png 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/641018540181893391/300x250-frame1_2.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

02af9ea0a3a533823c235a2b73ed42297c9e486f1320e102008ec0908ce21191

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/641018540181893391/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 23:18:29 GMT
x-content-type-options: nosniff
age: 379483
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8015
x-xss-protection: 0
last-modified: Wed, 09 Aug 2023 12:42:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 06 Dec 2024 23:18:29 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 11E6 38 KB
13 KB 10ms
7ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 78672
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 11 Dec 2023 10:52:00 GMT
expires: Tue, 10 Dec 2024 10:52:00 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request.php Show response
hal900020.redintelligence.net/ Frame C329 3 KB
2 KB 105ms
82ms Script
application/x-javascript 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900020.redintelligence.net/request.php?zone=5zyrr3xpcfb3&nw=20&renderingType=javascript&namespace=366ebc81c4&subid=&uid=1dff3dab63744665&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCeJDAHx14Ze26MpWtjuwPt4ODwAam5b2gaZ2XnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAoUuM1P2D7I-qAMByAObBKoEoQJP0DMg0QMAlOZjpdnCUVlALT0XlNT0U2xfg_Gvlwk_Yc2mYocM7OUR-uYUzQQfZyMF1bqln1WTtOG1LDz6mms2fO7gH8lT9uUultRULlcvhKt0IDVV3uZpxWw4IFx9MayZL88Bc37T-UlFTeAe7p0c94NvVSmeMj7dHVNZ3M9yPxrhOu30VuH4ajsTWLY_xMyQ6uF-YiFXgKCfm0pLnZ3s2VEoPw5Pg2lKV71av1ozLI9n6jpjfnjEyOJZUFSxp9Kk3d-Jw34lzQ0PSpLJHIxxyQBznB__S1koiP_kAun2jjcWomqj-T6CF4CHYLEz0dmIOeD8qoVfj0D1vkTWOw7LT66H081jtfbIjTMW4S1wQqMmePMOueRCW8AkM6vLw3VYwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB0yAqoCOgKAQEi9_cE6WOGKmNPAiYMDgAoDmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRF4g0TCLbjmNPAiYMDFZWWgwcdt8EAaLATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE%26sig%3DAOD64_2Pk8u7zC-j30m0yrUvfwB0Xcfdfg%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AE0sni8xp3MpesblZHF917Ov9CCc1l9Na7IFyb7jUtWYqdlXRnn06JVjlooOSzQF8aCLatJoFvJLSvmCNQK8dhP7o3gptXk3DZg3iEzcZVu9eZY8kwhzqYApXCW3HuWUm1y8QZ-Og2D4xSzE07lsh0h29lFYXGi0wRYuVAP1twDU3OkD4%26cry%3D1%26dbm_d%3DAKAmf-BTEodPzrPidW1BkCf5vcpi6tho64d8Y7aALyHGZ5E3P3UJ6356mahcXV25dSKZ6AQnMT89vjTWiNgz-UE9vP1PzH49karnHeDQPSrfyXGjnXXL0W4QNVIi1QCx4nymd7d-ZvF0wa935yADza7ovJP7jyMIx79b2-dgEbW4l4zrS4j__N45qgPJBBimpkKlMMgdcb7jFQ9THBc1cbv-cfDB2-NKaeBmx8zNjgS5nKVLrW6L95d7yRt8CTomdOd9enu7jP56gCquY5kX7Zkwx37upYiIb1eOYq-PcUBOZoYP3YhPxSjACNDUSoU1O3UReA5jedMLLEMAoyiMncScCYPp685cY4wCxY9UIb1yS5qt0P77lYKPtV8eWtUOLJ9Z33y18ph8zwzH17q61bmK0K-UisT1asOoFLAiapRai-SqVac8zUV8HNlPNGrtJXIUU6OJNAfPYB08Nra1JKX465QI6AfiD-4JxqCZ0YD5fR4DfwcCfibK10lDOWS_g0-bPoa27D3SZXjgGh6xir3F_9BxqoeMDrK76z5PZs6wEuyJdyGRc8bCj-eqJOamNdH2TvRpmyJDIrxCQo0F51dJPZt8-GP66g%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=9714897640080&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/5zyrr3xpcfb3?subid=&gdpr=&gdpr_consent=&rnd=1702370591826733&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCeJDAHx14Ze26MpWtjuwPt4ODwAam5b2gaZ2XnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAoUuM1P2D7I-qAMByAObBKoEoQJP0DMg0QMAlOZjpdnCUVlALT0XlNT0U2xfg_Gvlwk_Yc2mYocM7OUR-uYUzQQfZyMF1bqln1WTtOG1LDz6mms2fO7gH8lT9uUultRULlcvhKt0IDVV3uZpxWw4IFx9MayZL88Bc37T-UlFTeAe7p0c94NvVSmeMj7dHVNZ3M9yPxrhOu30VuH4ajsTWLY_xMyQ6uF-YiFXgKCfm0pLnZ3s2VEoPw5Pg2lKV71av1ozLI9n6jpjfnjEyOJZUFSxp9Kk3d-Jw34lzQ0PSpLJHIxxyQBznB__S1koiP_kAun2jjcWomqj-T6CF4CHYLEz0dmIOeD8qoVfj0D1vkTWOw7LT66H081jtfbIjTMW4S1wQqMmePMOueRCW8AkM6vLw3VYwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB0yAqoCOgKAQEi9_cE6WOGKmNPAiYMDgAoDmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRF4g0TCLbjmNPAiYMDFZWWgwcdt8EAaLATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE%26sig%3DAOD64_2Pk8u7zC-j30m0yrUvfwB0Xcfdfg%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AE0sni8xp3MpesblZHF917Ov9CCc1l9Na7IFyb7jUtWYqdlXRnn06JVjlooOSzQF8aCLatJoFvJLSvmCNQK8dhP7o3gptXk3DZg3iEzcZVu9eZY8kwhzqYApXCW3HuWUm1y8QZ-Og2D4xSzE07lsh0h29lFYXGi0wRYuVAP1twDU3OkD4%26cry%3D1%26dbm_d%3DAKAmf-BTEodPzrPidW1BkCf5vcpi6tho64d8Y7aALyHGZ5E3P3UJ6356mahcXV25dSKZ6AQnMT89vjTWiNgz-UE9vP1PzH49karnHeDQPSrfyXGjnXXL0W4QNVIi1QCx4nymd7d-ZvF0wa935yADza7ovJP7jyMIx79b2-dgEbW4l4zrS4j__N45qgPJBBimpkKlMMgdcb7jFQ9THBc1cbv-cfDB2-NKaeBmx8zNjgS5nKVLrW6L95d7yRt8CTomdOd9enu7jP56gCquY5kX7Zkwx37upYiIb1eOYq-PcUBOZoYP3YhPxSjACNDUSoU1O3UReA5jedMLLEMAoyiMncScCYPp685cY4wCxY9UIb1yS5qt0P77lYKPtV8eWtUOLJ9Z33y18ph8zwzH17q61bmK0K-UisT1asOoFLAiapRai-SqVac8zUV8HNlPNGrtJXIUU6OJNAfPYB08Nra1JKX465QI6AfiD-4JxqCZ0YD5fR4DfwcCfibK10lDOWS_g0-bPoa27D3SZXjgGh6xir3F_9BxqoeMDrK76z5PZs6wEuyJdyGRc8bCj-eqJOamNdH2TvRpmyJDIrxCQo0F51dJPZt8-GP66g%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: c59daabc80cdfadaeac0241e88dcbbe40018f642b3258a73e7d41831cfe2a8c3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 12 Dec 2023 08:43:12 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 69813700038159104445002012536020
Connection: close
Content-Length: 1150
Expires: Tue, 12 Dec 2023 08:43:12 +0100

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 5247 39 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 12:33:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 72577
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 10 Dec 2024 12:33:35 GMT

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 92ms
91ms Ping
image/gif 52.205.137.140
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=W4qeS5lieKiKiG8g&instance=214470769&version=7.28.2&age=231212&ldt=BIDS&key=jmgEr5Ik&c_id=12018&seq=1&order=5&vIndex=0&absoluteTime=4877.9&relativeTime=3045.4&sm_id=3233414&visiblestatecd=I&soundcd=OFF&alt=0&sC_ID=14497&load=1&status=LVFNLNIY&ac_id=2008&bidIndex=1&prebid.cid=0&prebid.bidders.appnexus.time=13.9&prebid.bidders.rubicon.time=2405.1&prebid.bidders.ix.time=25.4&prebid.bidders.triplelift.time=31.9&prebid.bidders.unruly.time=28.7&prebid.bidders.pubmatic.time=72.5&prebid.bidders.undertone.time=145.6&prebid.start=2469.7&prebid.time=2407.5&prebid.timeout=3000&adIndex=-1
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.28.2/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.205.137.140 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-137-140.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:12 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 91CA 0
20 B 45ms
44ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BQXf4IB14ZaymHNKD4gHKg66YBwAAAAA4AeAEAg&bg=!3t2l3ZLNAAY3kmNgF5I7ADQBe5WfOJmBh9GCz3tDDYj5zPdo4ZocHeTjm60bhKka9_DpWShMOMkez_e_eem3gbxja5d0AgAAAGFSAAAAAWgBB5kDKsJyZvM7UR87XjjNlpio2_MTOLdWHObt7WN5P0BU_0j_NK6DbNIWw9xT6jiNq6FERveBB2VyMkZJB1-iqs9pILV-T5fhZx65ESYm_ZQlEAEhX7_GPn5RNmtOjv9rc5GrLk06u1sqNzok9GPCrVPuSrcIvgZWPvlWhsdkHHc-WWMpz_vWDhctohwak3O--a83Pz4lg_w35BTJGfrsUOSNMPK04wOc0sc2jegxdP67AKlZnBgYVXAKzkwAuopGRt0Yd2-BWc8Q7AUUzZoYzDnfbn1xFGt3qsqZxbo6w7jy9SYwzDegp7DC0s6kNIAHafO9dAJ4L1RbLjXv6WaAoDKIHnh_sGigHnXpNxPg99zfRUimjZT0doJWBzaaAdTXX-cNx_4gbPANF9Wsw5uJMF6qK4wJyON9l6fFlvfu6cYhTObEiSZr5QYOcKxh4fyNyn3Y45S23-fV6uf-r7sKY9O29pcVPzEVqLZlVFRH04GxUsJ1VQkTUmq99C0SUzU4kdK594m31BK3R6mujUyc5GhJLk1IVs7xWrNN1iiqh1NNXuZpLfvISKqOtRJ04rRLc-epxiuWOH-d11bCFXEa4r4JXJ9Rm8JP0TKIcRj2AnBC_fVMO-kQ4aJx-gVTB0LcguzoB6CinXhRoxwwKeT3ESAdPN98yvZHEgufDQgoEzVuhm0n4uoF716ZDK9TOx8ENKExy_aMhNZfV4kkqM6tlH3tuOz4HW_GddZnMhNbKaBX6NZuoox2WY0w5qTSd9F2vgTy4N8IJ4CcymNHe7wdRn9DswlyJ8Vs8zHGluiZWVZBpdJkNT9qXTZz7PNgE8GxXx6gxXtSVXEzEA9s7dUGjQ7Wmt3k-ZRYikyOLuRp1FGXM9v6cJldsTGc4Nt6GG3i_05MJYkFeWC9u--1GUyIBUlTuoS_uYm3MG9p8jU8Bia5L3XncrE0sPUGJSkZNkIN9KQgh3T-rTGR2dSOUlqJFbq1gDTn0XbdnSeOyONWWW0zAWi5_p99pWPWVtSwtuKkDhbUM-3GwSc6Ec6bptJXUW5VkXpvmXaqjzu3F9b1l8TI3GfB7Ajhu2uIp_1m0w

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 11E6 39 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 12:33:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 72577
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 10 Dec 2024 12:33:35 GMT

GET
H2 200 e99aace94e6e58733936cdd965d03e75 Show response
pv.medialead.de/trck/epv/ Frame 42AA 0
326 B 175ms
22ms Document
application/javascript 91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=69274600041506204444994012536021&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=0027442e58&subid=&uid=fa4ae058d6ad0856&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCqgElHx14Zeq6MpWtjuwPt4ODwAam5b2gab2TnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAoUuM1P2D7I-qAMByAObBKoEogJP0Brl8u6yICIfWFz3vUgpiFGox7tXFGxqiHw6WSSMQ6pmhvX4GCGtxUhiDoK2eVA9lcVywFhGxmPlvTOnJrCEJciCRV7FXeAu4rEUmWInFi10sdmz_lJKg79MvZKEKtvVgx8Wq5xrOVy42C8Lo_fNsKKAC22eoJXi9Up1o7Td5_RqMSWiGMFgC2ESUH2ibVHPe4WlKqhqYkKU6XBvk6Mp391cS1tCBWNnpyp3RNhJmWDZ1ffMMNwM1FpY2fKd9W5ULjJh3U17Jd0RwhOm-i81oMQ_6bWSblUOgu_NanXgOQeKK4vAtsQWqq1l_9L6agu-DAWLVlEtd6umdOlfxgOG6CqIDArztuTRipExkQLazNfzHNEpM0Q4OFRmUVqIuj5vY8AE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggfCIDhgBAQARgdMgKqAjoCgEBIvf3BOljhipjTwImDA4AKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwiz45jTwImDAxWVloMHHbfBAGiwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE%26sig%3DAOD64_3VzKQJgiyuASd1ZnrUoUc6o3X6Pw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-CIVeR__uaBsS_3d-QW4988WBBL4H2Q_zpCkHp8s4ayl_emoH3jg-Ri4YfiDZmDm60hVTTyl1xQ2-xcFwHSK45OCtp3R16TbsERC1M2RzMQ6by7bm8Fh0xFgXb_ITmKLfRutkTIg_wOxVZMXItdCH3LUZQtwSOIxIu95tZ99SWxh5-OUv4%26cry%3D1%26dbm_d%3DAKAmf-AclAIkfwEWckXOw0z5ZxByty_5Np6rFAUW8dIn9ZUA3VyNkEHRMHWnG3v_JogA2szYuZ9LuUe1d2jnsT8GntsCKvoan6N-5iXBV3PDSipU0nNN6gp3QorAoly4NwqygO1VQRPLBEFy_lLQv8lL9_x9yxKIq4-g_fK6H1o1mEfAfDX5pJe-PYDgH17cQ7UhQA71rOGUIVtON8V9CXCDW9gpHknM2u0FUAE6R8iEcB8CoHUTVP86hJrwAe2I_id1BIkoWB4NWpX6FQd0M1wp44mjdfMP7zrEKB_LifT212yjTyps8p76Rwf64MlPWdTCNwhikBMWIJJAL-_6-AZWgVM0QPrb8AaCBkBV-xvpNucUox8hk_2pte7hP-xkav0jq8TZ24dHLAmqnOaqJ7e2t05xta4e-2Hw1_BFK4XNyHgtfGogakKbUT3KE8dr0zzy58c579PZzgfZ5X6OL_4XyVtHHVRXCYGOpy2GZerhawbuAVEuy10QqDbKZBV37n2A2IqsZygUdVlojiouwgDg7sSfzygPCK18I5bAeKXNmvpUEPqqmKP7XXBIsq3eXWs-uUNMkMY4rw2CjIJC8u9B5ZaSMKrgww%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=7078904564244&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.121.248.44 , France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript; charset=utf-8
date: Tue, 12 Dec 2023 08:43:12 GMT
host: pv.medialead.de
proxy-host: pv.medialead.de
server: nginx
vary: Origin

GET
H2 200 / Show response
adv.office-partner.de/ Frame 4450 930 B
923 B 42ms
8ms Document
text/html 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=0027442e58&subid=&uid=fa4ae058d6ad0856&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCqgElHx14Zeq6MpWtjuwPt4ODwAam5b2gab2TnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAoUuM1P2D7I-qAMByAObBKoEogJP0Brl8u6yICIfWFz3vUgpiFGox7tXFGxqiHw6WSSMQ6pmhvX4GCGtxUhiDoK2eVA9lcVywFhGxmPlvTOnJrCEJciCRV7FXeAu4rEUmWInFi10sdmz_lJKg79MvZKEKtvVgx8Wq5xrOVy42C8Lo_fNsKKAC22eoJXi9Up1o7Td5_RqMSWiGMFgC2ESUH2ibVHPe4WlKqhqYkKU6XBvk6Mp391cS1tCBWNnpyp3RNhJmWDZ1ffMMNwM1FpY2fKd9W5ULjJh3U17Jd0RwhOm-i81oMQ_6bWSblUOgu_NanXgOQeKK4vAtsQWqq1l_9L6agu-DAWLVlEtd6umdOlfxgOG6CqIDArztuTRipExkQLazNfzHNEpM0Q4OFRmUVqIuj5vY8AE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggfCIDhgBAQARgdMgKqAjoCgEBIvf3BOljhipjTwImDA4AKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwiz45jTwImDAxWVloMHHbfBAGiwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE%26sig%3DAOD64_3VzKQJgiyuASd1ZnrUoUc6o3X6Pw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-CIVeR__uaBsS_3d-QW4988WBBL4H2Q_zpCkHp8s4ayl_emoH3jg-Ri4YfiDZmDm60hVTTyl1xQ2-xcFwHSK45OCtp3R16TbsERC1M2RzMQ6by7bm8Fh0xFgXb_ITmKLfRutkTIg_wOxVZMXItdCH3LUZQtwSOIxIu95tZ99SWxh5-OUv4%26cry%3D1%26dbm_d%3DAKAmf-AclAIkfwEWckXOw0z5ZxByty_5Np6rFAUW8dIn9ZUA3VyNkEHRMHWnG3v_JogA2szYuZ9LuUe1d2jnsT8GntsCKvoan6N-5iXBV3PDSipU0nNN6gp3QorAoly4NwqygO1VQRPLBEFy_lLQv8lL9_x9yxKIq4-g_fK6H1o1mEfAfDX5pJe-PYDgH17cQ7UhQA71rOGUIVtON8V9CXCDW9gpHknM2u0FUAE6R8iEcB8CoHUTVP86hJrwAe2I_id1BIkoWB4NWpX6FQd0M1wp44mjdfMP7zrEKB_LifT212yjTyps8p76Rwf64MlPWdTCNwhikBMWIJJAL-_6-AZWgVM0QPrb8AaCBkBV-xvpNucUox8hk_2pte7hP-xkav0jq8TZ24dHLAmqnOaqJ7e2t05xta4e-2Hw1_BFK4XNyHgtfGogakKbUT3KE8dr0zzy58c579PZzgfZ5X6OL_4XyVtHHVRXCYGOpy2GZerhawbuAVEuy10QqDbKZBV37n2A2IqsZygUdVlojiouwgDg7sSfzygPCK18I5bAeKXNmvpUEPqqmKP7XXBIsq3eXWs-uUNMkMY4rw2CjIJC8u9B5ZaSMKrgww%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=7078904564244&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Tue, 12 Dec 2023 08:43:12 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Tue, 19 Dec 2023 08:43:12 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2

200

htlp Show response
futalis.de/ Frame 6B97
Redirect Chain

https://cdn.retailads.net/tb.php?t=150337V2172132532M&subid=69274600041506204444994012536021&ra_cnt_active=1&ra_cnt=1
https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3380147188

350 B
400 B

27ms
10ms

Document
text/html

167.233.14.134
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3380147188
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=0027442e58&subid=&uid=fa4ae058d6ad0856&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCqgElHx14Zeq6MpWtjuwPt4ODwAam5b2gab2TnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAoUuM1P2D7I-qAMByAObBKoEogJP0Brl8u6yICIfWFz3vUgpiFGox7tXFGxqiHw6WSSMQ6pmhvX4GCGtxUhiDoK2eVA9lcVywFhGxmPlvTOnJrCEJciCRV7FXeAu4rEUmWInFi10sdmz_lJKg79MvZKEKtvVgx8Wq5xrOVy42C8Lo_fNsKKAC22eoJXi9Up1o7Td5_RqMSWiGMFgC2ESUH2ibVHPe4WlKqhqYkKU6XBvk6Mp391cS1tCBWNnpyp3RNhJmWDZ1ffMMNwM1FpY2fKd9W5ULjJh3U17Jd0RwhOm-i81oMQ_6bWSblUOgu_NanXgOQeKK4vAtsQWqq1l_9L6agu-DAWLVlEtd6umdOlfxgOG6CqIDArztuTRipExkQLazNfzHNEpM0Q4OFRmUVqIuj5vY8AE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggfCIDhgBAQARgdMgKqAjoCgEBIvf3BOljhipjTwImDA4AKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwiz45jTwImDAxWVloMHHbfBAGiwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE%26sig%3DAOD64_3VzKQJgiyuASd1ZnrUoUc6o3X6Pw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-CIVeR__uaBsS_3d-QW4988WBBL4H2Q_zpCkHp8s4ayl_emoH3jg-Ri4YfiDZmDm60hVTTyl1xQ2-xcFwHSK45OCtp3R16TbsERC1M2RzMQ6by7bm8Fh0xFgXb_ITmKLfRutkTIg_wOxVZMXItdCH3LUZQtwSOIxIu95tZ99SWxh5-OUv4%26cry%3D1%26dbm_d%3DAKAmf-AclAIkfwEWckXOw0z5ZxByty_5Np6rFAUW8dIn9ZUA3VyNkEHRMHWnG3v_JogA2szYuZ9LuUe1d2jnsT8GntsCKvoan6N-5iXBV3PDSipU0nNN6gp3QorAoly4NwqygO1VQRPLBEFy_lLQv8lL9_x9yxKIq4-g_fK6H1o1mEfAfDX5pJe-PYDgH17cQ7UhQA71rOGUIVtON8V9CXCDW9gpHknM2u0FUAE6R8iEcB8CoHUTVP86hJrwAe2I_id1BIkoWB4NWpX6FQd0M1wp44mjdfMP7zrEKB_LifT212yjTyps8p76Rwf64MlPWdTCNwhikBMWIJJAL-_6-AZWgVM0QPrb8AaCBkBV-xvpNucUox8hk_2pte7hP-xkav0jq8TZ24dHLAmqnOaqJ7e2t05xta4e-2Hw1_BFK4XNyHgtfGogakKbUT3KE8dr0zzy58c579PZzgfZ5X6OL_4XyVtHHVRXCYGOpy2GZerhawbuAVEuy10QqDbKZBV37n2A2IqsZygUdVlojiouwgDg7sSfzygPCK18I5bAeKXNmvpUEPqqmKP7XXBIsq3eXWs-uUNMkMY4rw2CjIJC8u9B5ZaSMKrgww%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=7078904564244&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 167.233.14.134 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: lb-2.futalis.de
Software: /
Resource Hash: 582e283baa4cce4006055beb2eb8fe257c1ec5ef573a40f173b880636089e8cd

