urlscan.io logo urlscan.io
SecurityTrails logo

xurl.es Open in urlscan Pro
82.223.3.178  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://xurl.es/djh3r
Effective URL: https://xurl.es/
Submission: On October 20 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 24 IPs in 5 countries across 16 domains to perform 132 HTTP transactions. The main IP is 82.223.3.178, located in Spain and belongs to IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE. The main domain is xurl.es.
TLS certificate: Issued by R3 on September 7th 2021. Valid for: 3 months.
This is the only time xurl.es was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 16 82.223.3.178 8560 (IONOS-AS ...)
5 2a00:1450:400... 15169 (GOOGLE)
15 2a00:1450:400... 15169 (GOOGLE)
2 151.101.194.133 54113 (FASTLY)
2 2a03:2880:f01... 32934 (FACEBOOK)
6 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 2 2a03:2880:f11... 32934 (FACEBOOK)
15 2a00:1450:400... 15169 (GOOGLE)
1 142.250.184.226 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
30 2a00:1450:400... 15169 (GOOGLE)
5 2a00:1450:400... 15169 (GOOGLE)
2 3 2a00:1450:400... 15169 (GOOGLE)
1 2a02:2638:1::2 44788 (ASN-CRITE...)
1 2a02:2638:1::11 44788 (ASN-CRITE...)
4 2a00:1450:400... 15169 (GOOGLE)
7 2a02:2638:1::3 44788 (ASN-CRITE...)
1 2600:9000:215... 16509 (AMAZON-02)
1 178.250.2.148 44788 (ASN-CRITE...)
11 178.250.2.135 44788 (ASN-CRITE...)
2 178.250.2.150 44788 (ASN-CRITE...)
132 24
16    82.223.3.178 (Spain)

ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE)
xurl.es
5    2a00:1450:4001:827::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
15    2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com
2    151.101.194.133 (United States)

ASN54113 (FASTLY, US)
www.paypalobjects.com
2    2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)
connect.facebook.net
6    2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
2    2a00:1450:4001:809::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ssl.google-analytics.com
2    2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)
www.facebook.com
15    2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
1    142.250.184.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f2.1e100.net
partner.googleadservices.com
2    2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.de
2    2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.com
30    2a00:1450:4001:82f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
5    2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagservices.com
3    2a00:1450:4001:82a::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2a02:2638:1::2 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
rtb.nl.eu.criteo.com
1    2a02:2638:1::11 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
ads.eu.criteo.com
4    2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.gstatic.com
7    2a02:2638:1::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
static.criteo.net
1    2600:9000:2156:3200:1e:a43d:b640:93a1 (United States)

ASN16509 (AMAZON-02, US)
secure-gl.imrworldwide.com
1    178.250.2.148 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
cat.nl.eu.criteo.com
11    178.250.2.135 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
PTR: pix.am5.vip.prod.criteo.com
pix.eu.criteo.net
2    178.250.2.150 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
csm.eu.criteo.net
Domain Requested by
30 tpc.googlesyndication.com googleads.g.doubleclick.net
xurl.es
tpc.googlesyndication.com
pagead2.googlesyndication.com
16 xurl.es 1 redirects xurl.es
15 googleads.g.doubleclick.net pagead2.googlesyndication.com
googleads.g.doubleclick.net
xurl.es
15 pagead2.googlesyndication.com xurl.es
pagead2.googlesyndication.com
googleads.g.doubleclick.net
tpc.googlesyndication.com
www.googletagservices.com
11 pix.eu.criteo.net ads.eu.criteo.com
7 static.criteo.net ads.eu.criteo.com
6 fonts.gstatic.com fonts.googleapis.com
5 www.googletagservices.com googleads.g.doubleclick.net
5 fonts.googleapis.com xurl.es
googleads.g.doubleclick.net
tpc.googlesyndication.com
4 www.gstatic.com googleads.g.doubleclick.net
3 www.google.com 2 redirects tpc.googlesyndication.com
2 csm.eu.criteo.net ads.eu.criteo.com
2 adservice.google.com pagead2.googlesyndication.com
2 adservice.google.de pagead2.googlesyndication.com
2 www.facebook.com 1 redirects connect.facebook.net
2 ssl.google-analytics.com xurl.es
2 connect.facebook.net xurl.es
connect.facebook.net
2 www.paypalobjects.com xurl.es
1 cat.nl.eu.criteo.com ads.eu.criteo.com
1 secure-gl.imrworldwide.com ads.eu.criteo.com
1 ads.eu.criteo.com googleads.g.doubleclick.net
1 rtb.nl.eu.criteo.com googleads.g.doubleclick.net
1 partner.googleadservices.com pagead2.googlesyndication.com
132 23
Subject Issuer Validity Valid
xurl.es
R3		 2021-09-07 -
2021-12-06		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2021-10-04 -
2021-12-27		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
www.paypalobjects.com
DigiCert SHA2 Extended Validation Server CA		 2021-04-29 -
2021-12-13		 8 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2021-07-30 -
2021-10-28		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
*.googleadservices.com
GTS CA 1C3		 2021-10-04 -
2021-12-27		 3 months crt.sh
*.google.de
GTS CA 1C3		 2021-10-04 -
2021-12-27		 3 months crt.sh
*.google.com
GTS CA 1C3		 2021-10-04 -
2021-12-27		 3 months crt.sh
tpc.googlesyndication.com
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
*.nl.eu.criteo.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2021-08-21 -
2021-11-18		 3 months crt.sh
*.eu.criteo.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2021-08-21 -
2021-11-18		 3 months crt.sh
*.criteo.net
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2021-09-09 -
2021-12-07		 3 months crt.sh
*.imrworldwide.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-01-28 -
2022-02-01		 a year crt.sh
*.eu.criteo.net
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2021-09-12 -
2021-12-10		 3 months crt.sh
www.google.com
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh

This page contains 19 frames:

Primary Page: https://xurl.es/
Frame ID: D18D1293924B08CE443684F144247402
Requests: 34 HTTP requests in this frame