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 350
content-type: text/html; charset=utf-8

Redirect headers

content-length: 0
content-type: text/html; charset=utf-8
date: Tue, 12 Dec 2023 08:43:12 GMT
location: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3380147188
p3p: policyref="https://www.retailads.net/w3c/p3p.xml",CP="NOI CUR OUR STP"
server: Apache
xphp81: true

GET
H2 200 e99aace94e6e58733936cdd965d03e75 Show response
pv.medialead.de/trck/epv/ Frame 3AFE 0
327 B 172ms
20ms Script
application/javascript 91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=69274600041506204444994012536021&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=0027442e58&subid=&uid=fa4ae058d6ad0856&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCqgElHx14Zeq6MpWtjuwPt4ODwAam5b2gab2TnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAoUuM1P2D7I-qAMByAObBKoEogJP0Brl8u6yICIfWFz3vUgpiFGox7tXFGxqiHw6WSSMQ6pmhvX4GCGtxUhiDoK2eVA9lcVywFhGxmPlvTOnJrCEJciCRV7FXeAu4rEUmWInFi10sdmz_lJKg79MvZKEKtvVgx8Wq5xrOVy42C8Lo_fNsKKAC22eoJXi9Up1o7Td5_RqMSWiGMFgC2ESUH2ibVHPe4WlKqhqYkKU6XBvk6Mp391cS1tCBWNnpyp3RNhJmWDZ1ffMMNwM1FpY2fKd9W5ULjJh3U17Jd0RwhOm-i81oMQ_6bWSblUOgu_NanXgOQeKK4vAtsQWqq1l_9L6agu-DAWLVlEtd6umdOlfxgOG6CqIDArztuTRipExkQLazNfzHNEpM0Q4OFRmUVqIuj5vY8AE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggfCIDhgBAQARgdMgKqAjoCgEBIvf3BOljhipjTwImDA4AKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwiz45jTwImDAxWVloMHHbfBAGiwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE%26sig%3DAOD64_3VzKQJgiyuASd1ZnrUoUc6o3X6Pw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-CIVeR__uaBsS_3d-QW4988WBBL4H2Q_zpCkHp8s4ayl_emoH3jg-Ri4YfiDZmDm60hVTTyl1xQ2-xcFwHSK45OCtp3R16TbsERC1M2RzMQ6by7bm8Fh0xFgXb_ITmKLfRutkTIg_wOxVZMXItdCH3LUZQtwSOIxIu95tZ99SWxh5-OUv4%26cry%3D1%26dbm_d%3DAKAmf-AclAIkfwEWckXOw0z5ZxByty_5Np6rFAUW8dIn9ZUA3VyNkEHRMHWnG3v_JogA2szYuZ9LuUe1d2jnsT8GntsCKvoan6N-5iXBV3PDSipU0nNN6gp3QorAoly4NwqygO1VQRPLBEFy_lLQv8lL9_x9yxKIq4-g_fK6H1o1mEfAfDX5pJe-PYDgH17cQ7UhQA71rOGUIVtON8V9CXCDW9gpHknM2u0FUAE6R8iEcB8CoHUTVP86hJrwAe2I_id1BIkoWB4NWpX6FQd0M1wp44mjdfMP7zrEKB_LifT212yjTyps8p76Rwf64MlPWdTCNwhikBMWIJJAL-_6-AZWgVM0QPrb8AaCBkBV-xvpNucUox8hk_2pte7hP-xkav0jq8TZ24dHLAmqnOaqJ7e2t05xta4e-2Hw1_BFK4XNyHgtfGogakKbUT3KE8dr0zzy58c579PZzgfZ5X6OL_4XyVtHHVRXCYGOpy2GZerhawbuAVEuy10QqDbKZBV37n2A2IqsZygUdVlojiouwgDg7sSfzygPCK18I5bAeKXNmvpUEPqqmKP7XXBIsq3eXWs-uUNMkMY4rw2CjIJC8u9B5ZaSMKrgww%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=7078904564244&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.121.248.44 , France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:12 GMT
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx
host: pv.medialead.de
vary: Origin
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
content-length: 0
proxy-host: pv.medialead.de

GET
H2 200 e99aace94e6e58733936cdd965d03e75
pv.medialead.de/trck/eview/ Frame 3AFE 43 B
360 B 173ms
21ms Image
image/gif 91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pv.medialead.de/trck/eview/e99aace94e6e58733936cdd965d03e75?subid=69274600041506204444994012536021&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=0027442e58&subid=&uid=fa4ae058d6ad0856&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCqgElHx14Zeq6MpWtjuwPt4ODwAam5b2gab2TnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAoUuM1P2D7I-qAMByAObBKoEogJP0Brl8u6yICIfWFz3vUgpiFGox7tXFGxqiHw6WSSMQ6pmhvX4GCGtxUhiDoK2eVA9lcVywFhGxmPlvTOnJrCEJciCRV7FXeAu4rEUmWInFi10sdmz_lJKg79MvZKEKtvVgx8Wq5xrOVy42C8Lo_fNsKKAC22eoJXi9Up1o7Td5_RqMSWiGMFgC2ESUH2ibVHPe4WlKqhqYkKU6XBvk6Mp391cS1tCBWNnpyp3RNhJmWDZ1ffMMNwM1FpY2fKd9W5ULjJh3U17Jd0RwhOm-i81oMQ_6bWSblUOgu_NanXgOQeKK4vAtsQWqq1l_9L6agu-DAWLVlEtd6umdOlfxgOG6CqIDArztuTRipExkQLazNfzHNEpM0Q4OFRmUVqIuj5vY8AE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggfCIDhgBAQARgdMgKqAjoCgEBIvf3BOljhipjTwImDA4AKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwiz45jTwImDAxWVloMHHbfBAGiwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE%26sig%3DAOD64_3VzKQJgiyuASd1ZnrUoUc6o3X6Pw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-CIVeR__uaBsS_3d-QW4988WBBL4H2Q_zpCkHp8s4ayl_emoH3jg-Ri4YfiDZmDm60hVTTyl1xQ2-xcFwHSK45OCtp3R16TbsERC1M2RzMQ6by7bm8Fh0xFgXb_ITmKLfRutkTIg_wOxVZMXItdCH3LUZQtwSOIxIu95tZ99SWxh5-OUv4%26cry%3D1%26dbm_d%3DAKAmf-AclAIkfwEWckXOw0z5ZxByty_5Np6rFAUW8dIn9ZUA3VyNkEHRMHWnG3v_JogA2szYuZ9LuUe1d2jnsT8GntsCKvoan6N-5iXBV3PDSipU0nNN6gp3QorAoly4NwqygO1VQRPLBEFy_lLQv8lL9_x9yxKIq4-g_fK6H1o1mEfAfDX5pJe-PYDgH17cQ7UhQA71rOGUIVtON8V9CXCDW9gpHknM2u0FUAE6R8iEcB8CoHUTVP86hJrwAe2I_id1BIkoWB4NWpX6FQd0M1wp44mjdfMP7zrEKB_LifT212yjTyps8p76Rwf64MlPWdTCNwhikBMWIJJAL-_6-AZWgVM0QPrb8AaCBkBV-xvpNucUox8hk_2pte7hP-xkav0jq8TZ24dHLAmqnOaqJ7e2t05xta4e-2Hw1_BFK4XNyHgtfGogakKbUT3KE8dr0zzy58c579PZzgfZ5X6OL_4XyVtHHVRXCYGOpy2GZerhawbuAVEuy10QqDbKZBV37n2A2IqsZygUdVlojiouwgDg7sSfzygPCK18I5bAeKXNmvpUEPqqmKP7XXBIsq3eXWs-uUNMkMY4rw2CjIJC8u9B5ZaSMKrgww%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=7078904564244&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.121.248.44 , France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:12 GMT
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx
host: pv.medialead.de
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
content-length: 43
proxy-host: pv.medialead.de

GET
H3 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame F896 156 B
143 B 249ms
224ms XHR
text/xml 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?slotname=%2F92056281%2Fsimcast.com-premium&sz=480x270&ciu_szs=300x60&cust_params=sessionKey%3D214470769-W4qeS5lieKiKiG8g%26schain%3Dstnvideo.com%2CVRAfdwVZOg7jMyH8bxgoOA%26content%3D14497%26placementType%3DPremium%26embed%3DjmgEr5Ik%26domain%3Dsimcast.com%26player_size%3Dlarge%26player_width%3D761%26player_height%3D428%26player_type%3Dfloat%26smartmatch%3Dno%26version%3D7.28.2%26player_status%3DLVFNLNIY%26play_code%3D2008%26view100%3D1%26excl_cat%3Dstl_id00488%26rand%3D12%26uhr%3D09%26us_privacy%3Dfalse%26keywchk%3Dok&url=https%3A%2F%2Fsimcast.com%2F&unviewed_position_start=1&output=xml_vast4&env=vp&gdfp_req=1&ad_rule=0&video_url_to_fetch=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvinpearll-resort.ph%26pcid%3D48%26rid%3D112%26a%3D0&useragent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F120.0.6099.71%20Safari%2F537.36%2Cgzip(gfe)&vad_type=linear&vpos=preroll&pod=1&ppos=1&lip=true&min_ad_duration=0&max_ad_duration=250000&vrid=1263268&us_privacy=false&hl=en&cmsid=2631244&plcmt=2&vconp=2&video_doc_id=3233414&vpa=auto&vpmute=1&cnc=22632072816&kfa=0&tfcd=0&sdkv=h.3.608.2&osd=2&frm=0&vis=1&sdr=1&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&u_so=l&ctv=0&mpt=stnvideo%2Fplayer&sdki=445&ptt=20&adk=2858638697&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.608.2&sid=5FADFCCE-13FC-4F3E-B489-4154A4710F10&a3p=EhsKDDMzYWNyb3NzLmNvbRiCicfpxTFIAFICCG8SGAoJeWFob28uY29tGLWIx-nFMUgAUgIIbxIZCgp1aWRhcGkuY29tGIWIx-nFMUgAUgIIbxIbCgxpZDUtc3luYy5jb20YhYjH6cUxSABSAghvEhkKCmNyaXRlby5jb20YhYjH6cUxSABSAghvEhwKDWNyd2RjbnRybC5uZXQYhYjH6cUxSABSAghvEjsKCnB1YmNpZC5vcmcSJDQ1YjY0YWIwLTIxZDQtNDgwOS05MmIyLWIwMmIxMDkyODVhMxiFiMfpxTFIABIdCg5lc3AuY3JpdGVvLmNvbRj5h8fpxTFIAFICCGQSggIKCHJ0YmhvdXNlEuwBaGxyU0lsYldiR0kyUHdoSGJZV3hKaFc0TVJSQWRwRTEwVWFtTnBFN2t0dUhNWjJNYTJlUnBpaEp3M2FEbUVZNnJhWVh6eG1LeGZwc0k3OXd4bEViWml2ZlNrTXJiTWthVVhySFhyT1ZaSGpvSUJ1emJaSFBhM3F4cWZvVUpZa1BoakNKWUVGcG12S0d4YXNLWW1zRFJwQ3dnZG1yRDhpUTcxdmpDQTd1Uk9PeFIwQWF3TXEzeWpTazlzTWx2V2dBa2F2bjBQdFZtRURIVkxjVTUxMVc2U3pQRjZmNUVWRCs5Vkt3US8rRkJyYz0YkInH6cUxSAASPgoFb3BlbngSLGV5SnBJam9pZDNRNWIwdEliMGxTYXpKUmNIVlFSMVExUmxKS2R6MDlJbjA9GLyKx-nFMUgAEhsKDGxpdmVyYW1wLmNvbRiFiMfpxTFIAFICCG8SHQoObGl2ZWludGVudC5jb20YhYjH6cUxSABSAghv&nel=0&eid=44772139%2C44777649%2C44781409%2C44804291%2C44809548&ref=http%3A%2F%2Fwww.vinpearll-resort.ph%2F&top=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvinpearll-resort.ph%26pcid%3D48%26rid%3D112%26a%3D0&loc=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvinpearll-resort.ph%26pcid%3D48%26rid%3D112%26a%3D0&dlt=1702370589093&idt=1064&dt=1702370592783&cookie=ID%3D66fb6c22fc3a9635%3AT%3D1702370591%3ART%3D1702370591%3AS%3DALNI_MZfkuKH80pSF1_wip-yIKt6kIED3g&gpic=UID%3D00000d13d15adb7c%3AT%3D1702370591%3ART%3D1702370591%3AS%3DALNI_MY9JyekvrIrLvDkoduC0JaTpgV3-w&correlator=4095172922223013&scor=4145842940457260&ged=ve4_td4_tt3_pd4_la4000_er0.0.0.0_vi0.0.1200.1600_vp0_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.608.2_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:13 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CEA4 0
20 B 45ms
45ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B0TgFIB14ZcWSHYS1juwPrvm38A0AAAAAOAHgBAI&bg=!JCelJ2jNAAY3kmNgF5I7ADQBe5WfOCbHbl09j_yKMbg5WNKMKrluzu3OvKAp0haNpjRQCQQ7CbzLDRa30WkQvlSkWhKFAgAAAHFSAAAAAWgBB5kDSICrnzMe6QDbuqDdOwa7lpY5-fW9kWM6hDJvX3qJ6jHAF1JTWrokG8IGTXIsTMmxutdSQSvaijZCChjzT-VXTshHNMsxHwj2ljHsCsMpOAUaLdxG3xkWGV9juYmJ6djpXoivc6sr7KAJWZAIpuxi2oI4ul0a4yVdxmODBQUimm-C4FgQXXu5cZceMb-0dP0N8h8S1BV7k9rQzqOvbDpLQm2zqdSU3Bz2Kn9lp0QQk74lC9QUOLMx-uGbt2WlMbqzdRbMvkmJOQFdk3bOkcmLc7BSwUdxrYQTFp4tiw0sz6ytYc8lUAlsfpU5lNUVE3JAaVJpygjSabAxSJQBq6pnjstNRTP_DDKeq4G8ndKBpRIzXvInHaKxTndlPAR92dJd7JzzlZXVAvixs_TPiNwqVZ_1JIQU9G4_-_mcp4o4z9l4Shn9Wf8PYwA6z6G7lQqmtoP6n3iUlikY2ViNBJzlLIX9J_ytXTgolFy1ib1me5hvcPdIF29HkYgSlONEzBQBpsOrChjlSG_ANXMGZ850MVYvaCKd7lpg_RTT0g3zN63H58ABhyywHeNMCzJ0i0sDuiCl32L8Yk0mYDOiFRlIewZyGV_GynJB2agRedbrc4fgr-6FNRHGMGXEUFXS1n12nfOYijjC8D66SoraM_Na8k0y2Cgum06jfl4p5-rttpOvZJtMonzAdwBsIcq1QuIn2qOM7vbR29ec06JFql0A83XL7_IYnqEI2jX-x_raAj74bHtDg1zFVHUvo0G6_CSD91tZAwTmJjRl0ompewzC2le8ufTZzlT3ErtyeoXjJ7XY966Ix1WFV-FKdr7tTzBNx6w8hFe2TUoWIjaU4QsEX3C4EfrBriMjp-ST9Wk7oYCV_lMiUCmoSvoL2l84MksSTDKK_cwax3pLUsJlCWklsxnPGQtWfrM15FToNVNr-mJQay8Q6JvvMMqsh7UucQ4K_jMy0Zo0--V6bd9iwPb0-XhrWhZH_5Au0m-sY2CCSdD-4ins2n315ZzjrmjKKpzvXZAmrKIryiCxR3GXEIIra80OeTut8YZcrc9gbTc3VZ1wyIPdVVbIYrVlUend6ZtpaHEW0qIQoYDqYS0XF-puN26IJEmwi-GS8g

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 e99aace94e6e5873881d3400993e1e7e Show response
pv.medialead.de/trck/epv/ Frame AB63 0
326 B 146ms
21ms Document
application/javascript 91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=41235600036525004444550012536002&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=521027e4f6&subid=&uid=d94421509a5a6413&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCV8xDHx14Zey6MpWtjuwPt4ODwAam5b2gaYWVnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAoUuM1P2D7I-qAMByAObBKoEoQJP0AlIqICRquBqaoi4iWD8GmY68-pHrMd_GT6DROFSudQ6VW6gD4rxHvQO47SnCD0iSlGzZ9swulG0CH7khnaTd6f-FyI7GmjOaEJ2QKCnDsik9Z_WiYfo18rBFZh-4_FGEzsX8sjrsWswz0yQNJ6SDnGlFiMWShv7M6p75A337mc3SJO63v16wdT3uHuSGmacROiI98Ls2AOTprs2pnoViyk9J_wiGcKPhT3FI-3e3mlFKo18x4anR46QG2A6ZA3jTdf20y2dJ8SuS9HBXoiJQAD53ZBEaLLi3dRn4opuuD8vOYk6aW0sryZB4FLc43gt-EjMYCXMUAeu9rniuFwnuegONQA91jJ4OK-XgF1KEmrVDdJAnQaEF6my6-LBukomwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB0yAqoCOgKAQEi9_cE6WOGKmNPAiYMDgAoDmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRF4g0TCLXjmNPAiYMDFZWWgwcdt8EAaLATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE%26sig%3DAOD64_0wsKVTamJ4BRwlByguW2MrrYj3sQ%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-BRuRKJn9aCu1uGxhyQGGn5hj7w7r_XTY27McErsmWGK4TAiJ9Qu0tAt0FFE2DLdhFGGutIhFiP1tSQbOJWVr6Wk328URx6GYqPcxy7enL_-6bjs4epKWXW_lHxD5VjZHNpqkWTPbncFPUeJQ82I4w6DYrfjcCayClb24Wg12HumwK2vZI%26cry%3D1%26dbm_d%3DAKAmf-CgOECBy6ajciMYkH7Rs74IhCkvYYMNaD47IytXwG2LkIljLErXPX2jxdAMDX3i3TuU5Nw1hcvanL62uIr9YanzwYuNTOksdfHTNXZz8jDUe6fuady7IC5QsH9_wDV2F3pj7wR672p6p7S6JDcNYtu0JPxvGuAoAU-sJQwcwklx3S-8RebCTS57qjuEnFVfL7VTaf2PA1cNY9fiptd-N6t_nbLjBItytolUgwhMCkU4V-NR4NXJge5QlGuTECbXdbet5WLoic9X4lwSvTikl_uiw9q5OJ0f6Qh4ttRSdwz0AIluc8MI9xtX3RNAzKfskY2nZxNLB3YJT1QreTYLcaprEEU-7_RlmqfkygD1bNMoIXgMkzC5MrEt7tN16j4MQcEOc5sjb8j0f7Fvpf7oIFpvJCtgSvqSIE5Ey5kFiu_8AVbSDlYu5qDMhUQGFBqdeo0GzvuDLzbe_SZaYFnRPR_NxgJMKUPuFeoFDRLyP-IS5fmfiR220gzZxVzI8EP5msjcWkqwTN8h3pwd0gx_ahLpHTsO1HbVEimoupSg3jOysC37-_kcxLwJn4pJwqhFIetM1xv-qHPvMZuAvfWpjNlDLpZyLw%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=8731175614677&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.121.248.44 , France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"17200521800104416","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript; charset=utf-8
date: Tue, 12 Dec 2023 08:43:12 GMT
host: pv.medialead.de
proxy-host: pv.medialead.de
server: nginx
vary: Origin

GET
H2 200 / Show response
adv.office-partner.de/ Frame 28C6 930 B
922 B 16ms
9ms Document
text/html 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=521027e4f6&subid=&uid=d94421509a5a6413&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCV8xDHx14Zey6MpWtjuwPt4ODwAam5b2gaYWVnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAoUuM1P2D7I-qAMByAObBKoEoQJP0AlIqICRquBqaoi4iWD8GmY68-pHrMd_GT6DROFSudQ6VW6gD4rxHvQO47SnCD0iSlGzZ9swulG0CH7khnaTd6f-FyI7GmjOaEJ2QKCnDsik9Z_WiYfo18rBFZh-4_FGEzsX8sjrsWswz0yQNJ6SDnGlFiMWShv7M6p75A337mc3SJO63v16wdT3uHuSGmacROiI98Ls2AOTprs2pnoViyk9J_wiGcKPhT3FI-3e3mlFKo18x4anR46QG2A6ZA3jTdf20y2dJ8SuS9HBXoiJQAD53ZBEaLLi3dRn4opuuD8vOYk6aW0sryZB4FLc43gt-EjMYCXMUAeu9rniuFwnuegONQA91jJ4OK-XgF1KEmrVDdJAnQaEF6my6-LBukomwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB0yAqoCOgKAQEi9_cE6WOGKmNPAiYMDgAoDmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRF4g0TCLXjmNPAiYMDFZWWgwcdt8EAaLATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE%26sig%3DAOD64_0wsKVTamJ4BRwlByguW2MrrYj3sQ%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-BRuRKJn9aCu1uGxhyQGGn5hj7w7r_XTY27McErsmWGK4TAiJ9Qu0tAt0FFE2DLdhFGGutIhFiP1tSQbOJWVr6Wk328URx6GYqPcxy7enL_-6bjs4epKWXW_lHxD5VjZHNpqkWTPbncFPUeJQ82I4w6DYrfjcCayClb24Wg12HumwK2vZI%26cry%3D1%26dbm_d%3DAKAmf-CgOECBy6ajciMYkH7Rs74IhCkvYYMNaD47IytXwG2LkIljLErXPX2jxdAMDX3i3TuU5Nw1hcvanL62uIr9YanzwYuNTOksdfHTNXZz8jDUe6fuady7IC5QsH9_wDV2F3pj7wR672p6p7S6JDcNYtu0JPxvGuAoAU-sJQwcwklx3S-8RebCTS57qjuEnFVfL7VTaf2PA1cNY9fiptd-N6t_nbLjBItytolUgwhMCkU4V-NR4NXJge5QlGuTECbXdbet5WLoic9X4lwSvTikl_uiw9q5OJ0f6Qh4ttRSdwz0AIluc8MI9xtX3RNAzKfskY2nZxNLB3YJT1QreTYLcaprEEU-7_RlmqfkygD1bNMoIXgMkzC5MrEt7tN16j4MQcEOc5sjb8j0f7Fvpf7oIFpvJCtgSvqSIE5Ey5kFiu_8AVbSDlYu5qDMhUQGFBqdeo0GzvuDLzbe_SZaYFnRPR_NxgJMKUPuFeoFDRLyP-IS5fmfiR220gzZxVzI8EP5msjcWkqwTN8h3pwd0gx_ahLpHTsO1HbVEimoupSg3jOysC37-_kcxLwJn4pJwqhFIetM1xv-qHPvMZuAvfWpjNlDLpZyLw%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=8731175614677&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Tue, 12 Dec 2023 08:43:12 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Tue, 19 Dec 2023 08:43:12 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2

200

htlp Show response
futalis.de/ Frame 75BE
Redirect Chain

https://cdn.retailads.net/tb.php?t=150337V2172132532M&subid=41235600036525004444550012536002&ra_cnt_active=1&ra_cnt=1
https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3380147190

350 B
401 B

9ms
6ms

Document
text/html

167.233.14.134
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3380147190
Requested by: Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=521027e4f6&subid=&uid=d94421509a5a6413&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCV8xDHx14Zey6MpWtjuwPt4ODwAam5b2gaYWVnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAoUuM1P2D7I-qAMByAObBKoEoQJP0AlIqICRquBqaoi4iWD8GmY68-pHrMd_GT6DROFSudQ6VW6gD4rxHvQO47SnCD0iSlGzZ9swulG0CH7khnaTd6f-FyI7GmjOaEJ2QKCnDsik9Z_WiYfo18rBFZh-4_FGEzsX8sjrsWswz0yQNJ6SDnGlFiMWShv7M6p75A337mc3SJO63v16wdT3uHuSGmacROiI98Ls2AOTprs2pnoViyk9J_wiGcKPhT3FI-3e3mlFKo18x4anR46QG2A6ZA3jTdf20y2dJ8SuS9HBXoiJQAD53ZBEaLLi3dRn4opuuD8vOYk6aW0sryZB4FLc43gt-EjMYCXMUAeu9rniuFwnuegONQA91jJ4OK-XgF1KEmrVDdJAnQaEF6my6-LBukomwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB0yAqoCOgKAQEi9_cE6WOGKmNPAiYMDgAoDmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRF4g0TCLXjmNPAiYMDFZWWgwcdt8EAaLATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE%26sig%3DAOD64_0wsKVTamJ4BRwlByguW2MrrYj3sQ%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-BRuRKJn9aCu1uGxhyQGGn5hj7w7r_XTY27McErsmWGK4TAiJ9Qu0tAt0FFE2DLdhFGGutIhFiP1tSQbOJWVr6Wk328URx6GYqPcxy7enL_-6bjs4epKWXW_lHxD5VjZHNpqkWTPbncFPUeJQ82I4w6DYrfjcCayClb24Wg12HumwK2vZI%26cry%3D1%26dbm_d%3DAKAmf-CgOECBy6ajciMYkH7Rs74IhCkvYYMNaD47IytXwG2LkIljLErXPX2jxdAMDX3i3TuU5Nw1hcvanL62uIr9YanzwYuNTOksdfHTNXZz8jDUe6fuady7IC5QsH9_wDV2F3pj7wR672p6p7S6JDcNYtu0JPxvGuAoAU-sJQwcwklx3S-8RebCTS57qjuEnFVfL7VTaf2PA1cNY9fiptd-N6t_nbLjBItytolUgwhMCkU4V-NR4NXJge5QlGuTECbXdbet5WLoic9X4lwSvTikl_uiw9q5OJ0f6Qh4ttRSdwz0AIluc8MI9xtX3RNAzKfskY2nZxNLB3YJT1QreTYLcaprEEU-7_RlmqfkygD1bNMoIXgMkzC5MrEt7tN16j4MQcEOc5sjb8j0f7Fvpf7oIFpvJCtgSvqSIE5Ey5kFiu_8AVbSDlYu5qDMhUQGFBqdeo0GzvuDLzbe_SZaYFnRPR_NxgJMKUPuFeoFDRLyP-IS5fmfiR220gzZxVzI8EP5msjcWkqwTN8h3pwd0gx_ahLpHTsO1HbVEimoupSg3jOysC37-_kcxLwJn4pJwqhFIetM1xv-qHPvMZuAvfWpjNlDLpZyLw%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=8731175614677&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 167.233.14.134 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: lb-2.futalis.de
Software: /
Resource Hash: 582e283baa4cce4006055beb2eb8fe257c1ec5ef573a40f173b880636089e8cd

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 350
content-type: text/html; charset=utf-8

Redirect headers

content-length: 0
content-type: text/html; charset=utf-8
date: Tue, 12 Dec 2023 08:43:12 GMT
location: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3380147190
p3p: policyref="https://www.retailads.net/w3c/p3p.xml",CP="NOI CUR OUR STP"
server: Apache
xphp81: true

GET
H2 200 link.html Show response
track.webgains.com/ Frame 6536 2 KB
2 KB 139ms
67ms Script
text/html 13.43.203.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=41235600036525004444550012536002&nw=1
Requested by: Host: www.vinpearll-resort.ph
URL: http://www.vinpearll-resort.ph/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.43.203.41 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-43-203-41.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 976c98b5b69deedb53fbb85447f5e9e60aa5d35592e835a7b24a0b2530c447d7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:12 GMT
last-modified: Tue, 12 Dec 2023 08:43:12 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Tue, 12 Dec 2023 08:44:12 GMT

GET
H2

200

activityi;dc_pre=CJeW3dPAiYMDFR0NogMdHgMLMg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8226031561868.083 Show response
5994599.fls.doubleclick.net/ Frame 4377
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8226031561868.083?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CJeW3dPAiYMDFR0NogMdHgMLMg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8226031561868.083?

391 B
326 B

52ms
52ms

Document
text/html

216.58.206.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CJeW3dPAiYMDFR0NogMdHgMLMg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8226031561868.083?

Requested by

Host: www.vinpearll-resort.ph
URL: http://www.vinpearll-resort.ph/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil07s07-in-f6.1e100.net

Software

cafe /

Resource Hash

cf7082160e07b671dd8963fca3186f1d1e5d79d63b60e73f5d30d62c3827b2a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 217
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 12 Dec 2023 08:43:12 GMT
expires: Tue, 12 Dec 2023 08:43:12 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 12 Dec 2023 08:43:12 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CJeW3dPAiYMDFR0NogMdHgMLMg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8226031561868.083?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal90002.redintelligence.net/ Frame 3848 7 KB
2 KB 21ms
8ms Document
text/html 46.4.10.47
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90002.redintelligence.net/request_content.php?s=41235600036525004444550012536002&a=9111ab7a
Requested by: Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=521027e4f6&subid=&uid=d94421509a5a6413&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCV8xDHx14Zey6MpWtjuwPt4ODwAam5b2gaYWVnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAoUuM1P2D7I-qAMByAObBKoEoQJP0AlIqICRquBqaoi4iWD8GmY68-pHrMd_GT6DROFSudQ6VW6gD4rxHvQO47SnCD0iSlGzZ9swulG0CH7khnaTd6f-FyI7GmjOaEJ2QKCnDsik9Z_WiYfo18rBFZh-4_FGEzsX8sjrsWswz0yQNJ6SDnGlFiMWShv7M6p75A337mc3SJO63v16wdT3uHuSGmacROiI98Ls2AOTprs2pnoViyk9J_wiGcKPhT3FI-3e3mlFKo18x4anR46QG2A6ZA3jTdf20y2dJ8SuS9HBXoiJQAD53ZBEaLLi3dRn4opuuD8vOYk6aW0sryZB4FLc43gt-EjMYCXMUAeu9rniuFwnuegONQA91jJ4OK-XgF1KEmrVDdJAnQaEF6my6-LBukomwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB0yAqoCOgKAQEi9_cE6WOGKmNPAiYMDgAoDmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRF4g0TCLXjmNPAiYMDFZWWgwcdt8EAaLATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE%26sig%3DAOD64_0wsKVTamJ4BRwlByguW2MrrYj3sQ%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-BRuRKJn9aCu1uGxhyQGGn5hj7w7r_XTY27McErsmWGK4TAiJ9Qu0tAt0FFE2DLdhFGGutIhFiP1tSQbOJWVr6Wk328URx6GYqPcxy7enL_-6bjs4epKWXW_lHxD5VjZHNpqkWTPbncFPUeJQ82I4w6DYrfjcCayClb24Wg12HumwK2vZI%26cry%3D1%26dbm_d%3DAKAmf-CgOECBy6ajciMYkH7Rs74IhCkvYYMNaD47IytXwG2LkIljLErXPX2jxdAMDX3i3TuU5Nw1hcvanL62uIr9YanzwYuNTOksdfHTNXZz8jDUe6fuady7IC5QsH9_wDV2F3pj7wR672p6p7S6JDcNYtu0JPxvGuAoAU-sJQwcwklx3S-8RebCTS57qjuEnFVfL7VTaf2PA1cNY9fiptd-N6t_nbLjBItytolUgwhMCkU4V-NR4NXJge5QlGuTECbXdbet5WLoic9X4lwSvTikl_uiw9q5OJ0f6Qh4ttRSdwz0AIluc8MI9xtX3RNAzKfskY2nZxNLB3YJT1QreTYLcaprEEU-7_RlmqfkygD1bNMoIXgMkzC5MrEt7tN16j4MQcEOc5sjb8j0f7Fvpf7oIFpvJCtgSvqSIE5Ey5kFiu_8AVbSDlYu5qDMhUQGFBqdeo0GzvuDLzbe_SZaYFnRPR_NxgJMKUPuFeoFDRLyP-IS5fmfiR220gzZxVzI8EP5msjcWkqwTN8h3pwd0gx_ahLpHTsO1HbVEimoupSg3jOysC37-_kcxLwJn4pJwqhFIetM1xv-qHPvMZuAvfWpjNlDLpZyLw%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=8731175614677&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.47 Rostock, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.47.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: 4da28e930f31887fff4c81d9e122b67e889796f9be62afcc650d4b98df975cf1

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2081
Content-Type: text/html; charset=utf-8
Date: Tue, 12 Dec 2023 08:43:12 GMT
Expires: Tue, 12 Dec 2023 08:43:12 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H2

200

e99aace94e6e5873881d3400993e1e7e
pv.medialead.de/trck/eview/ Frame 6536
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=41235600036525004444550012536002&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=41235600036525004444550012536002&t=htlp&gdpr=1&consent=1&gdpr_consent=

43 B
360 B

87ms
22ms

Image
image/gif

91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=41235600036525004444550012536002&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 91.121.248.44 , France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:12 GMT
attribution-reporting-register-source: {"source_event_id":"17200521800104416","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx
host: pv.medialead.de
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
content-length: 43
proxy-host: pv.medialead.de

Redirect headers

location: https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=41235600036525004444550012536002&t=htlp&gdpr=1&consent=1&gdpr_consent=
date: Tue, 12 Dec 2023 08:43:12 GMT
server: nginx
content-length: 138
content-type: text/html

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 809B 1 KB
643 B 7ms
7ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 59102
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 11 Dec 2023 16:18:10 GMT
etag: 48472445140208031
expires: Tue, 12 Dec 2023 16:18:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 6536 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2215a49297a9b1815b45910891d66207c7ee52aad54d4d464f8c02e2d19b7e26

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 ts.js Show response
cdn.retailads.net/ Frame 75BE 5 KB
5 KB 5ms
5ms Script
application/javascript 2a01:4f8:d0a:2321::2
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.retailads.net/ts.js
Requested by: Host: futalis.de
URL: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3380147190
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 2a01:4f8:d0a:2321::2 Frankfurt am Main, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: Apache /
Resource Hash: 525e7c89461afb3f73ea7030fbceba4f9e9383570159926acee637b4f86b8148

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://futalis.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:12 GMT
last-modified: Wed, 05 Apr 2023 20:14:46 GMT
server: Apache
etag: "1416-5f89c717cdc2f"
content-type: application/javascript
xphp81: true
accept-ranges: bytes
content-length: 5142

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame 4450 175 KB
63 KB 16ms
16ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

02ba99ee9baed37257c745706e275b127fcf228bc5e012f153da8e90475b168f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:12 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64101
x-xss-protection: 0
last-modified: Tue, 12 Dec 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 12 Dec 2023 08:43:12 GMT

GET
H2 200 ts.js Show response
cdn.retailads.net/ Frame 6B97 5 KB
5 KB 5ms
5ms Script
application/javascript 2a01:4f8:d0a:2321::2
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.retailads.net/ts.js
Requested by: Host: futalis.de
URL: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3380147188
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 2a01:4f8:d0a:2321::2 Frankfurt am Main, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: Apache /
Resource Hash: 525e7c89461afb3f73ea7030fbceba4f9e9383570159926acee637b4f86b8148

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://futalis.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:12 GMT
last-modified: Wed, 05 Apr 2023 20:14:46 GMT
server: Apache
etag: "1416-5f89c717cdc2f"
content-type: application/javascript
xphp81: true
accept-ranges: bytes
content-length: 5142

GET
H3 200 css
fonts.googleapis.com/ Frame 3848 2 KB
434 B 17ms
16ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Titillium+Web:400,700

Requested by

Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request_content.php?s=41235600036525004444550012536002&a=9111ab7a

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

bf5b911ce6645add415b3dbf40d50dc8cda426f38f5300525bf4793c4131b2c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 12 Dec 2023 08:43:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 12 Dec 2023 08:16:50 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 12 Dec 2023 08:43:12 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 3848 17 KB
17 KB 22ms
8ms Image
image/png 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request_content.php?s=41235600036525004444550012536002&a=9111ab7a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: a01923b2d5b9e2d112dd9aae4bd9dea3be69c896cb7a80bdb8b0abd5a7d92d44

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Tue, 12 Dec 2023 08:43:12 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16983
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 3848 16 KB
16 KB 22ms
9ms Image
image/png 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request_content.php?s=41235600036525004444550012536002&a=9111ab7a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 14907d8bb48a70293263a47da938d5caca0c462a06f0008bd51b5f0b5801a05c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Tue, 12 Dec 2023 08:43:12 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16517
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 3848 13 KB
13 KB 22ms
8ms Image
image/png 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/55487/creativesup/1200x627.jpg
Requested by: Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request_content.php?s=41235600036525004444550012536002&a=9111ab7a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 858dc57e944be2519d21a7e8cff0773aaad66a6c30afb778a7b6c0e9827d0c00

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Tue, 12 Dec 2023 08:43:12 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 12994
Vary: Accept-Encoding
Content-Type: image/png

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame 28C6 175 KB
63 KB 20ms
20ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8f6958619f041f516ef515500be86ef22d6e525516bd5a379f0bf505f67f6380

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:12 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64119
x-xss-protection: 0
last-modified: Tue, 12 Dec 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 12 Dec 2023 08:43:12 GMT

GET
H2 200 89f7480c0afa0150827cf163f8728151 Show response
pv.medialead.de/trck/epv/ Frame B598 0
326 B 77ms
20ms Document
application/javascript 91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pv.medialead.de/trck/epv/89f7480c0afa0150827cf163f8728151?subid=69813700038159104445002012536020&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request.php?zone=5zyrr3xpcfb3&nw=20&renderingType=javascript&namespace=366ebc81c4&subid=&uid=1dff3dab63744665&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCeJDAHx14Ze26MpWtjuwPt4ODwAam5b2gaZ2XnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAoUuM1P2D7I-qAMByAObBKoEoQJP0DMg0QMAlOZjpdnCUVlALT0XlNT0U2xfg_Gvlwk_Yc2mYocM7OUR-uYUzQQfZyMF1bqln1WTtOG1LDz6mms2fO7gH8lT9uUultRULlcvhKt0IDVV3uZpxWw4IFx9MayZL88Bc37T-UlFTeAe7p0c94NvVSmeMj7dHVNZ3M9yPxrhOu30VuH4ajsTWLY_xMyQ6uF-YiFXgKCfm0pLnZ3s2VEoPw5Pg2lKV71av1ozLI9n6jpjfnjEyOJZUFSxp9Kk3d-Jw34lzQ0PSpLJHIxxyQBznB__S1koiP_kAun2jjcWomqj-T6CF4CHYLEz0dmIOeD8qoVfj0D1vkTWOw7LT66H081jtfbIjTMW4S1wQqMmePMOueRCW8AkM6vLw3VYwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB0yAqoCOgKAQEi9_cE6WOGKmNPAiYMDgAoDmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRF4g0TCLbjmNPAiYMDFZWWgwcdt8EAaLATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE%26sig%3DAOD64_2Pk8u7zC-j30m0yrUvfwB0Xcfdfg%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AE0sni8xp3MpesblZHF917Ov9CCc1l9Na7IFyb7jUtWYqdlXRnn06JVjlooOSzQF8aCLatJoFvJLSvmCNQK8dhP7o3gptXk3DZg3iEzcZVu9eZY8kwhzqYApXCW3HuWUm1y8QZ-Og2D4xSzE07lsh0h29lFYXGi0wRYuVAP1twDU3OkD4%26cry%3D1%26dbm_d%3DAKAmf-BTEodPzrPidW1BkCf5vcpi6tho64d8Y7aALyHGZ5E3P3UJ6356mahcXV25dSKZ6AQnMT89vjTWiNgz-UE9vP1PzH49karnHeDQPSrfyXGjnXXL0W4QNVIi1QCx4nymd7d-ZvF0wa935yADza7ovJP7jyMIx79b2-dgEbW4l4zrS4j__N45qgPJBBimpkKlMMgdcb7jFQ9THBc1cbv-cfDB2-NKaeBmx8zNjgS5nKVLrW6L95d7yRt8CTomdOd9enu7jP56gCquY5kX7Zkwx37upYiIb1eOYq-PcUBOZoYP3YhPxSjACNDUSoU1O3UReA5jedMLLEMAoyiMncScCYPp685cY4wCxY9UIb1yS5qt0P77lYKPtV8eWtUOLJ9Z33y18ph8zwzH17q61bmK0K-UisT1asOoFLAiapRai-SqVac8zUV8HNlPNGrtJXIUU6OJNAfPYB08Nra1JKX465QI6AfiD-4JxqCZ0YD5fR4DfwcCfibK10lDOWS_g0-bPoa27D3SZXjgGh6xir3F_9BxqoeMDrK76z5PZs6wEuyJdyGRc8bCj-eqJOamNdH2TvRpmyJDIrxCQo0F51dJPZt8-GP66g%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=9714897640080&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.121.248.44 , France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"25200521800103636","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript; charset=utf-8
date: Tue, 12 Dec 2023 08:43:12 GMT
host: pv.medialead.de
proxy-host: pv.medialead.de
server: nginx
vary: Origin

GET
H3

200

activityi;dc_pre=CNG73tPAiYMDFfwNogMd-HwHzw;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2973738813209.9185 Show response
8019191.fls.doubleclick.net/ Frame CEEE
Redirect Chain

https://8019191.fls.doubleclick.net/activityi;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2973738813209.9185?
https://8019191.fls.doubleclick.net/activityi;dc_pre=CNG73tPAiYMDFfwNogMd-HwHzw;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2973738813209.9185?

392 B
243 B

53ms
53ms

Document
text/html

216.58.206.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8019191.fls.doubleclick.net/activityi;dc_pre=CNG73tPAiYMDFfwNogMd-HwHzw;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2973738813209.9185?