Frame: https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Flike_box.php%3Fapp_id%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Df2361d3d14b9dec%2526domain%253Dxurl.es%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fxurl.es%25252Ff1b13da3afcbf7%2526relation%253Dparent.parent%26connections%3D16%26container_width%3D0%26header%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fpages%252FXURLes-Haz-tus-url-mas-cortas%252F135298596525315%26locale%3Des_ES%26sdk%3Djoey%26stream%3Dfalse%26width%3D300
Frame ID: 3E6EB6050F336FA2485FF50AAB6E6417
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20211018/r20190131/zrt_lookup.html
Frame ID: C9D4E0259D8C4B51F82198624E013259
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=90&slotname=4639160287&adk=271488381&adf=1839787983&pi=t.ma~as.4639160287&w=970&lmt=1634733299&psa=0&format=970x90&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299375&bpp=3&bdt=211&idt=84&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&correlator=677329721171&frm=20&pv=2&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=315&ady=166&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3r6ReJ8JPt&p=https%3A//xurl.es&dtd=102
Frame ID: CECC162480F485DFBF72E868BFDA70E8
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=250&slotname=7732227484&adk=2257642287&adf=1686907328&pi=t.ma~as.7732227484&w=300&lmt=1634733299&psa=0&format=300x250&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299378&bpp=1&bdt=213&idt=106&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=999&ady=315&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=ew5hHCpCBf&p=https%3A//xurl.es&dtd=108
Frame ID: F4C711560D16694C48336BE2ACCF2A3D
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=90&slotname=4639160287&adk=271488381&adf=1056458448&pi=t.ma~as.4639160287&w=970&lmt=1634733299&psa=0&format=970x90&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299378&bpp=1&bdt=214&idt=110&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90%2C300x250&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=315&ady=650&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=eB7pRZ64O1&p=https%3A//xurl.es&dtd=114
Frame ID: 87242219313D171A67D3E287987E30E5
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&adk=1812271804&adf=3025194257&lmt=1634733299&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fxurl.es%2F&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299387&bpp=1&bdt=223&idt=107&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90%2C300x250%2C970x90&nras=1&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=4&uci=a!4&fsb=1&dtd=113
Frame ID: 245C763115ACC546D6391365256F41DA
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 717C36BF183843B6CFF3F208DCD91EE2
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/QjHKgOpm15qTJXWLxUnNMS8wTt6682k-qtw68OFTrDs.js
Frame ID: 272F774B094FBDF2A30715F424BB022E
Requests: 1 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXAM8wAH5d0Kd_JLAA7NJVWMzJ3moV827TfWdQ&u=%7CjtkNbjzAHvkXI7EFplf4KgdxOu2e6rTR7NxMS3o46Gc%3D%7C&c1=TEbw32HdmhkgeNeeAzq5Zto3zNeDvGephfTH5JL0zydALMisec7v4dU5de-TFyMyKuX9u2jeaiDTb8Ze7hyMlcGgjWJAvQUHRMLNOfpWW7_gxE1dL3ewr_o2zhkXPHjXMbIwAmx8zRtN_X8wUbq8P3pAielLDl_dXqgjC6ouDApKJ0zJkm5ujvDWPyt8533LA0Ufnh5HNVn6fDW_GBkbDkWBtoRWS_l2sn-5TpS7sTFbI_YkOY8wySRCAwQQEYzLk40pEHSe1z2_v2ePMg2fFfOUIDxGRonoEvpk4cGzvWN63hrypEBN7xiLZFAULE6RBnR-70idnFlz8wrM5ESZcnLHcs_6LXKggXlmnax7_2-6Oq4z7U4XUee5zjpRBLn30wAFg07GPI4SPp08yFBrU7qEovLurzDY0aVEprudsWYfwX2VcjCLSmLUXyW5VIzXWSTAz46f_W6dpJryFwZtE5neWSakTh9yfBUJf25zxg374xVDhmgTe46Ie5Ej6uRb&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPqFy8wxwYd3LH8vk3wOlmrv4Dcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNDc5MzIwOTMzNTgzMzg2MKAB1bbS6gPIAQmpAqKX4E3MhrM-qAMBqgS2AU_Q0SXEqe2tcNJMbyHDTkPnkcxj8ToFtymGvemNjYUUn2UE2vbVzGkmSyZG4HDtOS8T2fBmV-tqvkgTNcd3m91KAd54ulW2VHng1aPxXSmifFmad7i1rfQq5NV14owj5uurd9jUHGn_Wv8P1YmofzlDWWo0DU-LiyQa1o4_PKluAEk_Om74o2Ijc387A3IEOPlHlW9eIAMG5Clo43gUa1lFCbH-24kc557bMUjrIGHJod9Vi2dTgAbUoIrLpJuoo2ygBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0BBcd5oEChYOu3-At_vGTJfTTPMQ%26client%3Dca-pub-4793209335833860%26adurl%3D
Frame ID: C56E1A3B3EE96C49C1CC3525CBF8B8A6
Requests: 23 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/QjHKgOpm15qTJXWLxUnNMS8wTt6682k-qtw68OFTrDs.js
Frame ID: 20FAECB091B2EB9C4D05CE9D54FF6A9E
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20211018/r20110914/zrt_lookup.html?fsb=1
Frame ID: 065576FB07218B4A6E10CAC5147B4279
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20211018/r20110914/zrt_lookup.html?fsb=1
Frame ID: 28B64D17084595E04935E076A22B4D43
Requests: 8 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7991778744330195530/index.html
Frame ID: 5FB412419F7A63969FC58C612E8FC2DB
Requests: 13 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: DFDC2A5A70592F132B608BB76A90C9B7
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: C0E42CF88F5D3A2FDE17CBF2384686BC
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/QjHKgOpm15qTJXWLxUnNMS8wTt6682k-qtw68OFTrDs.js
Frame ID: 7B1E8A3A2638260AF92A41F8CEFDFB03
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: 7E2506285180138D28AD3CF92B6D7F32
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: DF83DD4D4B6B3E7561DDA3F26A5095A8
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Acorta tus Url - Acortador de URL, acortador de enlaces - XURL.es

Page URL History Show full URLs

  1. https://xurl.es/djh3r HTTP 302
    https://xurl.es/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <input[^>]+_s-xclick
  • paypalobjects\.com
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

132
Requests

100 %
HTTPS

74 %
IPv6

16
Domains

23
Subdomains

24
IPs

5
Countries

1232 kB
Transfer

3029 kB
Size

8
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://xurl.es/djh3r HTTP 302
    https://xurl.es/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 23
  • https://www.facebook.com/plugins/like_box.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2361d3d14b9dec%26domain%3Dxurl.es%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fxurl.es%252Ff1b13da3afcbf7%26relation%3Dparent.parent&connections=16&container_width=0&header=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FXURLes-Haz-tus-url-mas-cortas%2F135298596525315&locale=es_ES&sdk=joey&stream=false&width=300 HTTP 302
  • https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Flike_box.php%3Fapp_id%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Df2361d3d14b9dec%2526domain%253Dxurl.es%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fxurl.es%25252Ff1b13da3afcbf7%2526relation%253Dparent.parent%26connections%3D16%26container_width%3D0%26header%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fpages%252FXURLes-Haz-tus-url-mas-cortas%252F135298596525315%26locale%3Des_ES%26sdk%3Djoey%26stream%3Dfalse%26width%3D300
Request Chain 42
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Request Chain 121
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

132 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
xurl.es/
Redirect Chain
  • https://xurl.es/djh3r
  • https://xurl.es/
11 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://xurl.es/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
82.223.3.178 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
nginx / PHP/7.4.24 PleskLin
Resource Hash
5b6afa5549088c078f3382b47fd0bc2ec9a38243f01085249a7a4204206c619f
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

:method
GET
:authority
xurl.es
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

server
nginx
date
Wed, 20 Oct 2021 12:34:59 GMT
content-type
text/html; charset=UTF-8
content-length
3578
x-powered-by
PHP/7.4.24 PleskLin
vary
Accept-Encoding
content-encoding
gzip
strict-transport-security
max-age=15768000; includeSubDomains