Requested by

Host: www.vinpearll-resort.ph
URL: http://www.vinpearll-resort.ph/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil07s07-in-f6.1e100.net

Software

cafe /

Resource Hash

da0e41e9a8fa7ec8230736178f8b6bb9456ba5adca2e3666a02eafea8dce8049

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 220
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 12 Dec 2023 08:43:12 GMT
expires: Tue, 12 Dec 2023 08:43:12 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 12 Dec 2023 08:43:12 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://8019191.fls.doubleclick.net/activityi;dc_pre=CNG73tPAiYMDFfwNogMd-HwHzw;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2973738813209.9185?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900020.redintelligence.net/ Frame EDB0 7 KB
2 KB 20ms
7ms Document
text/html 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900020.redintelligence.net/request_content.php?s=69813700038159104445002012536020&a=53e598e9
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request.php?zone=5zyrr3xpcfb3&nw=20&renderingType=javascript&namespace=366ebc81c4&subid=&uid=1dff3dab63744665&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCeJDAHx14Ze26MpWtjuwPt4ODwAam5b2gaZ2XnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAoUuM1P2D7I-qAMByAObBKoEoQJP0DMg0QMAlOZjpdnCUVlALT0XlNT0U2xfg_Gvlwk_Yc2mYocM7OUR-uYUzQQfZyMF1bqln1WTtOG1LDz6mms2fO7gH8lT9uUultRULlcvhKt0IDVV3uZpxWw4IFx9MayZL88Bc37T-UlFTeAe7p0c94NvVSmeMj7dHVNZ3M9yPxrhOu30VuH4ajsTWLY_xMyQ6uF-YiFXgKCfm0pLnZ3s2VEoPw5Pg2lKV71av1ozLI9n6jpjfnjEyOJZUFSxp9Kk3d-Jw34lzQ0PSpLJHIxxyQBznB__S1koiP_kAun2jjcWomqj-T6CF4CHYLEz0dmIOeD8qoVfj0D1vkTWOw7LT66H081jtfbIjTMW4S1wQqMmePMOueRCW8AkM6vLw3VYwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB0yAqoCOgKAQEi9_cE6WOGKmNPAiYMDgAoDmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRF4g0TCLbjmNPAiYMDFZWWgwcdt8EAaLATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE%26sig%3DAOD64_2Pk8u7zC-j30m0yrUvfwB0Xcfdfg%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AE0sni8xp3MpesblZHF917Ov9CCc1l9Na7IFyb7jUtWYqdlXRnn06JVjlooOSzQF8aCLatJoFvJLSvmCNQK8dhP7o3gptXk3DZg3iEzcZVu9eZY8kwhzqYApXCW3HuWUm1y8QZ-Og2D4xSzE07lsh0h29lFYXGi0wRYuVAP1twDU3OkD4%26cry%3D1%26dbm_d%3DAKAmf-BTEodPzrPidW1BkCf5vcpi6tho64d8Y7aALyHGZ5E3P3UJ6356mahcXV25dSKZ6AQnMT89vjTWiNgz-UE9vP1PzH49karnHeDQPSrfyXGjnXXL0W4QNVIi1QCx4nymd7d-ZvF0wa935yADza7ovJP7jyMIx79b2-dgEbW4l4zrS4j__N45qgPJBBimpkKlMMgdcb7jFQ9THBc1cbv-cfDB2-NKaeBmx8zNjgS5nKVLrW6L95d7yRt8CTomdOd9enu7jP56gCquY5kX7Zkwx37upYiIb1eOYq-PcUBOZoYP3YhPxSjACNDUSoU1O3UReA5jedMLLEMAoyiMncScCYPp685cY4wCxY9UIb1yS5qt0P77lYKPtV8eWtUOLJ9Z33y18ph8zwzH17q61bmK0K-UisT1asOoFLAiapRai-SqVac8zUV8HNlPNGrtJXIUU6OJNAfPYB08Nra1JKX465QI6AfiD-4JxqCZ0YD5fR4DfwcCfibK10lDOWS_g0-bPoa27D3SZXjgGh6xir3F_9BxqoeMDrK76z5PZs6wEuyJdyGRc8bCj-eqJOamNdH2TvRpmyJDIrxCQo0F51dJPZt8-GP66g%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=9714897640080&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: 11dccc30eb5d3e3271df114093a871f853e27c43f0f09514fb9b28dde368967c

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2060
Content-Type: text/html; charset=utf-8
Date: Tue, 12 Dec 2023 08:43:12 GMT
Expires: Tue, 12 Dec 2023 08:43:12 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame C329 43 B
703 B 66ms
49ms Image
image/gif 104.102.45.165
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=3266505&v=11601&q=357526&r=113440&pref1=69813700038159104445002012536020&pv=1

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.102.45.165 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 12 Dec 2023 08:43:12 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H2 200 impression.php
t23.intelliad.de/ Frame C329 43 B
555 B 61ms
17ms Image
image/gif 3.68.6.151
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t23.intelliad.de/impression.php?cl=2353636373136323131303&cp=101&ag=248&bm=100&bmcl=5373735313236323131303&crid=101&timestamp=1702370592&co=
Requested by: Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.68.6.151 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-68-6-151.eu-central-1.compute.amazonaws.com
Software: Apache /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
server: Apache
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW NID PSAo PSDo OUR STP OTC"
content-type: image/gif
cache-control: no-store, no-cache, max-age=0, must-revalidate
content-length: 43
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 809B
Redirect Chain

https://px.ads.linkedin.com/setuid?partner=googleadxdb&google_gid=CAESELR-l5c3uiQBPehkDRiWnfs&google_cver=1&google_push=AXcoOmT-j46KmRBKeFrFtxGYx8SY4FUHacA0q5dD1DhFX8lscm5AcTDqqqnvOQcZDbE8ch55o0Seq...
https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmT-j46KmRBKeFrFtxGYx8SY4FUHacA0q5dD1DhFX8lscm5AcTDqqqnvOQcZDbE8ch55o0SeqTBeuaJ459PnC7AqaLWuSPQ

170 B
188 B

17ms
17ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmT-j46KmRBKeFrFtxGYx8SY4FUHacA0q5dD1DhFX8lscm5AcTDqqqnvOQcZDbE8ch55o0SeqTBeuaJ459PnC7AqaLWuSPQ

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 12 Dec 2023 08:43:12 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 26768B20D78A45B7B540AEA01CF92D2E Ref B: FRAEDGE1414 Ref C: 2023-12-12T08:43:12Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmT-j46KmRBKeFrFtxGYx8SY4FUHacA0q5dD1DhFX8lscm5AcTDqqqnvOQcZDbE8ch55o0SeqTBeuaJ459PnC7AqaLWuSPQ
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYMTAp4BeZJovEvVn5h3A==

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 809B
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEFp_cKJahL_0Cfo0Ddfij0Y&google_cver=1&google_push=AXcoOmRvYAHMmkqk46N7edl1GOLQyqzmtsLdL_sCS7hJqxV8h42unvBJlapTg1vTOcDC7LlkP3lxhHqxZQfx...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmRvYAHMmkqk46N7edl1GOLQyqzmtsLdL_sCS7hJqxV8h42unvBJlapTg1vTOcDC7LlkP3lxhHqxZQfxNb747lXagq1aJuM

170 B
188 B

19ms
19ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmRvYAHMmkqk46N7edl1GOLQyqzmtsLdL_sCS7hJqxV8h42unvBJlapTg1vTOcDC7LlkP3lxhHqxZQfxNb747lXagq1aJuM

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmRvYAHMmkqk46N7edl1GOLQyqzmtsLdL_sCS7hJqxV8h42unvBJlapTg1vTOcDC7LlkP3lxhHqxZQfxNb747lXagq1aJuM
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 809B
Redirect Chain

https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESEMRQvqiYD7DCy-HdMuqHAI4&google_cver=1&google_push=AXcoOmTNonZ-FVTp5ROgqkoWctRLOFvT7BxkbyU3dkWnWYswHzu7vh0WApwmc4fDjipwsfs0GKR9Y8ifGHR3tLQI4yjmHHC...
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AXcoOmTNonZ-FVTp5ROgqkoWctRLOFvT7BxkbyU3dkWnWYswHzu7vh0WApwmc4fDjipwsfs0GKR9Y8ifGHR3tLQI4yjmHHCuHqQ&google_hm=NDc4MzI4Mjc0...

170 B
188 B

18ms
17ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AXcoOmTNonZ-FVTp5ROgqkoWctRLOFvT7BxkbyU3dkWnWYswHzu7vh0WApwmc4fDjipwsfs0GKR9Y8ifGHR3tLQI4yjmHHCuHqQ&google_hm=NDc4MzI4Mjc0MjM1Njc1MDM5Mw==

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AXcoOmTNonZ-FVTp5ROgqkoWctRLOFvT7BxkbyU3dkWnWYswHzu7vh0WApwmc4fDjipwsfs0GKR9Y8ifGHR3tLQI4yjmHHCuHqQ&google_hm=NDc4MzI4Mjc0MjM1Njc1MDM5Mw==
Date: Tue, 12 Dec 2023 08:43:12 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

report
sync.teads.tv/um/ Frame 809B
Redirect Chain

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEE6EDXoimmjm...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=AXcoOmQ-iM2_JjoVJTOGfEgogqI28W41lOA1asx2zZgsitfMXW-GwHG_CvVEGJJQjBYyF8RacSge1DvspfbFqHlV1cfxKR70RlMT
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
163 B

32ms
32ms

Image
image/gif

23.218.209.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Requested by: Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 23.218.209.56 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-218-209-56.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

expires: Tue, 12 Dec 2023 08:43:13 GMT
pragma: no-cache
date: Tue, 12 Dec 2023 08:43:13 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 809B
Redirect Chain

https://secure.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=${BASE64_UID_ENC}&google_gid=CAESEOe0MaaGfeRl6vQAJJW4yLw&google_cver=1&google_push=AXcoOmR9AKUmWykHA...
https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=NDIyMzA5NTMzMDY5MDU2OTM5Mg%3D%3D&google_gid=CAESEOe0MaaGfeRl6vQAJJW4yLw&google_cver=1&google_push=AXcoOmR9AKUmWykHAZ2wZv-FMIGujlvCLa...

170 B
188 B

17ms
17ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=NDIyMzA5NTMzMDY5MDU2OTM5Mg%3D%3D&google_gid=CAESEOe0MaaGfeRl6vQAJJW4yLw&google_cver=1&google_push=AXcoOmR9AKUmWykHAZ2wZv-FMIGujlvCLaVRlm0CNmab_QMwtb2wLcW2cdGX3QhNL_ORlYvVCidG4oaotcqDW4ptKIifvOlGzqSO

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:12 GMT
an-x-request-uuid: d290b981-0e1b-400d-be76-818f0d4d1d24
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=NDIyMzA5NTMzMDY5MDU2OTM5Mg%3D%3D&google_gid=CAESEOe0MaaGfeRl6vQAJJW4yLw&google_cver=1&google_push=AXcoOmR9AKUmWykHAZ2wZv-FMIGujlvCLaVRlm0CNmab_QMwtb2wLcW2cdGX3QhNL_ORlYvVCidG4oaotcqDW4ptKIifvOlGzqSO
x-proxy-origin: 81.95.5.37; 81.95.5.37; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25
x.bidswitch.net/check_uuid/ Frame 809B 43 B
145 B 9ms
7ms Image
image/gif 3.73.141.43
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25?google_gid=CAESEDIw9jMmpTXJFuwtGR3jF00&google_cver=1&google_push=AXcoOmTreTSHHI67iqEP4rUY7rLervrgI9osk7s0yeUHW63EZabjnuzg-H76TviVG4VXFjWw6a_iKE_MpACsZOG1361oZ4HR5-yr
Requested by: Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.73.141.43 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-73-141-43.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:12 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 809B
Redirect Chain

https://analytics.pangle-ads.com/api/ad/union/gg_cookie_matching?google_gid=CAESEFLgbsaq8esahE75A9NH6Xc&google_cver=1&google_push=AXcoOmSw-ocKql7pNg2BvDSIhVhR3RDRys9dq-Z4UcMGxtdBTZReoiizoRHUkFrVBND...
https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmSw-ocKql7pNg2BvDSIhVhR3RDRys9dq-Z4UcMGxtdBTZReoiizoRHUkFrVBNDDZNu1HomUJKaLKPaITI3UwoN4HugyFsgr

170 B
188 B

21ms
21ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmSw-ocKql7pNg2BvDSIhVhR3RDRys9dq-Z4UcMGxtdBTZReoiizoRHUkFrVBNDDZNu1HomUJKaLKPaITI3UwoN4HugyFsgr

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-akamai-request-id: 5994e50.9a4dd72
date: Tue, 12 Dec 2023 08:43:13 GMT
x-bytefaas-request-id: 2023121208431224F4C1CA6DCCE52BD96A
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-tt-trace-id: 00-23121208431224F4C1CA6DCCE52BD96A-6EA2F74A5F75CACC-00
x-cache: TCP_MISS from a23-54-206-24.deploy.akamaitechnologies.com (AkamaiGHost/11.3.3-52668873) (-)
x-parent-response-time: 93,23.54.206.24
server-timing: cdn-cache; desc=MISS, edge; dur=86, origin; dur=8, inner; dur=4
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 2023121208431224F4C1CA6DCCE52BD96A
x-cache-remote: TCP_MISS from a23-58-124-21.deploy.akamaitechnologies.com (AkamaiGHost/11.3.3-52668873) (-)
access-control-max-age: 86400
access-control-allow-methods: *
location: https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmSw-ocKql7pNg2BvDSIhVhR3RDRys9dq-Z4UcMGxtdBTZReoiizoRHUkFrVBNDDZNu1HomUJKaLKPaITI3UwoN4HugyFsgr
x-bytefaas-execution-duration: 3.19
access-control-allow-origin: *
access-control-allow-credentials: true
x-gw-dst-psm: ad.union.pangle_web_traffic
x-tt-trace-host: 0155477d3aa787bd96b8f391f905a6c63afcb11ef976a766237583046f6f58fa72fa7193abc095e7540860d90239886c556bf2e8e984c277e87ff28509d68255afd74767a73c4b69e9efe4910943de661b41787f3a8128427a26a22fd461f01b250bd6574580bf3aa24f75eebfd6e2ead2
x-origin-response-time: 8,23.58.124.21
cache-control: max-age=0, no-cache, no-store
access-control-allow-headers: *
expires: Tue, 12 Dec 2023 08:43:13 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 809B 0
12 B 16ms
15ms Image
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LvZgPg6fJV9Yag0c2qOju28EmmQopxK_fFaD_G2pQ1jLfhHjrQKKXcZT3pPviSXwJoBml5iKCG5PI

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:12 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame C501 1 KB
643 B 9ms
7ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 59102
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 11 Dec 2023 16:18:10 GMT
etag: 48472445140208031
expires: Tue, 12 Dec 2023 16:18:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame C329 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2b00924c56db200f53b1ab384cb82534d523a18b45cd34aa4e303f99b592abe8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK viewability Show response
hal90002.redintelligence.net/ Frame 3848 0
150 B 23ms
8ms Script
text/html 46.4.10.47
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90002.redintelligence.net/viewability?s=41235600036525004444550012536002&a=d200db51&vb=m
Requested by: Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request_content.php?s=41235600036525004444550012536002&a=9111ab7a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.47 Rostock, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.47.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/request_content.php?s=41235600036525004444550012536002&a=9111ab7a
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Tue, 12 Dec 2023 08:43:12 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 200 css
fonts.googleapis.com/ Frame EDB0 5 KB
682 B 17ms
16ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=69813700038159104445002012536020&a=53e598e9

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 12 Dec 2023 08:43:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 12 Dec 2023 07:39:52 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 12 Dec 2023 08:43:12 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame EDB0 11 KB
11 KB 23ms
9ms Image
image/png 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/36340/creativesup/native2.png
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=69813700038159104445002012536020&a=53e598e9
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 9145a2adc45008cc372f89737565d34703f6aa2b480812821f638684effb20d6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Tue, 12 Dec 2023 08:43:12 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 10940
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame EDB0 13 KB
13 KB 22ms
8ms Image
image/png 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/50502/creativesup/Fyrst-1200x627.jpg
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=69813700038159104445002012536020&a=53e598e9
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 5fea28d2dbeb40cfb34e01d16513f71ec94b3d86c457724081622c9a8ba46b8f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Tue, 12 Dec 2023 08:43:12 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 13285
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame EDB0 12 KB
12 KB 21ms
8ms Image
image/png 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/71572/creativesup/iQ_Native_Online-Deutschkurse_1200x627px_NEU.jpeg
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=69813700038159104445002012536020&a=53e598e9
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 28c3c0160ac4dbca5378a4499bdd34486e028090c4301135b95e6c4dd7b5c29f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Tue, 12 Dec 2023 08:43:13 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 11757
Vary: Accept-Encoding
Content-Type: image/png

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 4450 274 KB
91 KB 17ms
17ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

109b6ad7f86abcc818f78d6d00dee1e36fb08bf5babb79375afc66e36fc6822b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:13 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 93073
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 12 Dec 2023 08:43:13 GMT

GET
H2 200 dc_pre=CJeW3dPAiYMDFR0NogMdHgMLMg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8226031561868.083
adservice.google.com/ddm/fls/z/ Frame 4377 42 B
401 B 82ms
48ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CJeW3dPAiYMDFR0NogMdHgMLMg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8226031561868.083

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CJeW3dPAiYMDFR0NogMdHgMLMg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8226031561868.083?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame C501
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEPA_b3pTlA1eISSHBKH_DQg&google_cver=1&google_push=AXcoOmSlQRRfMG-ewtOVL-j6-Ui-Frjg0l_TWx68MMnJgj995ztscECDgiMjNuQd6_ewQfqwGBjCXQvQW327oHKEHr1dbbm_ii5S&...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEPA_b3pTlA1eISSHBKH_DQg&google_cver=1&google_push=AXcoOmSlQRRfMG-ewtOVL-j6-Ui-Frjg0l_TWx68MMnJgj995ztscECDgiMjNuQd6_ewQfqwGBjCXQvQW327oHKEHr1dbbm_ii5...

43 B
428 B

183ms
176ms

Image
image/gif

2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEPA_b3pTlA1eISSHBKH_DQg&google_cver=1&google_push=AXcoOmSlQRRfMG-ewtOVL-j6-Ui-Frjg0l_TWx68MMnJgj995ztscECDgiMjNuQd6_ewQfqwGBjCXQvQW327oHKEHr1dbbm_ii5S&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmSlQRRfMG-ewtOVL-j6-Ui-Frjg0l_TWx68MMnJgj995ztscECDgiMjNuQd6_ewQfqwGBjCXQvQW327oHKEHr1dbbm_ii5S%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Protocol: H2
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:13 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 8344adafdf4d5b8c-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:13 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 1385
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEPA_b3pTlA1eISSHBKH_DQg&google_cver=1&google_push=AXcoOmSlQRRfMG-ewtOVL-j6-Ui-Frjg0l_TWx68MMnJgj995ztscECDgiMjNuQd6_ewQfqwGBjCXQvQW327oHKEHr1dbbm_ii5S&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmSlQRRfMG-ewtOVL-j6-Ui-Frjg0l_TWx68MMnJgj995ztscECDgiMjNuQd6_ewQfqwGBjCXQvQW327oHKEHr1dbbm_ii5S%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 8344adae9e4a5b8c-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 sync
x.bidswitch.net/ Frame C501 43 B
145 B 10ms
9ms Image
image/gif 3.73.141.43
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESECv_ys-BSOw9-UmV35zfOf0&google_cver=1&google_push=AXcoOmTAoE69wyVnMGgKKK9KFa7q-0janhU2xviX6M_k23lgtYM2azVJZrVU0RFIc1wtxoc8i4GCFs2t7mUuAgBwZ8q_0GUwZ2C88Q
Requested by: Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.73.141.43 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-73-141-43.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:13 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C501
Redirect Chain

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEBmkM7eK2bkorzvhDw9L_jo&google_cver=1&google_push=AXcoOmTycmq6fT4Znhre68iud_JcXyf8ClBukS5w_KWcqOn2lOF2M7YyjtKP3FgdsT8teMQylxG0fPiHZd0Rh...
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESEBmkM7eK2bkorzvhDw9L_jo&google_push=AXcoOmTycmq6fT4Znhre68iud_JcXyf8ClBukS5w_KWcqOn2lOF2M7YyjtKP3FgdsT8teMQylxG0fPiHZd0Rh...
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmTycmq6fT4Znhre68iud_JcXyf8ClBukS5w_KWcqOn2lOF2M7YyjtKP3FgdsT8teMQylxG0fPiHZd0RhmRpOildV_cZstWNlA&google_hm=WFdwdFlqT0o1V2tKSn...

170 B
188 B

17ms
17ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmTycmq6fT4Znhre68iud_JcXyf8ClBukS5w_KWcqOn2lOF2M7YyjtKP3FgdsT8teMQylxG0fPiHZd0RhmRpOildV_cZstWNlA&google_hm=WFdwdFlqT0o1V2tKSnluU2xIUkU=

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 12 Dec 2023 08:43:13 GMT
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmTycmq6fT4Znhre68iud_JcXyf8ClBukS5w_KWcqOn2lOF2M7YyjtKP3FgdsT8teMQylxG0fPiHZd0RhmRpOildV_cZstWNlA&google_hm=WFdwdFlqT0o1V2tKSnluU2xIUkU=
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 238
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 204 -
s.ad.smaato.net/c/n/// Frame C501 0
236 B 53ms
24ms Image
text/plain 2600:9000:211e:b000:1b:5138:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEG_nQjyDYHUgnl14jMfR2yI&google_cver=1&google_push=AXcoOmRdB5oxa1Ck8EknnpuJtdAl_Z8QJRag1WrS6CtoBZD9o47mIQjXfw2bOxzBZ0Kqdq2szJNkFCVR7mg_6LEVNbS4-sjYK-j5HA
Requested by: Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:b000:1b:5138:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:13 GMT
cache-control: no-cache, must-revalidate
via: 1.1 6c7a5d26be7fb35284e54d321f16b6f6.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA56-C2
x-amz-cf-id: I2K0C398FHZty697bptyiw8XBeAe78juASPvooNb4HFymAgH4KEJuA==
x-cache: Miss from cloudfront

GET
H2

200

/
onetag-sys.com/match/ Frame C501
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEFp_cKJahL_0Cfo0Ddfij0Y&google_cver=1&google_push=AXcoOmTY6Tla1zpwDL6cCOApTYCSK3VIKgWUotmeybf4ZjX1H7l5xyusM9yPk1rGTjZo5wM6wbN3w4OmJDv...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmTY6Tla1zpwDL6cCOApTYCSK3VIKgWUotmeybf4ZjX1H7l5xyusM9yPk1rGTjZo5wM6wbN3w4OmJDv0h7mWJd9602AWmNjP2Jk
https://onetag-sys.com/match/?int_id=19&google_error=5

0
200 B

9ms
7ms

Image
text/plain

51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=19&google_error=5

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip253.ip-51-89-9.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=19&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 255
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25
x.bidswitch.net/check_uuid/ Frame C501 43 B
145 B 8ms
8ms Image
image/gif 3.73.141.43
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25?google_gid=CAESEDIw9jMmpTXJFuwtGR3jF00&google_cver=1&google_push=AXcoOmRV2BzG8J2Whvf4I2plJmDC8xSWlVu7KWpiaoCyxa0NLSfYglVhRKk7uWed-2UORrpLzAKV-6IOvFFbO4NvT6WH-Z8DS9fZBZk
Requested by: Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.73.141.43 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-73-141-43.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:13 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C501
Redirect Chain

https://analytics.pangle-ads.com/api/ad/union/gg_cookie_matching?google_gid=CAESEFLgbsaq8esahE75A9NH6Xc&google_cver=1&google_push=AXcoOmTztDDL6NaK9SWAJa07TeKK-H_LtqAx-SgcbqOF6_3MXWQ5H0d0hStEz33BtRP...
https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmTztDDL6NaK9SWAJa07TeKK-H_LtqAx-SgcbqOF6_3MXWQ5H0d0hStEz33BtRP4sDUjLfKlV68_gdQTMPVxg4AX4uTCfkRsajI

170 B
188 B

20ms
19ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmTztDDL6NaK9SWAJa07TeKK-H_LtqAx-SgcbqOF6_3MXWQ5H0d0hStEz33BtRP4sDUjLfKlV68_gdQTMPVxg4AX4uTCfkRsajI

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-akamai-request-id: 5995293.9a4de25
date: Tue, 12 Dec 2023 08:43:13 GMT
x-bytefaas-request-id: 202312120843130104880C6A267F36AC36
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-tt-trace-id: 00-2312120843130104880C6A267F36AC36-72647D6F879C52A3-00
x-cache: TCP_MISS from a23-54-206-24.deploy.akamaitechnologies.com (AkamaiGHost/11.3.3-52668873) (-)
x-parent-response-time: 91,23.54.206.24
server-timing: cdn-cache; desc=MISS, edge; dur=86, origin; dur=6, inner; dur=4
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 202312120843130104880C6A267F36AC36
x-cache-remote: TCP_MISS from a23-58-124-21.deploy.akamaitechnologies.com (AkamaiGHost/11.3.3-52668873) (-)
access-control-max-age: 86400
access-control-allow-methods: *
location: https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmTztDDL6NaK9SWAJa07TeKK-H_LtqAx-SgcbqOF6_3MXWQ5H0d0hStEz33BtRP4sDUjLfKlV68_gdQTMPVxg4AX4uTCfkRsajI
x-bytefaas-execution-duration: 3.04
access-control-allow-origin: *
access-control-allow-credentials: true
x-gw-dst-psm: ad.union.pangle_web_traffic
x-tt-trace-host: 0155477d3aa787bd96b8f391f905a6c63afcb11ef976a766237583046f6f58fa72fa7193abc095e7540860d90239886c55fe386c78236358da88172b2c2d2641da9a4cf8771db324c7fd51a30bd50a9e3bddff971a6e63696734d32d6c5ae98b6b6b510ff1a5fbc51076e78fc8dc429c60
x-origin-response-time: 6,23.58.124.21
cache-control: max-age=0, no-cache, no-store
access-control-allow-headers: *
expires: Tue, 12 Dec 2023 08:43:13 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame C501 0
12 B 17ms
17ms Image
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KuoHkI9i3cFf6md9qI23mA1ueCefcGjS-hp0KHmT2EItOFR241v3f-MNPX33AfO6DiVTWS2maq

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:13 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 dc_pre=CNG73tPAiYMDFfwNogMd-HwHzw;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2973738813209.9185
adservice.google.com/ddm/fls/z/ Frame CEEE 42 B
107 B 65ms
48ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CNG73tPAiYMDFfwNogMd-HwHzw;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2973738813209.9185

Requested by

Host: 8019191.fls.doubleclick.net
URL: https://8019191.fls.doubleclick.net/activityi;dc_pre=CNG73tPAiYMDFfwNogMd-HwHzw;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2973738813209.9185?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://8019191.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK viewability Show response
hal900020.redintelligence.net/ Frame EDB0 0
150 B 25ms
9ms Script
text/html 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900020.redintelligence.net/viewability?s=69813700038159104445002012536020&a=e3200fb0&vb=m
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=69813700038159104445002012536020&a=53e598e9
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/request_content.php?s=69813700038159104445002012536020&a=53e598e9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Tue, 12 Dec 2023 08:43:13 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5247 0
20 B 47ms
47ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B_HT-IB14Zf3PI-rLjuwPi_q9cAAAAAA4AeAEAg&bg=!5uWl5arNAAY3kmNgF5I7ADQBe5WfOM20yiMu8uzk_BvJl0NrJscsCyg3mRJxiy5PSGFX9XMFsKkrvoq6Qm5hypt0xpJsAgAAAJtSAAAAAWgBB5kDPkqiYBjiLXm1WaxoXg5ALg5xlic9Bu77U2XTDiPCddqJdqhAIWc0Dk1IXrUB-O1gsEwpcHfBz48TqI8crGvM7geisYzm9ELYFO_hjPZf_S-kXaSc7nHNhgNiU7YFywA13RNuYEWdG9SZh3m9WulrdbeMgLdzTlaaL43k5CreCttDZqj5-bseO84PBeIHowzsaMokupzGmP1fwiO_Za6dBY5D3nbR4SNl3J8fCiJCtAXuDVFgK8XAAK1BYyyqsodiCqzyfpAdSgbMsKj6pyfr7ebN9ciuJak3EdX8aP6Yh_wgufPcAsCx2Rzn7DZhTlXbSL-yJoy9ThX5RTwQFHdPJp4KPfY-xQXh163YF1aZWVUDLaeRNVET1UQgJN-Ks52Dtv0P8eaYDV8_lWtkJTKPRQtLyRFFPQaKsaUmhFWP2NQorIL7SdTelmWUblWF_pPZCtdtwrCa2h2eLGN8u3TyA1FMpy8V7enFxFypRam-QLr-cGze3B2IyBKUakNXE-n28nEWY2yb_AL55ssab6Sh6ReX9J2KIi3njvkXhMMZiWwUKK83rmQ6u-prykUVJzy1Bnxl4-_0A_fKD7LEm8Jod1VVWnEiZ_zb3Y64g7DuzuySNwQR076n7dqoc2sUtYyl5B7vtj-fyJoBBLMsnHf4qdt7Gu9mwsiqRLOA8KjognysUAXwXeQxgA_jjQeOh3JJUNlZuiIauf-SJFSjLD50y0NxcWQwgkNlZlFLw-0FvXtGxplksE2mMfvrrlIm31uMBF87J3jZ7daZpT5lCQ0372KpoUnebjZV7FmlVjtDHNt3kmYZD7FmyHtDIzzmTIsb0TFGu4gRAkK4HGMk6LoeZ8DVYsmrxr54S3WUIUp9KqSjS_Fq3McIZuJdCoMM2yXhZdjVdzVHy4QLCPhq20EaVwbi9GfIU31NIZTQB6RKJSFkEEpbi5cgsIidFbV2X1TfvdoP5dccKqROixlYNdjZLG7MwH-Eo-tv7qpKsWgznkyeOMXkM3ev6N6UcVgdrR4QAc5tyVt5xSAtsQ1iNAeBSK05vLXeP8GsHXFUFJmRtgQynEAGTxMkmNLAGkeQXn3FBMsezHRBwAP8qJx2EFnL

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 28C6 274 KB
91 KB 17ms
17ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

47f564eff8cb65e7628a7e9f765e23c8f21ae1b11a229e2613d3dc064f0d934d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:13 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 93075
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 12 Dec 2023 08:43:13 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame F896 0
234 B 1027ms
359ms Ping
image/gif 2404:6800:4009:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~lq23hu39&c=3220366250959&slotId=1610183125479.5&eee=missing-element&bi=missing-id&vast_v=4.0&lima_p_ich=0&lima_p_icu=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.608.2_en.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4009:80e::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:13 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 link.html Show response
track.webgains.com/ Frame 3AFE 2 KB
2 KB 75ms
75ms Script
text/html 13.43.203.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=69274600041506204444994012536021&nw=1
Requested by: Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.43.203.41 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-43-203-41.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 91ecdc55b17b88043de46300389526196cdbbe8eadb2671211236d91ba20f263

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:13 GMT
last-modified: Tue, 12 Dec 2023 08:43:13 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Tue, 12 Dec 2023 08:44:13 GMT

GET
H3

200

activityi;dc_pre=CNjj59PAiYMDFT0HogMd7GUAVA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3323952104246.1353 Show response
5994599.fls.doubleclick.net/ Frame E883
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3323952104246.1353?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CNjj59PAiYMDFT0HogMd7GUAVA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3323952104246.1353?

392 B
241 B

52ms
52ms

Document
text/html

216.58.206.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CNjj59PAiYMDFT0HogMd7GUAVA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3323952104246.1353?

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil07s07-in-f6.1e100.net

Software

cafe /

Resource Hash

80d1f6c2cb1fe0d0d2e162178a89f52835b60754ddc6c13cf1f6037c2e3d903c

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 218
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 12 Dec 2023 08:43:13 GMT
expires: Tue, 12 Dec 2023 08:43:13 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 12 Dec 2023 08:43:13 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CNjj59PAiYMDFT0HogMd7GUAVA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3323952104246.1353?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900021.redintelligence.net/ Frame 2552 7 KB
2 KB 23ms
8ms Document
text/html 144.76.238.55
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900021.redintelligence.net/request_content.php?s=69274600041506204444994012536021&a=c010e8a2
Requested by: Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 144.76.238.55 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.55.238.76.144.clients.your-server.de
Software: Apache /
Resource Hash: 69351436a8f8525bc9344ba53249f77476670f1d27d7b4ea181a3ee264cfd35d

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2122
Content-Type: text/html; charset=utf-8
Date: Tue, 12 Dec 2023 08:43:13 GMT
Expires: Tue, 12 Dec 2023 08:43:13 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 1790 1 KB
643 B 9ms
9ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 59103
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 11 Dec 2023 16:18:10 GMT
etag: 48472445140208031
expires: Tue, 12 Dec 2023 16:18:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 3AFE 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c42f557cab2b6913afdcd455ad144ce66abfa28df6c41de793efc0609f6ba52b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 6536 53 KB
19 KB 70ms
8ms Script
application/javascript 18.66.147.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=41235600036525004444550012536002&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-120.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fbc6bed540723f219a878e5735ae8cb1c05aa9f7012bf21870cd79e41af25bcd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 01:58:49 GMT
content-encoding: gzip
via: 1.1 6b25d4ce9efa3f2699980e1915129606.cloudfront.net (CloudFront)
last-modified: Thu, 23 Nov 2023 16:26:10 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P4
age: 24265
x-amz-server-side-encryption: AES256
etag: W/"1180a1bfee0aad979766ecd6180b923e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: MbvFOSoL5xw8m7OrS9zkVxll-sSTUyWXTDPMaNYDtObVBOaVQQY3wg==

GET
H2 200 1x1.png
cdn.track.production.webgains.team/7121/ Frame 6536 3 KB
3 KB 31ms
7ms Image
image/png 99.86.4.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.png?Expires=1702370892&Signature=Y9uMVPsJ4hO4Te~GO6qhCl340HwKMy6OsosalG702P18SSJ2JqW1HmFcvR-XecaNwQJzcS0MAqMb1r0fuUkSsgqoqFc0kdB323zP5kq5T~WeWIZlF-3Hfc-g8mxwD-LnRVP3DrjgaGdB2g277W920R7eMLiiZHQZzUv1eMBC0mkOq6d45sC3OEU~SRvTYQt-g-c1GTCmwoC3pQbsJMGRqVBABSpc7YBF8mgFACqRw918PF9URaTmWu22Sa0CUZfFvElLBmoR00NQ5JminQElD2Y7QASvSAarZBycBIa31HxG1twfKxAG~0DnUjHsh~SdWIxmnp6uqSNz8ASuSEB~Eg__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-94.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-version-id: null
date: Mon, 11 Dec 2023 10:07:35 GMT
via: 1.1 78059242182c195ff7f26013772da09a.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
age: 81339
etag: "4e57de0506fbdb487ffcd53b450caee1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2808
x-amz-cf-id: wzLjZBrH_e4lXxDLYbNyvu1xps_CblZ4oxFz_2LxAuWpmucGaNpoTA==

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 92ms
92ms Ping
image/gif 52.205.137.140
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=W4qeS5lieKiKiG8g&instance=214470769&version=7.28.2&age=231212&ldt=NO_IMP&key=jmgEr5Ik&c_id=12018&seq=1&order=6&vIndex=0&absoluteTime=5211.6&relativeTime=3379.1&sm_id=3233414&visiblestatecd=I&soundcd=OFF&alt=0&sC_ID=14497&load=1&status=LVFNLNIY&ac_id=2008&adIndex=-1&DS=found&prebidABS=G&prebidABC=[[1,%22control_mod_del%22],[1,%22bidder_mod%22,%220_mod%22],[1,%22bidder_del%22,%220_del%22]]&eg.enabled=false&eg.delay=15&eg.ctdwn=5&eg.vl=30&eg.mid=rm&eg.source=p6&eg.time=false
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.28.2/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.205.137.140 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-137-140.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:13 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

GET
H2 200 p
sb.scorecardresearch.com/ Frame 4B30 43 B
298 B 41ms
8ms Image
image/gif 18.245.60.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p?c1=2&c2=18065638&ns_type=hidden&ns_st_sv=6.3.4.190424&ns_st_smv=5.10&ns_st_it=c&ns_st_id=1702370589870&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=1131210&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.3.4.190424&ns_st_pn=1&ns_st_tp=1&ns_st_ci=3233414&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_ap=0&ns_st_dap=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_st_ldw=0&ns_st_ldo=0&ns_ts=1702370593069&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=3199&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=*null&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc12&ns_st_ge=Sports&ns_st_st=SendtoNews&ns_st_ce=0&ns_st_ia=0&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Fortune&c3=sendtonews&c4=Business&c6=*null&c7=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvinpearll-resort.ph%26pcid%3D48%26rid%3D112%26a%3D0&c8=&c9=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvinpearll-resort.ph%26pcid%3D48%26rid%3D112%26a%3D0
Requested by: Host: simcast.com
URL: https://simcast.com/?d=vinpearll-resort.ph&pcid=48&rid=112&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.245.60.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-245-60-76.fra60.r.cloudfront.net
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:13 GMT
via: 1.1 6ce3814cb60a4c907ac701e60e4c1e5a.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: FRA60-P5
x-cache: Miss from cloudfront
content-type: image/gif
content-length: 43
x-amz-cf-id: MtRXi3_iBy633a9MiHI8J98ge-X6a0-kJ5lmtivniE6-Bux2-gKqHA==

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame EDB0 14 KB
15 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900020.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 17:12:00 GMT
x-content-type-options: nosniff
age: 55873
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 10 Dec 2024 17:12:00 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame EDB0 15 KB
15 KB 9ms
9ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900020.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 11:13:55 GMT
x-content-type-options: nosniff
age: 336558
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Dec 2024 11:13:55 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 11E6 0
20 B 45ms
45ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B3PrjIB14ZcrSJNawjuwP5sGOoAYAAAAAOAHgBAI&bg=!1tWl1ZrNAAY3kmNgF5I7ADQBe5WfOIN8PXH1YNZbrubJXNKhFp3iCLs4iG51SoX3kw-HgGqc2oq79e7J-NRuY2cToVzVAgAAAO9SAAAAAWgBB5kDQuXMu-6wlAZTpsu2BupewQITsENi-fTZF-CSY3JN3-sceThNNMcL1OIGGRbJUrh3-qiUQc11uTCo7TSJBCOB-NoAjRP_mM9CwiEyH7ElBm9EmB5xGFWGEF8CrKVPvNUAHuCGv32EWb-MpiyrtlD7R5U4DB29Luxn5g39veeSN4cQVQvo4APxD0yofLcbvYLL8aDx6gsHwxAn6Afo0n4oEYNQ22ijS9rz0kzWkhzlPv8aTQz2AEMae_38szhsQXvsahGu6GhtZPJPl98okJyGOSWlX7xdmQXVqStv4aGO1W9IGXuM7sXUUW6Z8HBBzCPkm7iUxFxtKk6Em7zO-1n9INpGjwx2-TcX69dNw0s_kcIXvU5cfxJSj9rkK7_hl7GAxwV-tfukAS-8sWNVzOaooHy8ood-znhwYybQwLiQo8AuquQYBWQFouPUw8vbzXAY7rCiDSVaNjYiekTaGH4sFnO6111_1BDNGods8z70CPUtYM0AgjqnijfathtVVBsAesmjqXdKiQjgGZn8ZVqoav6K6a30JrRpAywb25yrHAsy9Tof5dVsRp7WPbnJZQ1q9Vl8w0WUkWdCLXZYjCX8-qE2miHkioh7QFsX0VO3MVZt0szQE7atuxiSjmLEUj1LxytchjgJjDnMAH4zhcxrEsTaL9buzzkU6fk9cu0_EJiXl4MB9rwRkYB-_GytKCI0QLijHu6_IKn_D0918QKEYS6GVHI-jen9ZQQlTluTUC9igiBdLiMQc1k68iGMFmg0UqewvQSiOhZ341CW2EfFKsb1hhPoD5p8kocMP1JO8_dy2-WyCY6liGyDWIAFQlzdtiSVoOd9YoFI_onQsBWQLezFW2lK47MCkmBB_TLNIa6BmX6Opbp6nV8LDwRTPVgJQYRKLiTHYgwZcL33wtTB7E5Wbzcle4CWCd1W5af-jkrMmAsYY7oD6Z1Cecpyo8tVipRN_zFPZUkFsmma5Tz6YBX03iSecMio70W5P4XzVX9YBOYifZDYFjFGVv6gq05YErJmEjh7l_UfjEA1msVuzqCkGycHwwIn-mBXVCzY8E4GeTSpDboGEjP3l2ygM4Plvysoy71yIKkiY4kNrMwrhpvpFg

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 101ms
101ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8344adaece3492a8-FRA
date: Tue, 12 Dec 2023 08:43:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fpTNn3fS%2FzItWz3PX0AQmI4h7lbHmZpLle8pvWHZySEzlpIAeSkcdHXo%2FoJknYdtMmae%2FCjJWzdRmw%2FVrVRMuBNpOjqX4iE9ZYk7JktEVmachuWEvsdwfnW1br2E2jvVZ2jgbOqRBc6AjWMhfko%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
260 B 116ms
116ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-92cafdd1.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Dec 2023 08:43:13 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Nan5q20ph1i6zX2Bimtv4Wig%2FlvidVZQJZbuT1gipEMWj%2BFWLAmyuPiAUhcWHY8Hchnv%2FYa6YRDTgvoIFZr56FPVkqVxcG1K1VHI2EIirnEPGvLXlRFQOo4EUCf5M3ZUCOvHYJlk%2BdACG3ijdEQ%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8344adaf6e8d92a8-FRA
content-length: 0

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 91ms
90ms Ping
image/gif 52.205.137.140
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=W4qeS5lieKiKiG8g&instance=214470769&version=7.28.2&age=231212&cmd=INV&key=jmgEr5Ik&c_id=12018&seq=1&order=7&vIndex=0&absoluteTime=5222.9&relativeTime=3390.4&alt=0&sC_ID=14497&sm_id=3233414&load=1&status=LVFNLNIY&ac_id=2008&EXTREF=https://simcast.com/?d=vinpearll-resort.ph%26pcid=48%26rid=112%26a=0&REF=https://simcast.com/?d=vinpearll-resort.ph%26pcid=48%26rid=112%26a=0&playerCfg=FL&playerType=FLOAT
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.28.2/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.205.137.140 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-137-140.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:13 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 91ms
91ms Ping
image/gif 52.205.137.140
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=W4qeS5lieKiKiG8g&instance=214470769&version=7.28.2&age=231212&cmd=PLAY&key=jmgEr5Ik&c_id=12018&seq=1&order=8&vIndex=0&absoluteTime=5223.1&relativeTime=3390.6&alt=0&sC_ID=14497&sm_id=3233414&load=1&status=LVFNLNIY&ac_id=2008&EXTREF=https://simcast.com/?d=vinpearll-resort.ph%26pcid=48%26rid=112%26a=0&REF=https://simcast.com/?d=vinpearll-resort.ph%26pcid=48%26rid=112%26a=0&playerCfg=FL&playerType=FLOAT&pposition=home
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.28.2/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.205.137.140 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-137-140.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:13 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