Redirect headers

server
nginx
date
Wed, 20 Oct 2021 12:34:59 GMT
content-type
text/html; charset=UTF-8
content-length
0
x-powered-by
PHP/7.4.24 PleskLin
location
https://xurl.es
strict-transport-security
max-age=15768000; includeSubDomains
css
fonts.googleapis.com/ 		1 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Quicksand&display=swap
Requested by
Host: xurl.es
URL: https://xurl.es/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
2f4ae1a03362ff6799b7c608778377e95820b2e74f38791bf51b87c253701ef8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
last-modified
Wed, 20 Oct 2021 10:41:30 GMT
server
ESF
date
Wed, 20 Oct 2021 12:34:59 GMT
x-frame-options
SAMEORIGIN
report-to
{"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only
same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires
Wed, 20 Oct 2021 12:34:59 GMT
estilos_new.css
xurl.es/css/ 		3 KB
1008 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://xurl.es/css/estilos_new.css?20201004
Requested by
Host: xurl.es
URL: https://xurl.es/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
82.223.3.178 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
2f1203fbb212151117c369f929efe26af29a3bda4b4f286d207da7d4eb74833d
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

:path
/css/estilos_new.css?20201004
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
xurl.es
referer
https://xurl.es/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:34:59 GMT
content-encoding
br
last-modified
Thu, 25 Feb 2021 22:25:55 GMT
server
nginx
x-powered-by
PleskLin
etag
W/"603823f3-d4c"
strict-transport-security
max-age=15768000; includeSubDomains
content-type
text/css
ajax2.js
xurl.es/js/ 		9 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://xurl.es/js/ajax2.js
Requested by
Host: xurl.es
URL: https://xurl.es/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
82.223.3.178 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
f7bb63c973d338f040a400d5272bf397ae8b1cf52d2a9d79a6870281cc27cd98
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

:path
/js/ajax2.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
xurl.es
referer
https://xurl.es/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:34:59 GMT
content-encoding
br
last-modified
Thu, 25 Feb 2021 22:25:59 GMT
server
nginx
x-powered-by
PleskLin
etag
W/"603823f7-2298"
strict-transport-security
max-age=15768000; includeSubDomains
content-type
application/javascript
xurl.png
xurl.es/images/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xurl.es/images/xurl.png
Requested by
Host: xurl.es
URL: https://xurl.es/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
82.223.3.178 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
aa5cce745f29df17c235f1341d0c9302da0c56d79bf056561a914129a89cbffc
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

:path
/images/xurl.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
xurl.es
referer
https://xurl.es/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:34:59 GMT
last-modified
Thu, 25 Feb 2021 22:25:57 GMT
server
nginx
x-powered-by
PleskLin
etag
"603823f5-14f0"
strict-transport-security
max-age=15768000; includeSubDomains
content-type
image/png
accept-ranges
bytes
content-length
5360
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ 		143 KB
50 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: xurl.es
URL: https://xurl.es/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e104549615301e3d036b6fb975b6a8c7d9f5b784fb2b4a9179367c5e96eef974
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:34:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
51017
x-xss-protection
0
server
cafe
etag
7966705136928129361
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Wed, 20 Oct 2021 12:34:59 GMT
btn_donateCC_LG.gif
www.paypalobjects.com/es_ES/ES/i/btn/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.paypalobjects.com/es_ES/ES/i/btn/btn_donateCC_LG.gif
Requested by
Host: xurl.es
URL: https://xurl.es/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d2edcfae0fb84452b9f1b8bc52e938e1f759b0b5302c4a9abea0784d24fb2065
Security Headers
Name Value
Strict-Transport-Security max-age=31557600
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:34:59 GMT
via
1.1 varnish, 1.1 varnish
x-content-type-options
nosniff
x-cache
HIT, HIT
fastly-io-info
ifsz=3178 idim=152x47 ifmt=gif ofsz=3177 odim=152x47 ofmt=gif
paypal-debug-id
76c1fcee4f724
fastly-stats
io=1
dc
ccg11-origin-www-1.paypal.com
content-length
3177
x-served-by
cache-sjc10048-SJC, cache-cdg20743-CDG
x-timer
S1634733299.335291,VS0,VE1
etag
"DwYiN+FG28YGvMdWXbkur7I+4YtphnQ1LfxEJbZBzEY"
strict-transport-security
max-age=31557600
content-type
image/gif
cache-control
public,max-age=3600
accept-ranges
bytes
x-cache-hits
52, 1
pixel.gif
www.paypalobjects.com/es_ES/i/scr/ 		42 B
433 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.paypalobjects.com/es_ES/i/scr/pixel.gif
Requested by
Host: xurl.es
URL: https://xurl.es/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
0c1ce4dd3afaa97d8627ecebc2e255fe5c1b3c2038f6961a86d10f0381056cc7
Security Headers
Name Value
Strict-Transport-Security max-age=31557600
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:34:59 GMT
via
1.1 varnish, 1.1 varnish
x-content-type-options
nosniff
x-cache
HIT, HIT
fastly-io-info
ifsz=43 idim=1x1 ifmt=gif ofsz=42 odim=1x1 ofmt=gif
paypal-debug-id
502d08fab1e33
fastly-stats
io=1
dc
ccg11-origin-www-1.paypal.com
content-length
42
x-served-by
cache-sjc10066-SJC, cache-cdg20743-CDG
x-timer
S1634733299.335473,VS0,VE1
etag
"dNSbNMYiK1Q98dwxkre+GOK5+qX2pefyT9A/BaBsoeM"
strict-transport-security
max-age=31557600
content-type
image/gif
cache-control
public,max-age=3600
accept-ranges
bytes
x-cache-hits
88, 1
all.js
connect.facebook.net/es_ES/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/es_ES/all.js
Requested by
Host: xurl.es
URL: https://xurl.es/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
fe1d024495ba096cf231a9bb3d9e942f16327d55cf1c65c7d562dbe0901eeb6b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
5OMAsqdzgp0MvCI2IWgJvA==
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
1687
x-fb-rlafr
0
x-fb-debug
on9exTGlv0uCui3mYnayi3yM2Vlisd8J0SSYSVqhMf4cAaPi4FqDIRlmQhKTCgwIBbjUQ0/E1KAcaepyqmF64g==
x-fb-trip-id
2050670934
x-fb-content-md5
3e4a7292d5e6a885ec2607f5c9e09da8
x-frame-options
DENY
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Wed, 20 Oct 2021 12:34:59 GMT
vary
Accept-Encoding
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=1200,stale-while-revalidate=3600
etag
"fd531b2df309b9ee0f4ea551971c76f4"
timing-allow-origin
*
expires
Wed, 20 Oct 2021 12:49:31 GMT
w3c-xhtml.png
xurl.es/images/ 		521 B
736 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xurl.es/images/w3c-xhtml.png
Requested by
Host: xurl.es
URL: https://xurl.es/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
82.223.3.178 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
88193f110768212d8a6526b7566b24f207bfb3eddd45df7fc2581b9d4ac4eff5
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