GET
H3 200 css
fonts.googleapis.com/ Frame 2552 5 KB
682 B 17ms
16ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request_content.php?s=69274600041506204444994012536021&a=c010e8a2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900021.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 12 Dec 2023 08:43:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 12 Dec 2023 07:42:26 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 12 Dec 2023 08:43:13 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 2552 17 KB
17 KB 23ms
9ms Image
image/png 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request_content.php?s=69274600041506204444994012536021&a=c010e8a2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: a01923b2d5b9e2d112dd9aae4bd9dea3be69c896cb7a80bdb8b0abd5a7d92d44

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900021.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Tue, 12 Dec 2023 08:43:13 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16983
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 2552 16 KB
16 KB 22ms
8ms Image
image/png 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request_content.php?s=69274600041506204444994012536021&a=c010e8a2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 14907d8bb48a70293263a47da938d5caca0c462a06f0008bd51b5f0b5801a05c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900021.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Tue, 12 Dec 2023 08:43:13 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16517
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 2552 13 KB
13 KB 22ms
8ms Image
image/png 78.46.111.106
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/55487/creativesup/1200x627.jpg
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request_content.php?s=69274600041506204444994012536021&a=c010e8a2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.111.106 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.106.111.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 858dc57e944be2519d21a7e8cff0773aaad66a6c30afb778a7b6c0e9827d0c00

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900021.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Tue, 12 Dec 2023 08:43:13 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 12994
Vary: Accept-Encoding
Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1790
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEOJQKwBMHaYwWOYH8Kh2weM&google_cver=1&google_push=AXcoOmQB922FWrtqVOZXKwpSjbH5aw6vmKLBPaLNaCtmftdvYqyTsCDJ6HK3ByOSCIo6gmNI8Dx9ki57yzG...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmQB922FWrtqVOZXKwpSjbH5aw6vmKLBPaLNaCtmftdvYqyTsCDJ6HK3ByOSCIo6gmNI8Dx9ki57yzGrcqt_0dsGTMwOxMDw&google_hm=sfuQAqbfQOeDDBs7ygZPayU

170 B
188 B

18ms
18ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmQB922FWrtqVOZXKwpSjbH5aw6vmKLBPaLNaCtmftdvYqyTsCDJ6HK3ByOSCIo6gmNI8Dx9ki57yzGrcqt_0dsGTMwOxMDw&google_hm=sfuQAqbfQOeDDBs7ygZPayU

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:13 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmQB922FWrtqVOZXKwpSjbH5aw6vmKLBPaLNaCtmftdvYqyTsCDJ6HK3ByOSCIo6gmNI8Dx9ki57yzGrcqt_0dsGTMwOxMDw&google_hm=sfuQAqbfQOeDDBs7ygZPayU
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1790
Redirect Chain

https://s.uuidksinc.net/match/47/?remote_uid=CAESEHcwP_L5rWJ6-4K1gsY9vls&c_param1=AXcoOmQv4jmmHKWrF1pTLbggDsdhyXe8Df_swqIQDYd0oDah14ChbeARc5UNt3XiTq0UfLnefjcm0npQlfjLKaQibzo4qjVqwT3Sjg&gdpr=%%GDPR%...
https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=AXcoOmQv4jmmHKWrF1pTLbggDsdhyXe8Df_swqIQDYd0oDah14ChbeARc5UNt3XiTq0UfLnefjcm0npQlfjLKaQibzo4qjVqwT3Sjg

170 B
188 B

17ms
17ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=AXcoOmQv4jmmHKWrF1pTLbggDsdhyXe8Df_swqIQDYd0oDah14ChbeARc5UNt3XiTq0UfLnefjcm0npQlfjLKaQibzo4qjVqwT3Sjg

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=AXcoOmQv4jmmHKWrF1pTLbggDsdhyXe8Df_swqIQDYd0oDah14ChbeARc5UNt3XiTq0UfLnefjcm0npQlfjLKaQibzo4qjVqwT3Sjg
date: Tue, 12 Dec 2023 08:43:13 GMT
server: nginx/1.23.2
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1790
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEEIKUJYRUX9g2kuaJ4SJ7w8&google_cver=1&google_push=AXcoOmRlh4O_z6xZGVD34-swye8d00Hv0NbpZE2xghPlIllLS-J-HA3oJMnjCY-0SE8o2-zQy-e3jo5Udm0-pt4k9...
https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEEIKUJYRUX9g2kuaJ4SJ7w8&google_cver=1&google_push=AXcoOmRlh4O_z6xZGVD34-swye8d00Hv0NbpZE2xghPlIllLS-J-HA3oJMnjCY-0SE8o2-zQy-e3jo5Udm0-pt4k9...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AXcoOmRlh4O_z6xZGVD34-swye8d00Hv0NbpZE2xghPlIllLS-J-HA3oJMnjCY-0SE8o2-zQy-e3jo5Udm0-pt4k9v-_7bkFskz6Zg&google_hm=HzsrpGZH453ac6nVTA6-...

170 B
188 B

17ms
17ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AXcoOmRlh4O_z6xZGVD34-swye8d00Hv0NbpZE2xghPlIllLS-J-HA3oJMnjCY-0SE8o2-zQy-e3jo5Udm0-pt4k9v-_7bkFskz6Zg&google_hm=HzsrpGZH453ac6nVTA6-50Kp

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Tue, 12 Dec 2023 08:43:13 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AXcoOmRlh4O_z6xZGVD34-swye8d00Hv0NbpZE2xghPlIllLS-J-HA3oJMnjCY-0SE8o2-zQy-e3jo5Udm0-pt4k9v-_7bkFskz6Zg&google_hm=HzsrpGZH453ac6nVTA6-50Kp
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap1ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1790
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEFp_cKJahL_0Cfo0Ddfij0Y&google_cver=1&google_push=AXcoOmSxe_8GB-EZ7zLNv5kBYF0-eCR3jJXmD5t9gqZdc5NI1UueiqPTnK4Nx_Kn14ZZz8zn6uuKaiTGBYl2...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmSxe_8GB-EZ7zLNv5kBYF0-eCR3jJXmD5t9gqZdc5NI1UueiqPTnK4Nx_Kn14ZZz8zn6uuKaiTGBYl2P05Z38vxj3tC_Qsb_Q

170 B
188 B

18ms
18ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmSxe_8GB-EZ7zLNv5kBYF0-eCR3jJXmD5t9gqZdc5NI1UueiqPTnK4Nx_Kn14ZZz8zn6uuKaiTGBYl2P05Z38vxj3tC_Qsb_Q

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmSxe_8GB-EZ7zLNv5kBYF0-eCR3jJXmD5t9gqZdc5NI1UueiqPTnK4Nx_Kn14ZZz8zn6uuKaiTGBYl2P05Z38vxj3tC_Qsb_Q
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2 204 /
cc.adingo.jp/adx/push/ Frame 1790 0
44 B 764ms
251ms Image
text/plain 52.194.38.29
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cc.adingo.jp/adx/push/?google_gid=CAESEF880Gxliy0RX_58i2klOuU&google_cver=1&google_push=AXcoOmR3HdMe51fwMQxjJlCcF8fSJ15sqMH3rFoxLfNHZUfbEC96CYhcciBpucGeULfo9BohAv0p2r3lg_OBKJxQNVQDtAHPMYQ7
Requested by: Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.194.38.29 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-194-38-29.ap-northeast-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:13 GMT
server: awselb/2.0

GET
H2 204 v1
match.sharethrough.com/E4rooAtA/ Frame 1790 0
35 B 64ms
8ms Image
text/plain 18.193.96.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/E4rooAtA/v1?google_gid=CAESECALUraslr0zovC1W5eBWcM&google_cver=1&google_push=AXcoOmSLNQjHnQCzbz89yV_ViciAj5Ed2uT-Xqt_jAw7AC55UDiuTN4TJ9FQ36Va8rp8C_6ew_8rSeN7Y3E_j43EnJU8L_37VCIn5q4
Requested by: Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.193.96.13 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-193-96-13.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:13 GMT

GET
H2

200

0.gif
id5-sync.com/i/495/ Frame 1790
Redirect Chain

https://sync.inmobi.com/gob?google_gid=CAESECDTvJNMw7Ax-epBVutTDaQ&google_cver=1&google_push=AXcoOmRD8VBicZ35rli3i_aVVg84qL1u5YD9jQUovSjC8xYLHzq-AvJ162Rhx2jHLvmKo-fRGTqyUfu9qHmIJTavGKGA2Nj7njpZYg
https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAXcoOmRD8VBicZ35rli3i_aVVg84qL1u5YD9jQUovSjC8xYL...

43 B
920 B

8ms
7ms

Image
image/gif

162.19.138.116
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAXcoOmRD8VBicZ35rli3i_aVVg84qL1u5YD9jQUovSjC8xYLHzq-AvJ162Rhx2jHLvmKo-fRGTqyUfu9qHmIJTavGKGA2Nj7njpZYg

Protocol

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-type: image/gif;charset=UTF-8
date: Tue, 12 Dec 2023 08:43:13 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
p3p: CP="CAO PSA OUR"

Redirect headers

date: Tue, 12 Dec 2023 08:43:13 GMT
content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
expect-ct: max-age=0
x-dns-prefetch-control: off
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=utf-8
location: https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAXcoOmRD8VBicZ35rli3i_aVVg84qL1u5YD9jQUovSjC8xYLHzq-AvJ162Rhx2jHLvmKo-fRGTqyUfu9qHmIJTavGKGA2Nj7njpZYg
x-download-options: noopen
vary: Accept
content-length: 273
x-xss-protection: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 1790 0
12 B 16ms
15ms Image
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IF4143jXl89C2loaQeL6TXVJ4kKnfLkzx5BxMAA8gpGkJ3pakSZra7ID20mX5ON2chQZb8gO0

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-35-176-121-206.eu-west-2.compute.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:13 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1 200
OK viewability Show response
hal900021.redintelligence.net/ Frame 2552 0
150 B 21ms
8ms Script
text/html 144.76.238.55
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900021.redintelligence.net/viewability?s=69274600041506204444994012536021&a=69222488&vb=m
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request_content.php?s=69274600041506204444994012536021&a=c010e8a2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 144.76.238.55 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.55.238.76.144.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900021.redintelligence.net/request_content.php?s=69274600041506204444994012536021&a=c010e8a2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Tue, 12 Dec 2023 08:43:13 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 3AFE 53 KB
19 KB 11ms
8ms Script
application/javascript 18.66.147.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=69274600041506204444994012536021&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-120.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fbc6bed540723f219a878e5735ae8cb1c05aa9f7012bf21870cd79e41af25bcd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 01:58:49 GMT
content-encoding: gzip
via: 1.1 6b25d4ce9efa3f2699980e1915129606.cloudfront.net (CloudFront)
last-modified: Thu, 23 Nov 2023 16:26:10 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P4
age: 24265
x-amz-server-side-encryption: AES256
etag: W/"1180a1bfee0aad979766ecd6180b923e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: OklIS5EAiIQLC97SYQYr6rTyD8x9x1rY3JeUpw_eB7Ir9HlLDqX2CQ==

GET
H2 200 1x1.gif
cdn.track.production.webgains.team/7121/ Frame 3AFE 85 B
419 B 9ms
6ms Image
image/gif 99.86.4.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.gif?Expires=1702370893&Signature=Czk-tA3r--Z-FIpC~lpyjvBk4nNN8IjzR3k46Kvl1aYd9CQqgMh2sMPXdMjB9qzAm2as~Cc0bqsDtYxSc70cHTkVH23xZBsjrN-FMDEQuuzCTr-cbAW5nOPLbX4mDCSB365d4UPa-W0ex3IW6Jf30NEeK2Ccj~Xs4hgN4vL6DvYdJ1Z-JvRkmbUYemOKdqAq-puEr3SmtulBvdPmXTuRj7f1ThRSRMGCZf2fFqNDe-Zp914JQdru~822ytgdq8JFUEXx3ng7Q~~5RQ3CjjLjtvszTvn~XeYJu-z5LFR8ES6Wpk51TQVBtlbAqn-H6p7vGaX56pAZe5q3f1PjZ2C4yQ__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-94.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 08409d08d8d118c6c6d1c375e079bfce656ac367ff4d1dd9551fff110033c185

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-version-id: null
date: Tue, 12 Dec 2023 04:35:09 GMT
via: 1.1 78059242182c195ff7f26013772da09a.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
age: 71692
etag: "70af33d70b6810475aae19743c8c435b"
x-cache: Hit from cloudfront
content-type: image/gif
accept-ranges: bytes
content-length: 85
x-amz-cf-id: spOCKjJc3oGCuclvKE5EjDQCrGeM3aZfY7cdOTTkrzziDTMF4DXjzA==

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 2552 14 KB
15 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900021.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 17:12:00 GMT
x-content-type-options: nosniff
age: 55873
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 10 Dec 2024 17:12:00 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 2552 15 KB
15 KB 11ms
10ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900021.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 11:13:55 GMT
x-content-type-options: nosniff
age: 336558
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Dec 2024 11:13:55 GMT

GET
H2 200 dc_pre=CNjj59PAiYMDFT0HogMd7GUAVA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3323952104246.1353
adservice.google.com/ddm/fls/z/ Frame E883 42 B
107 B 47ms
46ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CNjj59PAiYMDFT0HogMd7GUAVA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3323952104246.1353

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CNjj59PAiYMDFT0HogMd7GUAVA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3323952104246.1353?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 215E 42 B
64 B 44ms
44ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss7fv11CKbPfiUJQzi0IoMwiGfqLp81c0BacVdHPwfnmcSlNSfca5DQLFQyKej3arWgPWXzvv6pDd3jWdQxDDlv8WREYI3XjueVRrojHqnLEWXOlxNQA2lqlgYg9UYQDw0kptRQvlDt_OQ&sai=AMfl-YQldIAQCGP0vMSZ_nFEpWxxZ531Ow3bhvI94pp9XjYfrNJOy2vjQYMdubj9Nk8sjO9D9XdZpvHxT8fZmyV2106YlnTClF_zI-sK4GgBX-TDUkJ7c-rpfF-0wtQ&sig=Cg0ArKJSzO1ETtEx8oCAEAE&cid=CAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE&id=ampim&o=436,310&d=728,90&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=136&tls=1136&g=100&h=100&tt=1136&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 781F 42 B
64 B 51ms
50ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu2PHx3gSu-pG92jXUWPzOIWGic_lEfrJGUqq36FztBGPcO34smZKnlDRPYYeUU8cZhaL3P98SR9UyrIod89pY6VK786vR8_Lx9KgW_lw0vnpR2QpLIbF9YAPkIX9cPWSNc6IpliVfguLrbpi5C2mhuWsXc&sai=AMfl-YT37BLG7u3vMu9B52btbvZ7eMuRkOktFO1HSfUvqMdAU3bCAdr_Z21YToNrgiIjD1H8lozf4Rhi2iCqPF8HkaE1PYaDohyjlFvx7CovYH0j0HNr0MmusgpRYww&sig=Cg0ArKJSzH-yeeeol39FEAE&cid=CAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE&id=lidar2&mcvt=1000&p=495,1250,745,1550&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231211&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=15329010&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1702370592312&rpt=237&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 781F 0
20 B 41ms
41ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=1203421645681&version=m202309260101&ct=119&x=1&cor=2420888087035578400

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 102ms
102ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8344adb2185492a8-FRA
date: Tue, 12 Dec 2023 08:43:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Qif%2FW3%2BCWPZNNpF2cvAuR9gwXcZ3eB7Neubg15p4q%2BY97tjfvrhOr3O%2Ba6SfJJhjB63tOFQnIkXtuL9n7RE0Ff3FSX1ahMd3P9nlnim32jmD2z%2FtO6Z%2BvPY525Idwf%2F7h47skqt1zNY3BgpKRGw%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
259 B 107ms
107ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-92cafdd1.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Dec 2023 08:43:13 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Jv9qQiW5LwrPCAEriiTbwp5HcZQRfOvYapvsmyxZA1GRlIce4peFyxJ3tkkJ5tG4WkQcmXoKxbkSpOBn9kGwX%2Bm%2Ba0%2BUk6nMx8vdPJ9l8plmj9lZpJvWBRqLU9zYcZWwtM9g04RvUbkAoVZRXek%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8344adb2c8c292a8-FRA
content-length: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 6536 42 B
64 B 45ms
45ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvOOzPZuEPY7MxSIuIppHcB8gpB-502ayUESOvj5YYstR2jWz9l_H21uj9DLIuiFRtMjVsjAEQbtiB-ySVi9YAzifuArK2zkxni4QrIODhHs9oHdJQLbeeJFU4F1B2NU1Eve0M7r0ThtUM&sai=AMfl-YQMTEekshGd5rHnYlH7r0ufdksF3-8tThw0wz4kn1II6Pkmr-NKfhWeHkzva454OUqkcMgxsvvQ_AOv1hFS8pYln9Pe2-_5BOXaDp9w4Z38GHdiKaIfdeSGHw0&sig=Cg0ArKJSzFqLBgsEQ7lyEAE&cid=CAQSOwDICaaNgT0YSU3lEXJQRTIdL1lfAIgTFHWzcEpu_8sH-8VotevMmr35lxmS_Y8PMYXZM9vGaTgEBQ3xGAE&id=lidar2&mcvt=1022&p=1110,436,1200,1164&mtos=1022,1022,1022,1022,1022&tos=1022,0,0,0,0&v=20231211&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=1529572179&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1702370592316&rpt=507&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 6536 16 B
209 B 69ms
68ms Fetch
application/json 35.176.121.206
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.176.121.206 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Dec 2023 08:43:14 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 99ms
20ms Preflight 35.176.121.206
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.176.121.206 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-176-121-206.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Tue, 12 Dec 2023 08:43:13 GMT
server: nginx

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 3AFE 16 B
209 B 73ms
73ms Fetch
application/json 35.176.121.206
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.176.121.206 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-176-121-206.eu-west-2.compute.amazonaws.com

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Dec 2023 08:43:14 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 93ms
21ms Preflight 35.176.121.206
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.176.121.206 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-176-121-206.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Tue, 12 Dec 2023 08:43:13 GMT
server: nginx

GET
H/1.1 200
OK viewability Show response
hal90002.redintelligence.net/ Frame 3848 0
150 B 20ms
7ms Script
text/html 46.4.10.47
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90002.redintelligence.net/viewability?s=41235600036525004444550012536002&a=d200db51&vb=v
Requested by: Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request_content.php?s=41235600036525004444550012536002&a=9111ab7a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.47 Rostock, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.47.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/request_content.php?s=41235600036525004444550012536002&a=9111ab7a
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Tue, 12 Dec 2023 08:43:14 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C329 0
20 B 42ms
42ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=8310565416545&version=m202309260101&ct=77&x=1&cor=826161166376599700

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6536 0
20 B 42ms
41ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=248623719153&version=m202309260101&ct=77&x=1&cor=10254026097930027000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3AFE 0
20 B 41ms
41ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=2342535617085&version=m202309260101&ct=77&x=1&cor=10169969901019320000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 104ms
103ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8344adbdafdf92a8-FRA
date: Tue, 12 Dec 2023 08:43:15 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gNgnc%2FkR67x86fCVbSyi85zHnwEi%2F8so5DhnshkJwYjUmGhN5IdaiQt%2FkpY9Y3fDy6FDVU%2BQf%2BWZOnW%2Bcove28WhDbAhdGAnZg2xXn9M%2FkMlfzaL7iA0Y15nPEASRL3vFkkXDhuLZHcLxklXGKc%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 108ms
107ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8344adbdafe392a8-FRA
date: Tue, 12 Dec 2023 08:43:15 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r8u%2Boa%2Fo1eQ2j9UpQJR8LzBq6wmfMfa1MV1ebtYfjpErGTJR8gKBnTDpNP2CQK5WuJTvfuQxNLdBShRcodOdH0E237BQvY4CZnmzPeZKZqiauqYC0WCGe7QVKmkkgGqbONyEO28pkQachAUcym4%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
261 B 102ms
102ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-92cafdd1.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Dec 2023 08:43:15 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FNYbZzdxcgxOpOHbtBqo3BLfFGgCwdzelseOAIHbC5cw%2Bh95dcSOWMqKHLYQAOtaqOJUS%2FgJcF%2BYAWRZ%2BDmgWvjkOBrkhFhq3uHw5rnsn9HZ1rFIexmhYxEz7ZbGbb0J5ObGu8USFnYx1equFf8%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8344adbe585292a8-FRA
content-length: 0

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
257 B 107ms
107ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-92cafdd1.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Dec 2023 08:43:15 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7gu8tacgmHbbTtYaQnpGGvTR1xlJ6PkOsx0iaKgFd2Y3ZB8f9eDPr0ZB4UT2r8gn0DmIK%2BISWyXb3k9Lbjo6hHoZW0IjfKQ4HPp7D2%2FOyPqiQhu7NOPTnG3Ts8ePan%2FHVlh32g6a1q3W9RLFHLo%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8344adbe585892a8-FRA
content-length: 0

GET
H2 200 inserts.js Show response
tags.qortex.ai/components/inserts/dist/inserts/ 127 KB
43 KB 23ms
23ms Script
application/javascript 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/components/inserts/dist/inserts/inserts.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-92cafdd1.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 462478cd501b11de6f111719b46b8c46375ffeba611413f99b1844814a19eec8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:15 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 29 Nov 2023 15:28:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 63
etag: W/"120"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FQiJ%2Fgn40jgaahSNufaRoqrfE5Q4bttHmMjWOiC74Ghmfa0pGZVzpw3md5qWs6gTW01fqjEbQTaXQdVsQH%2BWo52AUfjMBGaAbeqJDhduFjyF1TXGWrcsTXNrE6%2BwWG3G%2FLnTAmKgbfEEqDN7"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8344adbdaf569b37-FRA

GET
H2 200 p-64ee7c76.system.js Show response
tags.qortex.ai/components/inserts/dist/inserts/ 5 KB
1 KB 14ms
14ms Script
application/javascript 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/components/inserts/dist/inserts/p-64ee7c76.system.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-overlay.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: c3215027ca249cdbf9ffed54db340245cac215b0c23fa609119a27cd2c37a54a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:15 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 29 Nov 2023 15:28:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 62
etag: W/"120"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ByFOhXclPKraTQ0GskBUbRif%2FROtGTevM0n%2FXnDxd8CpZbYk5e%2FoOqXC6WrZrqjWy95Yac%2BUjDlo5DuP8q2dUF9irKvFm%2Bd3xSerf2cVR9U%2BKFrhxxpC4G9Q%2FR1CkxSQSoenhR6fTGnGkUGR"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8344adbdef909b37-FRA

GET
H2 200 p-519aaece.system.js Show response
tags.qortex.ai/components/inserts/dist/inserts/ 18 KB
7 KB 17ms
17ms Script
application/javascript 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/components/inserts/dist/inserts/p-519aaece.system.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-overlay.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 7de421f5fc292856d86cd03dba3ad6bab58657ea6c554221445a834e5fa09649

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:15 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 29 Nov 2023 15:28:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 60
etag: W/"120"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yanTAyRxQaL6R0TfkyJxmItMoGVQRk5C13SDQCQxCaeH%2BbnLDDVbIqh9UIlthec8rrvAuHptC1CBY938fikOzKzcTgPaBinN1U12HEya3rC8wOLTApZ7IbFC6V871W170LrRrW0u5t2A9E25"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8344adbe0fd99b37-FRA

GET
H2 200 p-9efd87b0.system.entry.js Show response
tags.qortex.ai/components/inserts/dist/inserts/ 56 KB
13 KB 393ms
393ms Script
application/javascript 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/components/inserts/dist/inserts/p-9efd87b0.system.entry.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-overlay.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 7379f54fee3b6e796115e80fa8f9884272355c4f120eb1ca87e2ad221f3611a7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:15 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Wed, 29 Nov 2023 15:28:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"120"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uMKVom7idu3zXuGSkuNg7hmRhH47K7Mk%2FHgVsHxk%2BKFVtFGzI1u5UdSpVHPm4rs80gHGZudhWWVF3JW87gexOkZjMiN9l%2Fj4H4rQziKUqqLcbPE8mrwdlX9qv0O9vwGLqQyJLMsJBKZcQmP0"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8344adbe2ff89b37-FRA

GET
H3 200 envelope Show response
lexicon.33across.com/v1/ Frame 4B30 49 B
65 B 95ms
95ms XHR
application/json 35.244.193.51
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0015a00003LiqV3AAJ&gdpr=0&src=pbjs&ver=8.6.0&coppa=0
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/library/prebid/8.6.0/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: d0d2e098cd489ef7bc528c86de8ab5c51b5d6cdf9b76a8b08766036992f0d2f4

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 12 Dec 2023 08:43:15 GMT
via: 1.1 google
vary: origin
content-type: application/json
access-control-allow-origin: https://simcast.com
cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 51C6 281 B
555 B 49ms
14ms Document
text/html 2.19.217.60
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/library/prebid/8.6.0/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.19.217.60 Prague, Czech Republic, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-217-60.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 12 Dec 2023 08:43:15 GMT
ETag: "280525-119-60930cbd3cec0"
Last-Modified: Thu, 02 Nov 2023 19:57:23 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 51C6 46 KB
13 KB 14ms
14ms Script
text/html 2.19.217.60
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.19.217.60 Prague, Czech Republic, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-217-60.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: e82975d064a5db53a828a869d8651cc1af1c7718af5b13c360ef17a61c537d84

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Tue, 12 Dec 2023 08:43:15 GMT
Content-Encoding: gzip
Last-Modified: Mon, 11 Dec 2023 19:16:50 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=37968
Connection: keep-alive
Content-Length: 13232
Expires: Tue, 12 Dec 2023 19:16:03 GMT

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 51C6 7 B
380 B 55ms
9ms XHR
application/json 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 81c2cbe50044dac07e1ac9ea9841ac415bdc38dd2f6b915ab044bf69ee71c628

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 579d6dd278f76ae39d067788043e4297
Expires: 0

GET
H2 200 p-088fd4b1.system.js Show response
tags.qortex.ai/components/inserts/dist/inserts/ 113 KB
40 KB 17ms
17ms Script
application/javascript 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/components/inserts/dist/inserts/p-088fd4b1.system.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-overlay.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 0bd59a8e174cc94d8f23112b317fac39a481b88f8bad2a04c384c5ffd8a4f988

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:15 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 29 Nov 2023 15:28:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 58
etag: W/"120"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6JV6H9k66FXy19GK%2FW%2FLYqErXdmYJzSbGq7Pjzy2hX1TD9Jv%2BLNr2e6HzCilUiD0%2FUkh3SdIdRdAuWTcZf828IvBbjFTl0YV%2Fd6vqPbJlWIJb8O%2F1jXZJkVj4q2tZEkGVBQOAIXpk2TawI6i"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8344adc09a189b37-FRA

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 103ms
103ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8344adc0c9f592a8-FRA
date: Tue, 12 Dec 2023 08:43:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a7U7ffWW1Pxr7JmV0nma2qUO25Yt0%2BwQ80N8UcF%2BXrkoZf0ws7CCIDtD4TCIYZKPl4VZ%2BdckEUuVgap7hBxpHstECSb72X4ToC0712%2BJ6SYWn1kt5kSUbDrskslxIozFP9bgJ7I2tJO5htp2G3I%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
261 B 108ms
108ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-92cafdd1.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Dec 2023 08:43:16 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cKvktUGD8Q%2B52ELm9EsDXlM7Opa8xlnj2V3gHm5b0LfGfBPGnGXw0TuJSAOycLCNSl2gZsCYRkwJMUZ64vh7fOh9byIgn1GlFWR4u32cnD%2Ftu%2Bi5U4JoRqfbgU4jJj6mxCHUNyM2Ac2IyN6OBWU%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8344adc17a6292a8-FRA
content-length: 0

GET
H2 200 Generic-BugFlip.png
tags.qortex.ai/assets/inserts/shared/common_images/ 407 B
747 B 201ms
200ms Image
image/png 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.qortex.ai/assets/inserts/shared/common_images/Generic-BugFlip.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 92ef728984670149848a09c8a589b1ca470fe602065dee127c26a0dcab2115a5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:16 GMT
cf-cache-status: EXPIRED
last-modified: Wed, 29 Nov 2023 15:25:43 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"120"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PosVVsymhrqU98yf4qCtvD1ydDQSKbNxfRuf5HkES1Ml%2FZchOC5UuhJLpVKFM1%2FLW30mK55xrAvJ%2BjNY43sGTxsj%2Fj4YkWAPcu5%2B5XaARCdhk1dpUutMSvk5nmLq9bw29yknL8BW022hzdlK"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 8344adc0da4b9b37-FRA
content-length: 407

GET
H2 200 PNG_CloseButtonOutline.png
tags.qortex.ai/assets/inserts/shared/common_images/ 1 KB
1 KB 17ms
17ms Image
image/png 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.qortex.ai/assets/inserts/shared/common_images/PNG_CloseButtonOutline.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 430cc3198a26a9b7438c95aeb5ff9ae90437059a690cdd1287c57070f52d2982

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:15 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 57
x-powered-by: Express
content-length: 1080
last-modified: Wed, 29 Nov 2023 15:28:28 GMT
server: cloudflare
etag: W/"120"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=udpcr25hEJmshSlks3FiavaVjlQWSOESeJAeTYbdeWKuj5gNHromWXrsfgMgIx0yVXK8PQocdMGEkxCSJL2zikx%2BeDVZwqAI2mpBnrAivA7qIczbF4F7CorvcNyc8P%2B8uABkI8%2Fh1vluC3oQ"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 8344adc0da4d9b37-FRA

GET
H2 200 PNG_CloseButtonBackground.png
tags.qortex.ai/assets/inserts/shared/common_images/ 554 B
879 B 16ms
16ms Image
image/png 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.qortex.ai/assets/inserts/shared/common_images/PNG_CloseButtonBackground.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 9e399906113e82fdca498a58d00013adda68308481605fcae2d488772559425f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:15 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 57
x-powered-by: Express
content-length: 554
last-modified: Wed, 29 Nov 2023 15:28:28 GMT
server: cloudflare
etag: W/"120"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kyVJ0GBqsA6%2BRVLbn8EsXLJAx8ZFNtQukpwokwHrdqCNe45zfZxhbxwu2KPHoUK7FURS%2BymDAhKsmvuUKcGa4XgyIdAYmH8YyO%2ByXcRSB7V6OOJH398c8ubK0EZFzJ3UyFzjEuKca4HJVVy4"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 8344adc0da4f9b37-FRA

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 109ms
109ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8344adc2cb4e92a8-FRA
date: Tue, 12 Dec 2023 08:43:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bltu3c5S4JOrWu%2BDEj1xDl%2BLElZuKNVstDR5BelM6VSfCFnHlgOE82Vak4Jz5QNdWQyHuJ7x4b7Nh9xxYa37iUG2PrD1ew4OC%2F4%2B1NO%2FVAwc7hvByXhUSKwkQNSDwYWv7hPnEgnxUJ5hMn7Y1dE%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 107ms
107ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8344adc2db5692a8-FRA
date: Tue, 12 Dec 2023 08:43:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=88WncsxJEoNf4P2LZ%2FKEdvlBs9wlEfoORq0Q8uZ9d5t2hDjhN6DNUBFrVREhpRtRBSS9wpAjOwQbh%2FhrPDilDMPBVX4L%2BR4MxrGTszQE7mIg2Zdxjd6nrAIcglm1QeBj9QpuQdv1npUH%2F24GgxI%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
261 B 102ms
102ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-92cafdd1.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Dec 2023 08:43:16 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WAEKtuuWBplDsqKmTRcRCAQ77upU3T%2FpTSUsi%2F3FujiMUgNRiYNek1B2cdNC2F7eMgAhsnGBRbIjqeUXRj72Rkhbg0cm8Io3tb8hIB70CkLDSlPqX%2Fs%2F%2BW2x12euCS5MScMKsQszJe%2BjnTxxRIg%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8344adc37bcd92a8-FRA
content-length: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 39 KB
16 KB 330ms
330ms Fetch
text/plain 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=101578578091841&correlator=4325014922779118&eid=31080078%2C31079240%2C31080057&output=ldjh&gdfp_req=1&vrg=202312070101&ptt=17&impl=fifs&iu_parts=22181265%2Csmc_cx-on-stream&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ifi=7&sfv=1-0-40&sc=1&cookie=ID%3D66fb6c22fc3a9635%3AT%3D1702370591%3ART%3D1702370591%3AS%3DALNI_MZfkuKH80pSF1_wip-yIKt6kIED3g&gpic=UID%3D00000d13d15adb7c%3AT%3D1702370591%3ART%3D1702370591%3AS%3DALNI_MY9JyekvrIrLvDkoduC0JaTpgV3-w&abxe=1&dt=1702370596285&lmt=1702370596&adxs=20&adys=495&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvinpearll-resort.ph%26pcid%3D48%26rid%3D112%26a%3D0&ref=http%3A%2F%2Fwww.vinpearll-resort.ph%2F&vis=1&psz=760x-1&msz=760x-1&fws=4&ohw=760&ga_vid=1249156730.1702370590&ga_sid=1702370590&ga_hid=1461476486&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRiCicfpxTFIAFICCG8SGAoJeWFob28uY29tGLWIx-nFMUgAUgIIbxIZCgp1aWRhcGkuY29tGIWIx-nFMUgAUgIIbxIbCgxpZDUtc3luYy5jb20YhYjH6cUxSABSAghvEhwKDWNyd2RjbnRybC5uZXQYhYjH6cUxSABSAghvEjsKCnB1YmNpZC5vcmcSJDQ1YjY0YWIwLTIxZDQtNDgwOS05MmIyLWIwMmIxMDkyODVhMxiFiMfpxTFIABIdCg5lc3AuY3JpdGVvLmNvbRj5h8fpxTFIAFICCGQSggIKCHJ0YmhvdXNlEuwBaGxyU0lsYldiR0kyUHdoSGJZV3hKaFc0TVJSQWRwRTEwVWFtTnBFN2t0dUhNWjJNYTJlUnBpaEp3M2FEbUVZNnJhWVh6eG1LeGZwc0k3OXd4bEViWml2ZlNrTXJiTWthVVhySFhyT1ZaSGpvSUJ1emJaSFBhM3F4cWZvVUpZa1BoakNKWUVGcG12S0d4YXNLWW1zRFJwQ3dnZG1yRDhpUTcxdmpDQTd1Uk9PeFIwQWF3TXEzeWpTazlzTWx2V2dBa2F2bjBQdFZtRURIVkxjVTUxMVc2U3pQRjZmNUVWRCs5Vkt3US8rRkJyYz0YkInH6cUxSAASPgoFb3BlbngSLGV5SnBJam9pZDNRNWIwdEliMGxTYXpKUmNIVlFSMVExUmxKS2R6MDlJbjA9GLyKx-nFMUgAEhsKDGxpdmVyYW1wLmNvbRiFiMfpxTFIAFICCG8SHQoObGl2ZWludGVudC5jb20YhYjH6cUxSABSAghv&dlt=1702370589093&idt=730&cust_params=gcRTDTest%3Dtrue%26pbstck_ab_test%3Dtrue%26wvr%3D3%26wie%3Dtop%26cndl%3D10%26cnrtt%3D0%26cntp%3Dna%26cnet%3D4g%26cnsd%3Dfalse%26wrc%3Dfr%26gpt_l%3D300%26wrap_l%3D1700%26ccp%3Dunknown%26sesdepth%3D1%26page_r%3D500%26padpr%3D16%2633acrossId%3Dfalse%26amxId%3Dfalse%26criteo%3Dfalse%26hadronId%3Dfalse%26id5Id%3Dfalse%26identityLink%3Dfalse%26liveIntentId%3Dfalse%26lotamePanoramaId%3Dfalse%26pairId%3Dfalse%26quantcastId%3Dfalse%26sharedId%3Dtrue%26teadsId%3Dfalse%26uid2%3Dfalse%26uids%3Dpubcid%26uids_c%3D1%26waai%3D700%26gc_bucket%3DB%26waae%3D1500%26pbglobal%3Daaw%26tif%3Dtrue%26lui%3D2s%26pad%3D14&adks=820046595&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e5cf94d13ff41ccdaf6b093f9d72dd946d75e794bb056d040e6d71b424a4fb13

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:16 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16026
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://simcast.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
261 B 108ms
108ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-92cafdd1.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Dec 2023 08:43:16 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L%2BMOI36Q1h%2Bh0ht7LLz3Y0bOGc2109ChNejpNOJPLJMbZgxuyhnCa4MP89kI5%2BDryAH4gYjuXKK0xwbo6TY9S62T1zgMzZWRyqcudip3LshcK7cyuEMSBrE3CccUc4%2F6zlJn9uVI%2FBkOjlVJBsw%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8344adc37bd192a8-FRA
content-length: 0

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 187ms
187ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8344adc2db5a92a8-FRA
date: Tue, 12 Dec 2023 08:43:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Gojr%2F9vnQ3fhO5BvmrYcm%2Bu7SVQBJA8Kjv6oE7Q2eBmdsktRX8VvAa8C16MNpafrU3CKV8s9Zej3%2Fz1QYpCqpMFdqEDuPuG3DtWXJBgD9ssZIrlOarH18QgtZqRNtJ6X49DXnnRIS%2FX8LptJAFk%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
260 B 100ms
100ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-92cafdd1.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Dec 2023 08:43:16 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xfd2QOdocNAqkk%2FzaPSBqR8B9wI1caOE%2B067bW3JPe88Q7uWiD5yrcEFhqkU7OfmfdpaMf0PC0DW9AVdd13Cm4ul%2FpUL8nsgf9By75%2B96ppbKGLk5%2BH8oByYf94gByBtXF0GHSwMQ5MhUMdeowI%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8344adc40c3292a8-FRA
content-length: 0

POST
H2 204 prebid Show response
ib.adnxs.com/openrtb2/ 0
631 B 7ms
7ms Fetch 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/openrtb2/prebid

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-52-30-208-25.eu-west-1.compute.amazonaws.com

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:16 GMT
an-x-request-uuid: 9feda583-f6fd-46db-9e79-8570aee73116
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin: https://simcast.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 81.95.5.37; 81.95.5.37; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 pb Show response
ad.360yield.com/1914/ 0
164 B 31ms
31ms Fetch 52.19.94.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.360yield.com/1914/pb
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.19.94.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-19-94-255.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 12 Dec 2023 08:43:16 GMT
access-control-allow-credentials: true
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

POST
H/1.1 200
OK hbjson Show response
grid.bidswitch.net/ 25 B
363 B 25ms
24ms Fetch
application/json 3.127.32.193
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://grid.bidswitch.net/hbjson
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.127.32.193 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-32-193.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: dbb07786d0fa9b9e5dcbef01f6cc98a090f841d9e2c73011e8ce8d012bf2fb69

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

Date: Tue, 12 Dec 2023 08:43:16 GMT
Content-Encoding: gzip
Server: nginx
Content-Type: application/json
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
Connection: keep-alive
Content-Length: 50

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
41 B 15ms
14ms Fetch 145.40.97.66
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 145.40.97.66 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

x-nbr: 8
date: Tue, 12 Dec 2023 08:43:15 GMT
server: envoy
vary: origin, Accept-Encoding
access-control-allow-origin: https://simcast.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
407 B 21ms
21ms Fetch
application/json 51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip253.ip-51-89-9.eu

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://simcast.com
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900

POST
H2 200 cdb Show response
bidder.criteo.com/ 2 KB
2 KB 37ms
37ms Fetch
application/json 2a02:2638:3::7
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?ptv=139&profileId=185&av=36&wv=8.24.0&bundle=OhvzzV9GNVlYJTJGUGpsZGlEOUE5VGJDaEFyRlM5SmFFM0x0Z2ZoMmJPaG04dldUM0RrM0NHSkU1MyUyRiUyQnNHdnhOY1g4MVRsaHM2eUdLd1FwQlR6MlhCJTJGdmE3YkM0dFNFR3J2bjg3SmlqeDZjazcxVFBHVnZrcUFOeFgwUnBKdkFhNmw0ZXdzaEFCMjllQnpnTUo1JTJCY1RjWWVQSFRnJTNEJTNE&cb=95891739052

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::7 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

42839d6946608554a242c763509e31a3f788f2e3e2afcc02a89e5e8e74e04681

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 12 Dec 2023 08:43:16 GMT
content-encoding: br
strict-transport-security: max-age=31536000; preload;
server: Kestrel
vary: Accept-Encoding, Origin
content-type: application/json
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 334 B
341 B 23ms
22ms Fetch
application/json 34.120.63.153
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUQWX43D
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.63.153 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 153.63.120.34.bc.googleusercontent.com
Software: envoy /
Resource Hash: a7d6c951ac4a2dae926ee1e1596358f89314e48f668e223da94b34e984456bca

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:16 GMT
content-encoding: gzip
via: 1.1 google
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
server: envoy
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 12 Dec 2023 08:43:16 GMT

POST
H/1.1 200
OK / Show response
ghb1.adtelligent.com/v2/auction/ 4 KB
1009 B 101ms
47ms Fetch
application/json 2a0c:5c87:5241::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb1.adtelligent.com/v2/auction/
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c87:5241::2 Cricklewood, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 839ee7a5c0450b4ca9156246dbbba21da1ce882ab0c5f2f4b9a44c0e4f058e3e

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: text/plain

Response headers

Date: Tue, 12 Dec 2023 08:43:16 GMT
Content-Encoding: gzip
Server: Adtelligent
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://simcast.com
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
X-Robots-Tag: noindex
Content-Length: 703

POST
H2 204 events
bidder.criteo.com/csm/ 0
189 B 14ms
12ms Ping
text/plain 2a02:2638:3::7
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/csm/events

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.139.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::7 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 12 Dec 2023 08:43:15 GMT
strict-transport-security: max-age=31536000; preload;
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Kestrel
vary: Origin

GET
H2 200 pixels Show response
ssp-sync.criteo.com/user-sync/ 456 B
677 B 69ms
14ms XHR
application/json 2a02:2638:3::6
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssp-sync.criteo.com/user-sync/pixels

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.139.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::6 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

2eaa534af96502961ffac6fd8addbd1c18568a68090c693b9aa502835f59115f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; preload;
server: Kestrel
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://simcast.com
cache-control: no-store,max-age=0
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 189ms
189ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8344adc39bd892a8-FRA
date: Tue, 12 Dec 2023 08:43:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4lFmZ9QwMbgR6D2KYgBslybrLNtgjLJ8A%2FBJ56OBh%2BeWHtgQgmjb52BvbsmuqXPEtnFxuSzdtLzehXyT49tqWyA6NPb4odDdt66xBOs1%2FfVc5wLqa%2Bejwx58LkGbSRY1oiWTlybTYlyVcSzAyvo%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
259 B 103ms
103ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-92cafdd1.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Dec 2023 08:43:16 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9pgiBrLClV0ASjBzNi76MCbmlsNBCVyeH4C%2FKriLKNe26Hv6%2FqKGybxRsbM9VoILywDYVbzyJADI35lJRjyT3jlV76iUgoYIG6o9FEgDC4TGJASdRg2AFwPXJKdRpWc11p1jk3aEaz%2BcdMUzVxQ%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8344adc4cca192a8-FRA
content-length: 0