:path
/images/w3c-xhtml.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
xurl.es
referer
https://xurl.es/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:34:59 GMT
etag
"209-5bc30a2b53ef2"
last-modified
Thu, 25 Feb 2021 22:25:57 GMT
server
nginx
x-powered-by
PleskLin
strict-transport-security
max-age=15768000; includeSubDomains
content-type
image/png
x-accel-version
0.01
accept-ranges
bytes
content-length
521
w3c-css.png
xurl.es/images/ 		524 B
738 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xurl.es/images/w3c-css.png
Requested by
Host: xurl.es
URL: https://xurl.es/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
82.223.3.178 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
e77e235669fece8e6008a8f5d31ce9e44fd390032778ff6727b73938425a6941
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

:path
/images/w3c-css.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
xurl.es
referer
https://xurl.es/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:34:59 GMT
etag
"20c-5bc30a2b4a2b1"
last-modified
Thu, 25 Feb 2021 22:25:57 GMT
server
nginx
x-powered-by
PleskLin
strict-transport-security
max-age=15768000; includeSubDomains
content-type
image/png
x-accel-version
0.01
accept-ranges
bytes
content-length
524
logo-freebsd.png
xurl.es/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xurl.es/images/logo-freebsd.png
Requested by
Host: xurl.es
URL: https://xurl.es/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
82.223.3.178 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
1aaaa76604e8cce1fc24df8b27d6124fc780575f15aeb5a05089277ba25cccec
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

:path
/images/logo-freebsd.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
xurl.es
referer
https://xurl.es/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:34:59 GMT
last-modified
Thu, 25 Feb 2021 22:25:57 GMT
server
nginx
x-powered-by
PleskLin
etag
"603823f5-725"
strict-transport-security
max-age=15768000; includeSubDomains
content-type
image/png
accept-ranges
bytes
content-length
1829
logo-apache.png
xurl.es/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xurl.es/images/logo-apache.png
Requested by
Host: xurl.es
URL: https://xurl.es/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
82.223.3.178 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
99bc13458990137777412f543d96fa3e68c7e276e8bbb4c9173bd495481f49e4
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

:path
/images/logo-apache.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
xurl.es
referer
https://xurl.es/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:34:59 GMT
last-modified
Thu, 25 Feb 2021 22:25:57 GMT
server
nginx
x-powered-by
PleskLin
etag
"603823f5-645"
strict-transport-security
max-age=15768000; includeSubDomains
content-type
image/png
accept-ranges
bytes
content-length
1605
logo-php.png
xurl.es/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xurl.es/images/logo-php.png
Requested by
Host: xurl.es
URL: https://xurl.es/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
82.223.3.178 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
5c5fc0560c5d4acaea1cadae07be72f5ad5919a471e794a8a512b7f2cc9811e6
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

:path
/images/logo-php.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
xurl.es
referer
https://xurl.es/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:34:59 GMT
last-modified
Thu, 25 Feb 2021 22:25:57 GMT
server
nginx
x-powered-by
PleskLin
etag
"603823f5-665"
strict-transport-security
max-age=15768000; includeSubDomains
content-type
image/png
accept-ranges
bytes
content-length
1637
logo-mysql.png
xurl.es/images/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xurl.es/images/logo-mysql.png
Requested by
Host: xurl.es
URL: https://xurl.es/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
82.223.3.178 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
f138232191786a1c6d362de031b33fac03d9a97be15539e752de4c41e167af00
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

:path
/images/logo-mysql.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
xurl.es
referer
https://xurl.es/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:34:59 GMT
last-modified
Thu, 25 Feb 2021 22:25:57 GMT
server
nginx
x-powered-by
PleskLin
etag
"603823f5-538"
strict-transport-security
max-age=15768000; includeSubDomains
content-type
image/png
accept-ranges
bytes
content-length
1336
pro_five_0c.gif
xurl.es/images/ 		58 B
271 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xurl.es/images/pro_five_0c.gif
Requested by
Host: xurl.es
URL: https://xurl.es/css/estilos_new.css?20201004
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
82.223.3.178 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
7529f421b38083855086bd50c4373e5ade8a3afed02fda87cab44c4cb324eadd
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

:path
/images/pro_five_0c.gif
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
xurl.es
referer
https://xurl.es/css/estilos_new.css?20201004
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/css/estilos_new.css?20201004
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:34:59 GMT
etag
"3a-5bc30a2af2467"
last-modified
Thu, 25 Feb 2021 22:25:57 GMT
server
nginx
x-powered-by
PleskLin
strict-transport-security
max-age=15768000; includeSubDomains
content-type
image/gif
x-accel-version
0.01
accept-ranges
bytes
content-length
58
pro_five_2a.gif
xurl.es/images/ 		559 B
773 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xurl.es/images/pro_five_2a.gif
Requested by
Host: xurl.es
URL: https://xurl.es/css/estilos_new.css?20201004
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
82.223.3.178 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
f072eaaf91a5ea9eb15baf3e94ccf8ae36e44c6152e0aba2f1103b3a6b7a60bc
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

:path
/images/pro_five_2a.gif
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
xurl.es
referer
https://xurl.es/css/estilos_new.css?20201004
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/css/estilos_new.css?20201004
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:34:59 GMT
etag
"22f-5bc30a2b108ca"
last-modified
Thu, 25 Feb 2021 22:25:57 GMT
server
nginx
x-powered-by
PleskLin
strict-transport-security
max-age=15768000; includeSubDomains
content-type
image/gif
x-accel-version
0.01
accept-ranges
bytes
content-length
559
pro_five_2b.gif
xurl.es/images/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xurl.es/images/pro_five_2b.gif
Requested by
Host: xurl.es
URL: https://xurl.es/css/estilos_new.css?20201004
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
82.223.3.178 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
529ae4f38c76e38b64a96590b61528af7e519acacf5b9726bc1151bfc7677b43
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

:path
/images/pro_five_2b.gif
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
xurl.es
referer
https://xurl.es/css/estilos_new.css?20201004
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/css/estilos_new.css?20201004
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:34:59 GMT
last-modified
Thu, 25 Feb 2021 22:25:57 GMT
server
nginx
x-powered-by
PleskLin
etag
"603823f5-5e7"
strict-transport-security
max-age=15768000; includeSubDomains
content-type
image/gif
accept-ranges
bytes
content-length
1511
pro_five_0a.gif
xurl.es/images/ 		553 B
768 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xurl.es/images/pro_five_0a.gif
Requested by
Host: xurl.es
URL: https://xurl.es/css/estilos_new.css?20201004
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
82.223.3.178 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
d6eea55f702d79866f785453b1e53fa20cfd7efb1885886779ce8cc3f0685979
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

:path
/images/pro_five_0a.gif
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
xurl.es
referer
https://xurl.es/css/estilos_new.css?20201004
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/css/estilos_new.css?20201004
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:34:59 GMT
etag
"229-5bc30a2ae49a5"
last-modified
Thu, 25 Feb 2021 22:25:57 GMT
server
nginx
x-powered-by
PleskLin
strict-transport-security
max-age=15768000; includeSubDomains
content-type
image/gif
x-accel-version
0.01
accept-ranges
bytes
content-length
553
pro_five_0b.gif
xurl.es/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xurl.es/images/pro_five_0b.gif
Requested by
Host: xurl.es
URL: https://xurl.es/css/estilos_new.css?20201004
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
82.223.3.178 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
0712a327424e57302c3e5634b02583f54153e0744da7879b6eaca1b80d36749c
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

:path
/images/pro_five_0b.gif
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
xurl.es
referer
https://xurl.es/css/estilos_new.css?20201004
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/css/estilos_new.css?20201004
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:34:59 GMT
last-modified
Thu, 25 Feb 2021 22:25:57 GMT
server
nginx
x-powered-by
PleskLin
etag
"603823f5-607"
strict-transport-security
max-age=15768000; includeSubDomains
content-type
image/gif
accept-ranges
bytes
content-length
1543
6xK-dSZaM9iE8KbpRA_LJ3z8mH9BOJvgkP8o58a-wg.woff2
fonts.gstatic.com/s/quicksand/v24/ 		13 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/quicksand/v24/6xK-dSZaM9iE8KbpRA_LJ3z8mH9BOJvgkP8o58a-wg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Quicksand&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9e56d22c4c632bd0b72bbaf1fed2472ddb3707287435fe92bb00ec97f13ca8f9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://xurl.es
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sun, 17 Oct 2021 10:51:55 GMT
x-content-type-options
nosniff
age
265384
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13776
x-xss-protection
0
last-modified
Mon, 26 Jul 2021 18:33:23 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Mon, 17 Oct 2022 10:51:55 GMT
all.js
connect.facebook.net/es_ES/ 		266 KB
76 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/es_ES/all.js?hash=4bfbc796f80a9373af768e4d71143196
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/es_ES/all.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
4c23b6931c720f5e0ab729ff415e6dc68ddb3ea447fe4be460118d8a6f0dbfa7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://xurl.es/
Origin
https://xurl.es
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
bp5mP7K/V63uXplfGdJ2vA==
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
76600
x-fb-rlafr
0
x-fb-debug
6jtNsYPraS7bkQA0bsD9Q0h7W9lK1D7BfivmPCeaTu248GEsSpoppxaqsCsYbWPrnW3f++89Y+Mkg0pVzxi7OQ==
x-fb-trip-id
686109401
x-fb-content-md5
aa43b0f97c2734c9472dae8378ad1121
x-frame-options
DENY
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Wed, 20 Oct 2021 12:34:59 GMT
vary
Accept-Encoding
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=31536000,stale-while-revalidate=3600,immutable
etag
"370039ea4d990d57e8e7dcf24982d983"
timing-allow-origin
*
priority
u=3,i
expires
Thu, 20 Oct 2022 12:29:32 GMT
ga.js
ssl.google-analytics.com/ 		45 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ssl.google-analytics.com/ga.js
Requested by
Host: xurl.es
URL: https://xurl.es/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://xurl.es/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 19 Oct 2021 16:47:48 GMT
server
Golfe2
age
4982
date
Wed, 20 Oct 2021 11:11:57 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17168
expires
Wed, 20 Oct 2021 13:11:57 GMT
__utm.gif
ssl.google-analytics.com/r/ 		35 B
197 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1489284647&utmhn=xurl.es&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Acorta%20tus%20Url%20-%20Acortador%20de%20URL%2C%20acortador%20de%20enlaces%20-%20XURL.es&utmhid=70025016&utmr=-&utmp=%2F&utmht=1634733299331&utmac=UA-266266-17&utmcc=__utma%3D253530880.446147574.1634733299.1634733299.1634733299.1%3B%2B__utmz%3D253530880.1634733299.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1330421689&utmredir=1&utmu=DAAAAAAAAAAAAAAAAAAAAAAE~
Requested by
Host: xurl.es
URL: https://xurl.es/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Oct 2021 12:34:59 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.facebook.com/login/ Frame 3E6E
Redirect Chain
  • https://www.facebook.com/plugins/like_box.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2361d3d14b9dec%26domain%3Dxurl.es%26is_canvas%...
  • https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Flike_box.php%3Fapp_id%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253...
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Flike_box.php%3Fapp_id%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Df2361d3d14b9dec%2526domain%253Dxurl.es%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fxurl.es%25252Ff1b13da3afcbf7%2526relation%253Dparent.parent%26connections%3D16%26container_width%3D0%26header%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fpages%252FXURLes-Haz-tus-url-mas-cortas%252F135298596525315%26locale%3Des_ES%26sdk%3Djoey%26stream%3Dfalse%26width%3D300
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/es_ES/all.js?hash=4bfbc796f80a9373af768e4d71143196
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com data: blob: 'self';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.facebook.com
:scheme
https
:path
/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Flike_box.php%3Fapp_id%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Df2361d3d14b9dec%2526domain%253Dxurl.es%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fxurl.es%25252Ff1b13da3afcbf7%2526relation%253Dparent.parent%26connections%3D16%26container_width%3D0%26header%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fpages%252FXURLes-Haz-tus-url-mas-cortas%252F135298596525315%26locale%3Des_ES%26sdk%3Djoey%26stream%3Dfalse%26width%3D300
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://xurl.es/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
about:blank

Response headers

vary
Accept-Encoding
content-encoding
br
x-fb-rlafr
0
cross-origin-opener-policy
unsafe-none
pragma
no-cache
cache-control
private, no-cache, no-store, must-revalidate
expires
Sat, 01 Jan 2000 00:00:00 GMT
x-content-type-options
nosniff
x-xss-protection
0
content-security-policy-report-only
default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com;frame-src *.facebook.com *.fbsbx.com data:;worker-src blob: *.facebook.com;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-security-policy
default-src facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com data: blob: 'self';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
x-frame-options
DENY
strict-transport-security
max-age=15552000; preload
content-type
text/html; charset="utf-8"
x-fb-debug
MN417kOo9u9C/xWNj4JbtOfw9wOWBG5/SEHdiARhqK6PM7Pm78oBzwkicHw3SlEq/4I8lnOKPYRZDVVJ1rUtBg==
date
Wed, 20 Oct 2021 12:34:59 GMT
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

Redirect headers

location
https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Flike_box.php%3Fapp_id%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Df2361d3d14b9dec%2526domain%253Dxurl.es%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fxurl.es%25252Ff1b13da3afcbf7%2526relation%253Dparent.parent%26connections%3D16%26container_width%3D0%26header%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fpages%252FXURLes-Haz-tus-url-mas-cortas%252F135298596525315%26locale%3Des_ES%26sdk%3Djoey%26stream%3Dfalse%26width%3D300
x-fb-rlafr
0
cross-origin-opener-policy
unsafe-none
pragma
no-cache
cache-control
private, no-cache, no-store, must-revalidate
expires
Sat, 01 Jan 2000 00:00:00 GMT
x-content-type-options
nosniff
x-xss-protection
0
content-security-policy-report-only
default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ wss://*.whatsapp.com:* v.whatsapp.net *.fbsbx.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net cx.atdmt.com www.googleadservices.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com ad.atdmt.com data: www.instagram.com *.vrich619.com;worker-src blob: *.facebook.com;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
strict-transport-security
max-age=15552000; preload
content-type
text/html; charset="utf-8"
x-fb-debug
dbz1I92Ex4FdwcyAZTJ+rSr8sJ7Z5GreveMKwvI6QxXUYNvanwmUS4TbTMDxoZ581cs01puf7PrPP6SRtqiExg==
content-length
0
date
Wed, 20 Oct 2021 12:34:59 GMT
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
show_ads_impl_with_ama_fy2019.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/ 		271 KB
97 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4793209335833860&plah=xurl.es
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4a111a9457fa1840f6fe07aa190976ea50916cad4f6cb241b282d5eba91ff04e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:34:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
99362
x-xss-protection
0
server
cafe
etag
11237849450337737701
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
expires
Wed, 20 Oct 2021 12:34:59 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20211018/r20190131/ Frame C9D4 		10 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20211018/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1437cdd25532919299784f840c613a46dbcf783903d558bcf5386defd7cceb1c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/html/r20211018/r20190131/zrt_lookup.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://xurl.es/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Tue, 19 Oct 2021 14:22:43 GMT
expires
Tue, 02 Nov 2021 14:22:43 GMT
content-type
text/html; charset=ISO-8859-1
etag
15765991816257340444
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
4703
x-xss-protection
0
age
79936
cache-control
public, max-age=1209600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cookie.js
partner.googleadservices.com/gampad/ 		197 B
794 B 		Script
General
Check archive.org
Download Go to
Full URL
https://partner.googleadservices.com/gampad/cookie.js?domain=xurl.es&callback=_gfp_s_&client=ca-pub-4793209335833860
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4793209335833860&plah=xurl.es
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f2.1e100.net
Software
cafe /
Resource Hash
55e834b88453616e75ede9c2de230c607d5869f80d7a14b35e16f681a56bbffe
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:34:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
report-to
{"group":"gfe-default_product_name","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/default_product_name"}]}
content-type
text/javascript; charset=UTF-8
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
189
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="gfe-default_product_name"
integrator.js
adservice.google.de/adsid/ 		107 B
716 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=xurl.es
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4793209335833860&plah=xurl.es
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 20 Oct 2021 12:34:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		107 B
520 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=xurl.es
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4793209335833860&plah=xurl.es
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 20 Oct 2021 12:34:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
100
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame CECC 		85 KB
28 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=90&slotname=4639160287&adk=271488381&adf=1839787983&pi=t.ma~as.4639160287&w=970&lmt=1634733299&psa=0&format=970x90&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299375&bpp=3&bdt=211&idt=84&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&correlator=677329721171&frm=20&pv=2&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=315&ady=166&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3r6ReJ8JPt&p=https%3A//xurl.es&dtd=102
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4793209335833860&plah=xurl.es
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e9db20bbabb13b4e4b498940023db919362dee26fbaf2adc10b65eed78e6f09a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-4793209335833860&output=html&h=90&slotname=4639160287&adk=271488381&adf=1839787983&pi=t.ma~as.4639160287&w=970&lmt=1634733299&psa=0&format=970x90&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299375&bpp=3&bdt=211&idt=84&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&correlator=677329721171&frm=20&pv=2&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=315&ady=166&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3r6ReJ8JPt&p=https%3A//xurl.es&dtd=102
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://xurl.es/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Wed, 20 Oct 2021 12:35:00 GMT
server
cafe
content-length
28559
x-xss-protection
0
set-cookie
test_cookie=CheckForPermission; expires=Wed, 20-Oct-2021 12:49:59 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Wed, 20 Oct 2021 12:35:00 GMT
cache-control
private
ads
googleads.g.doubleclick.net/pagead/ Frame F4C7 		71 KB
26 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=250&slotname=7732227484&adk=2257642287&adf=1686907328&pi=t.ma~as.7732227484&w=300&lmt=1634733299&psa=0&format=300x250&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299378&bpp=1&bdt=213&idt=106&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=999&ady=315&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=ew5hHCpCBf&p=https%3A//xurl.es&dtd=108
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4793209335833860&plah=xurl.es
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
084bc5b07a6e44bd37f8c82e18d999d40c0c055d2567606fff11b4434c78661d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-4793209335833860&output=html&h=250&slotname=7732227484&adk=2257642287&adf=1686907328&pi=t.ma~as.7732227484&w=300&lmt=1634733299&psa=0&format=300x250&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299378&bpp=1&bdt=213&idt=106&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=999&ady=315&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=ew5hHCpCBf&p=https%3A//xurl.es&dtd=108
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://xurl.es/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Wed, 20 Oct 2021 12:34:59 GMT
server
cafe
content-length
26773
x-xss-protection
0
set-cookie
test_cookie=CheckForPermission; expires=Wed, 20-Oct-2021 12:49:59 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Wed, 20 Oct 2021 12:34:59 GMT
cache-control
private
ads
googleads.g.doubleclick.net/pagead/ Frame 8724 		19 KB
9 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=90&slotname=4639160287&adk=271488381&adf=1056458448&pi=t.ma~as.4639160287&w=970&lmt=1634733299&psa=0&format=970x90&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299378&bpp=1&bdt=214&idt=110&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90%2C300x250&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=315&ady=650&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=eB7pRZ64O1&p=https%3A//xurl.es&dtd=114
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4793209335833860&plah=xurl.es
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b0e1406dcd3f5a51fba5bddd8f1dcfa3094ce89092cb038c1e50afa46a1c4024
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-4793209335833860&output=html&h=90&slotname=4639160287&adk=271488381&adf=1056458448&pi=t.ma~as.4639160287&w=970&lmt=1634733299&psa=0&format=970x90&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299378&bpp=1&bdt=214&idt=110&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90%2C300x250&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=315&ady=650&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=eB7pRZ64O1&p=https%3A//xurl.es&dtd=114
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://xurl.es/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Wed, 20 Oct 2021 12:35:00 GMT
server
cafe
content-length
8554
x-xss-protection
0
set-cookie
test_cookie=CheckForPermission; expires=Wed, 20-Oct-2021 12:49:59 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Wed, 20 Oct 2021 12:35:00 GMT
cache-control
private
ads
googleads.g.doubleclick.net/pagead/ Frame 245C 		278 KB
72 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&adk=1812271804&adf=3025194257&lmt=1634733299&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fxurl.es%2F&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299387&bpp=1&bdt=223&idt=107&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90%2C300x250%2C970x90&nras=1&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=4&uci=a!4&fsb=1&dtd=113
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4793209335833860&plah=xurl.es
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8d2c59f31aa243378eabc1a7da1187c0f0aec68390a463c2a2e7c3e80dc82be1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-4793209335833860&output=html&adk=1812271804&adf=3025194257&lmt=1634733299&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fxurl.es%2F&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299387&bpp=1&bdt=223&idt=107&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90%2C300x250%2C970x90&nras=1&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=4&uci=a!4&fsb=1&dtd=113
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://xurl.es/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Wed, 20 Oct 2021 12:35:00 GMT
server
cafe
content-length
73011
x-xss-protection
0
set-cookie
test_cookie=CheckForPermission; expires=Wed, 20-Oct-2021 12:49:59 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Wed, 20 Oct 2021 12:35:00 GMT
cache-control
private
15124230702353446467
tpc.googlesyndication.com/simgad/ Frame F4C7 		43 KB
43 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/15124230702353446467?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qmX-kClKd5EDqUlQaEAfi0slME9xg
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=250&slotname=7732227484&adk=2257642287&adf=1686907328&pi=t.ma~as.7732227484&w=300&lmt=1634733299&psa=0&format=300x250&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299378&bpp=1&bdt=213&idt=106&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=999&ady=315&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=ew5hHCpCBf&p=https%3A//xurl.es&dtd=108
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2aa55152e026608daa26a646305a1904735719414b4e0e2ff9fbb64e4e00715b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Mon, 18 Oct 2021 12:47:23 GMT
x-content-type-options
nosniff
age
172056
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
44074
x-xss-protection
0
last-modified
Mon, 18 Oct 2021 10:33:20 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Tue, 18 Oct 2022 12:47:23 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211018/r20110914/ Frame F4C7 		18 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211018/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=250&slotname=7732227484&adk=2257642287&adf=1686907328&pi=t.ma~as.7732227484&w=300&lmt=1634733299&psa=0&format=300x250&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299378&bpp=1&bdt=213&idt=106&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=999&ady=315&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=ew5hHCpCBf&p=https%3A//xurl.es&dtd=108
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8bfd018bb29e8c00faffeb3660e5cbcec66c0ba1dff56f8d2f9a1bcc47c11852
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:08:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1574
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7699
x-xss-protection
0
server
cafe
etag
16022440550062051545
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 03 Nov 2021 12:08:45 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211018/r20110914/client/ Frame F4C7 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211018/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=250&slotname=7732227484&adk=2257642287&adf=1686907328&pi=t.ma~as.7732227484&w=300&lmt=1634733299&psa=0&format=300x250&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299378&bpp=1&bdt=213&idt=106&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=999&ady=315&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=ew5hHCpCBf&p=https%3A//xurl.es&dtd=108
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:09:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1516
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1426
x-xss-protection
0
server
cafe
etag
18061233391346882222
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 03 Nov 2021 12:09:43 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211018/r20110914/client/ Frame F4C7 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211018/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=250&slotname=7732227484&adk=2257642287&adf=1686907328&pi=t.ma~as.7732227484&w=300&lmt=1634733299&psa=0&format=300x250&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299378&bpp=1&bdt=213&idt=106&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=999&ady=315&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=ew5hHCpCBf&p=https%3A//xurl.es&dtd=108
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
bf14bee270a7c9237cc9e28deb028998a04f08aa59309ce22ef92f3ba54ac03d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:31:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
202
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6290
x-xss-protection
0
server
cafe
etag
5128541104351419840
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 03 Nov 2021 12:31:37 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame F4C7 		122 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=250&slotname=7732227484&adk=2257642287&adf=1686907328&pi=t.ma~as.7732227484&w=300&lmt=1634733299&psa=0&format=300x250&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299378&bpp=1&bdt=213&idt=106&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=999&ady=315&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=ew5hHCpCBf&p=https%3A//xurl.es&dtd=108
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5ec6259ce93d1583fd116bc92baa687aacfdf415efabc596b398c1ebf27c680e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:34:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
37884
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1634556853496587"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Wed, 20 Oct 2021 12:34:59 GMT
one_click_handler_one_afma_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211018/r20110914/client/ Frame F4C7 		27 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211018/r20110914/client/one_click_handler_one_afma_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=250&slotname=7732227484&adk=2257642287&adf=1686907328&pi=t.ma~as.7732227484&w=300&lmt=1634733299&psa=0&format=300x250&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299378&bpp=1&bdt=213&idt=106&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=999&ady=315&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=ew5hHCpCBf&p=https%3A//xurl.es&dtd=108
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
21c293e6df6dde82c613e769026a9d9e4d1a67511d217141afa59f3838926318
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 19 Oct 2021 14:35:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
79190
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11253
x-xss-protection
0
server
cafe
etag
15720074209988684830
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 02 Nov 2021 14:35:09 GMT
adview
googleads.g.doubleclick.net/pagead/ Frame F4C7 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=CcITd8wxwYc2qH4yQ3gOXu5qoCfGKqN5loYynpPMOrgIQASCxj4gEYJXikIKgB6ABrdyKiAPIAQKoAwHIA8kEqgTaAU_QUvn4-PsNFwPIfkx5PiXE1LmDnFl9k-mBqafD3mR8-GeSE7k5fiyuA6BcNAybRLAK5Rays3cXdohooPpv160qetGUJpkRkbIoQZFdn-poUfCvwl1-L9qFBsr6PY_GPcQAaT9soYc3i6qdgjS01hx_ZRANJjJDrEOA8nO_r958Iu4PaNp_nMZKCQUqX1b-jXUmOGymi-UkBIwGRv9Oi3phJDSYhr-Pba2bGtRwbuBHkoScN5qwAjhLLCaB2xpHIBQ5RtcQu3h_EPj38IH98uSRakmdeYABefeswATbpLac4QGSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGAoAHgqbFaqgH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgH1ckbqAemvhvYBwHyBwMQ9VzSCAkIgOGAEBABGF-ACgHICwHYEwzQFQGAFwGyFxwKGggAEhRwdWItNDc5MzIwOTMzNTgzMzg2MBgA&sigh=l0Hxp5cT0g0
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=250&slotname=7732227484&adk=2257642287&adf=1686907328&pi=t.ma~as.7732227484&w=300&lmt=1634733299&psa=0&format=300x250&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299378&bpp=1&bdt=213&idt=106&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=999&ady=315&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=ew5hHCpCBf&p=https%3A//xurl.es&dtd=108
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=250&slotname=7732227484&adk=2257642287&adf=1686907328&pi=t.ma~as.7732227484&w=300&lmt=1634733299&psa=0&format=300x250&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299378&bpp=1&bdt=213&idt=106&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=999&ady=315&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=ew5hHCpCBf&p=https%3A//xurl.es&dtd=108
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
date
Wed, 20 Oct 2021 12:34:59 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Wed, 20 Oct 2021 12:34:59 GMT
s
googleads.g.doubleclick.net/pagead/drt/ Frame 717C 		143 B
222 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=250&slotname=7732227484&adk=2257642287&adf=1686907328&pi=t.ma~as.7732227484&w=300&lmt=1634733299&psa=0&format=300x250&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299378&bpp=1&bdt=213&idt=106&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=999&ady=315&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=ew5hHCpCBf&p=https%3A//xurl.es&dtd=108
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/drt/s?v=r20120211
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=250&slotname=7732227484&adk=2257642287&adf=1686907328&pi=t.ma~as.7732227484&w=300&lmt=1634733299&psa=0&format=300x250&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299378&bpp=1&bdt=213&idt=106&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=999&ady=315&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=ew5hHCpCBf&p=https%3A//xurl.es&dtd=108
accept-encoding
gzip, deflate, br
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=250&slotname=7732227484&adk=2257642287&adf=1686907328&pi=t.ma~as.7732227484&w=300&lmt=1634733299&psa=0&format=300x250&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299378&bpp=1&bdt=213&idt=106&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=999&ady=315&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=ew5hHCpCBf&p=https%3A//xurl.es&dtd=108

Response headers

content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Wed, 20 Oct 2021 11:54:37 GMT
server
cafe
content-length
145
x-xss-protection
0
cache-control
public, max-age=3600
age
2422
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
truncated
/ Frame F4C7 		217 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
755d11b5326ae3a32401be8099b7ccf2c45f196bbbe7d7b756c5281a006a606b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type
image/png
si
googleads.g.doubleclick.net/pagead/drt/ Frame 717C
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
158 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=250&slotname=7732227484&adk=2257642287&adf=1686907328&pi=t.ma~as.7732227484&w=300&lmt=1634733299&psa=0&format=300x250&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299378&bpp=1&bdt=213&idt=106&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=999&ady=315&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=ew5hHCpCBf&p=https%3A//xurl.es&dtd=108
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/drt/si?st=NO_DATA
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
cookie
IDE=AHWqTUk4RxDY8d8XhCbteOyQKePxogAt07MTmpln0lIFPo8GJGaawTEjWIprb1v1e7Q
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Wed, 20 Oct 2021 12:35:00 GMT
server
cafe
content-length
0
x-xss-protection
0
set-cookie
DSID=NO_DATA; expires=Wed, 20-Oct-2021 13:35:00 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Wed, 20 Oct 2021 12:35:00 GMT
cache-control
private

Redirect headers

location
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control
private
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Wed, 20 Oct 2021 12:35:00 GMT
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
QjHKgOpm15qTJXWLxUnNMS8wTt6682k-qtw68OFTrDs.js
pagead2.googlesyndication.com/bg/ Frame 272F 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/QjHKgOpm15qTJXWLxUnNMS8wTt6682k-qtw68OFTrDs.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=250&slotname=7732227484&adk=2257642287&adf=1686907328&pi=t.ma~as.7732227484&w=300&lmt=1634733299&psa=0&format=300x250&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299378&bpp=1&bdt=213&idt=106&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=999&ady=315&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=ew5hHCpCBf&p=https%3A//xurl.es&dtd=108
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4231ca80ea66d79a9325758bc549cd312f304edebaf3693eaadc3af0e153ac3b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 11:57:23 GMT
content-encoding
br
x-content-type-options
nosniff
age
2257
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13301
x-xss-protection
0
last-modified
Mon, 11 Oct 2021 11:08:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="botguard-scs"
expires
Thu, 20 Oct 2022 11:57:23 GMT
css
fonts.googleapis.com/ Frame CECC 		3 KB
676 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=90&slotname=4639160287&adk=271488381&adf=1839787983&pi=t.ma~as.4639160287&w=970&lmt=1634733299&psa=0&format=970x90&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299375&bpp=3&bdt=211&idt=84&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&correlator=677329721171&frm=20&pv=2&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=315&ady=166&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3r6ReJ8JPt&p=https%3A//xurl.es&dtd=102
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
last-modified
Wed, 20 Oct 2021 11:23:20 GMT
server
ESF
date
Wed, 20 Oct 2021 12:35:00 GMT
x-frame-options
SAMEORIGIN
report-to
{"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only
same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires
Wed, 20 Oct 2021 12:35:00 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211018/r20110914/client/ Frame 8724 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211018/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=90&slotname=4639160287&adk=271488381&adf=1056458448&pi=t.ma~as.4639160287&w=970&lmt=1634733299&psa=0&format=970x90&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299378&bpp=1&bdt=214&idt=110&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90%2C300x250&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=315&ady=650&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=eB7pRZ64O1&p=https%3A//xurl.es&dtd=114
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:09:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1517
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1426
x-xss-protection
0
server
cafe
etag
18061233391346882222
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 03 Nov 2021 12:09:43 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 8724 		122 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=90&slotname=4639160287&adk=271488381&adf=1056458448&pi=t.ma~as.4639160287&w=970&lmt=1634733299&psa=0&format=970x90&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299378&bpp=1&bdt=214&idt=110&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90%2C300x250&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=315&ady=650&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=eB7pRZ64O1&p=https%3A//xurl.es&dtd=114
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5ec6259ce93d1583fd116bc92baa687aacfdf415efabc596b398c1ebf27c680e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:35:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
37884
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1634556853496587"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Wed, 20 Oct 2021 12:35:00 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211018/r20110914/client/ Frame 8724 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211018/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=90&slotname=4639160287&adk=271488381&adf=1056458448&pi=t.ma~as.4639160287&w=970&lmt=1634733299&psa=0&format=970x90&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299378&bpp=1&bdt=214&idt=110&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90%2C300x250&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=315&ady=650&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=eB7pRZ64O1&p=https%3A//xurl.es&dtd=114
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
bf14bee270a7c9237cc9e28deb028998a04f08aa59309ce22ef92f3ba54ac03d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:31:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
203
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6290
x-xss-protection
0
server
cafe
etag
5128541104351419840
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 03 Nov 2021 12:31:37 GMT
adview
googleads.g.doubleclick.net/pagead/ Frame 8724 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=CiTk18wxwYd3LH8vk3wOlmrv4Dcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNDc5MzIwOTMzNTgzMzg2MKAB1bbS6gPIAQmpAqKX4E3MhrM-qAMBqgSzAU_Q0SXEqe2tcNJMbyHDTkPnkcxj8ToFtymGvemNjYUUn2UE2vbVzGkmSyZG4HDtOS8T2fBmV-tqvkgTNcd3m91KAd54ulW2VHng1aPxXSmifFmad7i1rfQq5NV14owj5uurd9jUHGn_Wv8P1YmofzlDWWo0DU-LiyQa1o4_PKluAEk_Om74o2Ijc387A3IEOPlHlW9eIAMG5Clo43gUa1lFS7PzSQ6_e41krVxI8FxvWdZBgAbUoIrLpJuoo2ygBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAGACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItNDc5MzIwOTMzNTgzMzg2MBgA&sigh=8hzYvkGbGqg&cid=CAQSGwCNIrLMk0KdHHzvaymd7j_51ilpui9nNkTr2RgB
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=90&slotname=4639160287&adk=271488381&adf=1056458448&pi=t.ma~as.4639160287&w=970&lmt=1634733299&psa=0&format=970x90&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299378&bpp=1&bdt=214&idt=110&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90%2C300x250&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=315&ady=650&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=eB7pRZ64O1&p=https%3A//xurl.es&dtd=114
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=90&slotname=4639160287&adk=271488381&adf=1056458448&pi=t.ma~as.4639160287&w=970&lmt=1634733299&psa=0&format=970x90&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299378&bpp=1&bdt=214&idt=110&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90%2C300x250&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=315&ady=650&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=eB7pRZ64O1&p=https%3A//xurl.es&