GET
H/1.1 200
OK cri
match.prod.bidr.io/cookie-sync/ 43 B
433 B 120ms
29ms Image
image/gif 52.30.208.25
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://match.prod.bidr.io/cookie-sync/cri?r=https%3a%2f%2fssp-sync.criteo.com%2fuser-sync%2fmatch%3fp%3dzfyEVl9GJTJGeFp2JTJCdyUyRkNjTUJCQkM2NGJCdXJ4QUEwMFVjcFNnNTgzRVRYaVN5MTgwJTNE%26u%3d%24%7bUSER_ID%7d&gdpr=&consent=&us_privacy=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.30.208.25 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
Date: Tue, 12 Dec 2023 08:43:16 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
content-type: image/gif
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

204

match
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://x.bidswitch.net/sync?ssp=criteo&custom_data=j6h-vF9JY0oyRm13Qm45NXc3cUhPMnpmZUxoS1Naa0ZrJTJGbTJqRTl5SmlIQTUxcjglM0Q&gdpr=&gdpr_consent=&us_privacy=&cr_user_id=k-czunc1w3CUIPtdRuI8AwzY6KO-w-...
https://x.bidswitch.net/ul_cb/sync?ssp=criteo&custom_data=j6h-vF9JY0oyRm13Qm45NXc3cUhPMnpmZUxoS1Naa0ZrJTJGbTJqRTl5SmlIQTUxcjglM0Q&gdpr=&gdpr_consent=&us_privacy=&cr_user_id=k-czunc1w3CUIPtdRuI8AwzY...
https://dis.criteo.com/dis/usersync.aspx?r=25&p=52&dis=0&gdpr=&gdpr_consent=&url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D462%26ssp%3Dcriteo%26user_id%3D%40%40CRITEO_USERID%40%40
https://x.bidswitch.net/sync?dsp_id=462&ssp=criteo&user_id=k-czunc1w3CUIPtdRuI8AwzY6KO-w-cfOUOMaj1w&gdpr=&gdpr_consent=
https://ssp-sync.criteo.com/user-sync/match?p=j6h-vF9JY0oyRm13Qm45NXc3cUhPMnpmZUxoS1Naa0ZrJTJGbTJqRTl5SmlIQTUxcjglM0Q&u=ca0ca925-8ddd-449e-9862-b530564c0bff

0
141 B

13ms
13ms

Image
text/plain

2a02:2638:3::6
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/match?p=j6h-vF9JY0oyRm13Qm45NXc3cUhPMnpmZUxoS1Naa0ZrJTJGbTJqRTl5SmlIQTUxcjglM0Q&u=ca0ca925-8ddd-449e-9862-b530564c0bff

Protocol

Server

2a02:2638:3::6 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:15 GMT
cache-control: no-store,max-age=0
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Kestrel

Redirect headers

location: //ssp-sync.criteo.com/user-sync/match?p=j6h-vF9JY0oyRm13Qm45NXc3cUhPMnpmZUxoS1Naa0ZrJTJGbTJqRTl5SmlIQTUxcjglM0Q&u=ca0ca925-8ddd-449e-9862-b530564c0bff
date: Tue, 12 Dec 2023 08:43:16 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 107ms
107ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8344adc4dcad92a8-FRA
date: Tue, 12 Dec 2023 08:43:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JWDvPEItHJAOLeJAmoZGScjqSXHLsbr6DYGNMIaFRf2JfZjy%2BfUH5DERnNv%2FJuZDJfV3XhNAJclJngyo9ghSuEo7Bcup06wPRfARtN2J0soL%2Bndk%2BONKpP8A4kAanHlr357thsotnR9Wm7NzeQA%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
266 B 101ms
101ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-92cafdd1.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Dec 2023 08:43:16 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q6kHM4dYOzDB8olmsH1G%2Bt%2B%2BS3XXyaP9WMhgrWO8CVwqxMwIeuKs%2BeLc25uqcbIJsDgLUIYBpAVvUSNmGHw%2FSnImlut7ZJKHCMJbr5Z0F%2B5CZ90yQyz8y5TLMEI0oWhZYLpvzaE95NPStR4HqD8%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8344adc57d2f92a8-FRA
content-length: 0

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 101ms
101ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8344adc4ecc192a8-FRA
date: Tue, 12 Dec 2023 08:43:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Aen35M3pkkyjp3mgkzNnHZfn4v5AI4YCYbVQOXAZWCHBsyKuz1qItIzP%2FFQmoOTA7LOSZLZG5MnWHChg0KQZALXpvdvyLh7dtvi%2FWHD0bZPCMuLDG0PBIHpNwlDZqrTSkE1Rg1E3uO33DIAHH9o%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
263 B 107ms
105ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-92cafdd1.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Dec 2023 08:43:16 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fLEpdQAYoUY7w%2FwZ49tKz9MskUSrWRLgb5ahJz12HV6xyis6%2FGlnvF7%2B2Ong6WR973%2FZ5%2FRUsDzBhIOcbPk2sFJiOtqTHJIpiaCIyYPSWhsoEep2PebEqOqQRHXXEoCOdAEFwKks%2BrMUAMagTOo%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8344adc58d3492a8-FRA
content-length: 0

GET
H3 200 container.html Show response
f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 63BF 6 KB
3 KB 8ms
7ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 5
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 12 Dec 2023 08:43:11 GMT
expires: Wed, 11 Dec 2024 08:43:11 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 101ms
101ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8344adc4fccb92a8-FRA
date: Tue, 12 Dec 2023 08:43:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CIEZvBdQ3OWzptiNrFDtGd63GUX923oMLHHFJHWOD7DinmBzUNs287VGtqzSiljcwdOAaUZpUtAr6ZJKqZZD0BGD6%2F9xyWgyQebeScs85WiMgpoaZ9fGor95%2B3vMyl4pjPrTaJuaz7fSKOUwAgk%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
261 B 100ms
100ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-92cafdd1.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Dec 2023 08:43:16 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lWpjrcUGoyv3Qp5AZWAYH6WMtD3F6KUzvqlKl%2BMYo5KIRUk8KxxSGg%2BFGkemDx0KL4otEgJOf4pvbLULnYylui92Z77xl8gF6oUfGBB4HFCprHtCd%2ButcjjuZuc%2Fb33%2BcbTlazzYkWyvA8fmpJA%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8344adc59d3892a8-FRA
content-length: 0

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 187ms
187ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8344adc4fcd192a8-FRA
date: Tue, 12 Dec 2023 08:43:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=smJ21n7ybZkItHg7vW3nEET3%2BRnQ3PICvzAj6NtwhX21KKOp6FMmXdrThjiaScpp57Pcuj25GxPSRfsqAU8O4EzA%2BekH2bawC%2F6Q8EwR3OhwxUl7wTd9ZOgUn4eYbz3hoya8zr%2B6yo6%2BQgbS%2BGo%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
287 B 198ms
198ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-92cafdd1.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Dec 2023 08:43:17 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3f9%2BL%2FT93JTP8RFTlIsENaPYqA6ZWDCrkmV5nzwftQdSh%2FW%2BzlAz9YU7%2BaaOdSBMc%2BCM35w6giugoFNeAYC%2FenKSN2EEKDYaeLxjvHrOqLsHV0Y7tXh7wPzGjgiKnOidGJv9j4D090z9Djq3w2I%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8344adc62d9d92a8-FRA
content-length: 0

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 6C8A 144 KB
47 KB 96ms
68ms Document
text/html 2a02:2638:3::12
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=ZXgdJAAFPrIHg6k-AAf3mgSCfPziqbbjy3igLQ&u=%7CrPeJ%2Fx4SPgjMKHfVvu44lMPmfYxjWBu2nFWhFdIL%2BE8%3D%7C&c1=d4_i42wbpE2NRhSHxThdXdeadzG9gosNB-Ap14Pg0HmFAf1GHAR2jvULOd3YfT8Kie5-AMuoqyTirKgE-lWZejSh2I_Z98DfGkr4TDT-pp2Tljw4GPbr6xXLclT1nzIdckzQJ97y5YQgE6hzQC9a-cm8xg87Gtd2Mwlctx5SKfz6MdNcDutidxhWDmWCMto-8cBriEd0fDJOi-C7t9r0Fs3eL8y08-y2UXwpq-ZqjNnfNUgWKdruR5kLx1SkeqYG7UBX0qagEISxwrCjNR4qMnLDQuA_4H1rom6d5uFGDWOQnaOjixddOp-vRlLXnuTtnxXQGctrnZDLWY3TD8uWniWMS4PGKccueEsCQLgTRQBJPAPa04SHWBGQnhsOuCMBunXz8WTZO2eojfUgYmN5P-HgUXuEtx1_iXqSNcDRcPduCV-pRFm18zF6cTWgiFTs5ywIFf8mTawPHEhb1IOgKqjjBlxtUtJLHJPb_g96wodps2h4GsKYfe-55vYdk7aXFH4vAp79u8S_lZ8LF5BSv5ecWhy8Inboxzu6DLs5Qw3NdQFSwz5fxNWnTCP47zhijFZcLHH8CRpP2ZTiWoTTvcOp32n0LBy59ASx77H6d2T06Gusqp3j_XSBRcRxwz3Ora1ls0eQDds&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCYszCJB14ZbL9FL7SjuwPmu-f2AzJntKxXNWdkfdwwI23ARABIABglYKAgJgHggEXY2EtcHViLTEwNjI5NzI4NjE1NTMzMDPIAQmpAkc5ppu2D7I-4AIAqAMByAMCqgSsAk_QZhWKIguVyKz5s2o1B8FCIqODj7HQXh48sX1Y7FXG0Nr820OdduNpt2n4JkKRFKk4enyII5Kf146Qu1tqFD_H7KQC9U8ZNIoAKuIZ3UvWIxS38rDFsI79oGeKSROIDmi-qwlHNm-LQ4GcqT9iyTC2DRRWcRGbHusnlPFpj0IHHY6uIu-rhz30Tczz4bByTQFoVRTYESZC2IbSlRk2tmVv5eLgtEPVyo7iMtH4b27s99BqhlxljPgr45ypJ4T70gEcxrIS3KT1Q7qJlRh97T3kj3cFgCaowJVTYXiOUhe7TEpxJPik4WOddadp4UZYe4xQWqwUJSbEjjK89cwNi2GQJv5FGRK5hvp6rH09PRlAVt0UsJ8qwpQcOP4vJuG2z1dU4QzyIRR4TRs_y-AEAYAGjtSynLeypa1ioAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHQiA4YAQEAEyAqoCOgKAQEi9_cE6WJbcrNXAiYMD-gsCCAGADAHiDRMI46Ct1cCJgwMVPqmDBx2a9wfL0BUBgBcB%26num%3D1%26sig%3DAOD64_0gvKK6JlQTGfsPAl4PQTfvYZp2wQ%26client%3Dca-pub-1062972861553303%26adurl%3D

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::12 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

605c14de1b6b029e28823e27e73c6d3fcb4a95d2f25caaad449fb0f455dd6378

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Tue, 12 Dec 2023 08:43:16 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=Ry62Si_p7O5RNGtx1ut53bBvbo8q9UnswPPUtTOiyGmQMfcLyIyD1-t4L9nM2iiZLeOkPqLjlFpMPP8KJdQlSV9jDh7HtEcWn_Bkpfd-nCJX5TOduYF2BgbdYwROE7rxDnVLb81fkFZSLPuxKPXZHKg5Dcr-2ovcKxR7rz6AD9xTq6hrp-NsJXlqzF-CRvTC6R1wB0XjPsJoti3_a9pbl4eHs0RS492Im0yEdKHHnqzeS7akuaBC03TTYjsOIvw9Dm_Tyg"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 51755811
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 63BF 3 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 01:54:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24537
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Dec 2023 01:54:19 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame ED56 1 KB
643 B 9ms
9ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 59106
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 11 Dec 2023 16:18:10 GMT
etag: 48472445140208031
expires: Tue, 12 Dec 2023 16:18:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 63BF 20 KB
8 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 01:54:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24537
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Dec 2023 01:54:19 GMT

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 63BF 24 KB
6 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 01:36:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25607
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 11 Dec 2024 01:36:29 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 63BF 203 KB
64 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9129c3cb5b3b6d486d719614ef0e64508258a9d15de6c8bfab167e3da9dd87f3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65486
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702315402350014"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 12 Dec 2023 08:43:16 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame ED56
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEOxJfvuCz-ISrK40vG6lxP4&google_cver=1&google_push=AXcoOmQ5BlaC1iPQiyN2xY9U0OlyqnxUDk-xUuH2QuBOCUDFOzSCQ13sxe-8KkKB7tJ-xhppAKaB91gQnXGO_m...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMxMTYyNjAxODMyNjkwNzY2MQ%3D%3D&google_push=AXcoOmQ5BlaC1iPQiyN2xY9U0OlyqnxUDk-xUuH2QuBOCUDFOzSCQ13sxe-8KkKB7tJ-xhppAKaB91gQnXGO_mb5x8...

170 B
188 B

18ms
18ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMxMTYyNjAxODMyNjkwNzY2MQ%3D%3D&google_push=AXcoOmQ5BlaC1iPQiyN2xY9U0OlyqnxUDk-xUuH2QuBOCUDFOzSCQ13sxe-8KkKB7tJ-xhppAKaB91gQnXGO_mb5x885cCVvokyWCA

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMxMTYyNjAxODMyNjkwNzY2MQ%3D%3D&google_push=AXcoOmQ5BlaC1iPQiyN2xY9U0OlyqnxUDk-xUuH2QuBOCUDFOzSCQ13sxe-8KkKB7tJ-xhppAKaB91gQnXGO_mb5x885cCVvokyWCA
Date: Tue, 12 Dec 2023 08:43:16 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame ED56
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEL-Ze0Pf0S7LwbZIwkm3Xlg&google_cver=1&google_push=AXcoOmRzffAZM_7H6RgpKDkPoH7uT3ucaukXep9Le6RUMO4uSfab9nBh71U4x6VvakNPlLLAMMnZrow2Zx1bY6KnBnK43BF...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRzffAZM_7H6RgpKDkPoH7uT3ucaukXep9Le6RUMO4uSfab9nBh71U4x6VvakNPlLLAMMnZrow2Zx1bY6KnBnK43BFsYN7fWA&google_hm=eS1HWVBpbVFkRTJwRXpT...

170 B
188 B

21ms
20ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRzffAZM_7H6RgpKDkPoH7uT3ucaukXep9Le6RUMO4uSfab9nBh71U4x6VvakNPlLLAMMnZrow2Zx1bY6KnBnK43BFsYN7fWA&google_hm=eS1HWVBpbVFkRTJwRXpTSnBqRlA1N0lBMXdoc0RhXzFLN35B

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 12 Dec 2023 08:43:16 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRzffAZM_7H6RgpKDkPoH7uT3ucaukXep9Le6RUMO4uSfab9nBh71U4x6VvakNPlLLAMMnZrow2Zx1bY6KnBnK43BFsYN7fWA&google_hm=eS1HWVBpbVFkRTJwRXpTSnBqRlA1N0lBMXdoc0RhXzFLN35B
content-length: 0

GET
H2 200 dds
rtb.openx.net/sync/ Frame ED56 43 B
94 B 18ms
16ms Image
image/gif 35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEJKXz7o7UMHOyBpCmpj4A2U&google_cver=1&google_push=AXcoOmR66lxQkND4Y0Bz0ncWx7hPSlbqzczFBQcMEsuVOCmtnuqsFVFHrGU237ZXU7Uo2oygnRF7yTlS00tzKDvMWHpnYghKFP8bjw
Requested by: Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:16 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame ED56
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEGXXUVARHK1f7gYxZl4gPCA&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEGXXUVARHK1f7gYxZl4gPCA&google_hm=ZXgdIApTNrzIXldbGaOYSgAAFCoAAAIB&google_nid=index&google_push=AXcoOmRw0kePb9mjf5TJYC4bZbNVJBT2WLF6T...

170 B
188 B

19ms
19ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEGXXUVARHK1f7gYxZl4gPCA&google_hm=ZXgdIApTNrzIXldbGaOYSgAAFCoAAAIB&google_nid=index&google_push=AXcoOmRw0kePb9mjf5TJYC4bZbNVJBT2WLF6TEawGFv2WJhRVYCafQS9eEvm7PKYNgFHezlpoCmMkHn9h43FWvZGraGlfTl25C4n

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:16 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GDy97c7UVBjSZaZlDHKE9J9qaTd7wqY8%2F3OSZKZ6SucZODBjSRRvcwiFnCUAE8yMmW5zryX6JqT7gyIPVB%2FbBDA3L7JKA7yYKxoQd9xkS64P%2FtFzLlwjTc5X%2FD2tgJnLBAvHQ89JnQ%2FrGg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEGXXUVARHK1f7gYxZl4gPCA&google_hm=ZXgdIApTNrzIXldbGaOYSgAAFCoAAAIB&google_nid=index&google_push=AXcoOmRw0kePb9mjf5TJYC4bZbNVJBT2WLF6TEawGFv2WJhRVYCafQS9eEvm7PKYNgFHezlpoCmMkHn9h43FWvZGraGlfTl25C4n
cache-control: no-cache
cf-ray: 8344adc53bac1cc3-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H2 204 v1
match.sharethrough.com/E4rooAtA/ Frame ED56 0
34 B 9ms
8ms Image
text/plain 18.193.96.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/E4rooAtA/v1?google_gid=CAESECALUraslr0zovC1W5eBWcM&google_cver=1&google_push=AXcoOmT1eu6FbrtxSVakL2MJdCOb2WAdF-SPUrfcy5IetCc5PXHeKJmzIHTsY3b2E-s-aCm_ML8CrZpd-pynmgr-dRRMGL3uWtilMFQ
Requested by: Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.193.96.13 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-193-96-13.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:16 GMT

GET
H2

200

0.gif
id5-sync.com/i/495/ Frame ED56
Redirect Chain

https://sync.inmobi.com/gob?google_gid=CAESECDTvJNMw7Ax-epBVutTDaQ&google_cver=1&google_push=AXcoOmSR05ZtMZnPQgy0-Xz_1kGmuUPPd_P5t8yN6prwDyy4YCZ1NDjYSqC_fGPI3d2QFl6PjaW5-pb1n7vANL_9CHs5Zdteelqld7c
https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAXcoOmSR05ZtMZnPQgy0-Xz_1kGmuUPPd_P5t8yN6prwDyy4...

43 B
920 B

8ms
8ms

Image
image/gif

162.19.138.116
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAXcoOmSR05ZtMZnPQgy0-Xz_1kGmuUPPd_P5t8yN6prwDyy4YCZ1NDjYSqC_fGPI3d2QFl6PjaW5-pb1n7vANL_9CHs5Zdteelqld7c

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-type: image/gif;charset=UTF-8
date: Tue, 12 Dec 2023 08:43:16 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
p3p: CP="CAO PSA OUR"

Redirect headers

date: Tue, 12 Dec 2023 08:43:16 GMT
content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
expect-ct: max-age=0
x-dns-prefetch-control: off
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=utf-8
location: https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAXcoOmSR05ZtMZnPQgy0-Xz_1kGmuUPPd_P5t8yN6prwDyy4YCZ1NDjYSqC_fGPI3d2QFl6PjaW5-pb1n7vANL_9CHs5Zdteelqld7c
x-download-options: noopen
vary: Accept
content-length: 274
x-xss-protection: 0

GET
H2

200

spacer.gif
an.yandex.ru/resource/ Frame ED56
Redirect Chain

https://an.yandex.ru/mapuid/google/CAESEN_QWE3e9nnLLPfbbLOLd1w?ext-param=AXcoOmR-hcdVNx1l_DJME2b8nfOOtRyuv4-M5UwLYmNUCgv2BsxB64UROJn0fL3Q1dvHtwbKc4jcKQhqUqmh6-lmJAFZxYd4kYIOzfo&partner-tag=yandex_a...
https://an.yandex.ru/mapuid/google/CAESEN_QWE3e9nnLLPfbbLOLd1w?redir-setuniq=1&ext-param=AXcoOmR-hcdVNx1l_DJME2b8nfOOtRyuv4-M5UwLYmNUCgv2BsxB64UROJn0fL3Q1dvHtwbKc4jcKQhqUqmh6-lmJAFZxYd4kYIOzfo&part...
https://cm.g.doubleclick.net/pixel?google_nid=yandex_ag&google_hm=CAESEN_QWE3e9nnLLPfbbLOLd1w&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif
https://an.yandex.ru/resource/spacer.gif

43 B
144 B

55ms
55ms

Image
image/gif

2a02:6b8::90
GLOBAL_DC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/resource/spacer.gif

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:43:16 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Wed, 18 Apr 2001 10:28:03 GMT
content-type: image/gif
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Tue, 26 Nov 2024 08:43:16 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Dec 2023 08:43:16 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://an.yandex.ru/resource/spacer.gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 237
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame ED56 0
12 B 16ms
15ms Image
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KNUiaU4n5rMErld_uSuJmOQxdRVx8068b6UJaD863XyFLZAjG4tvms3bw6mkaZGiApYB6VpKRH

Requested by

Host: f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com
URL: https://f8ab30a9ace92e48c2e816b8547d4147.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS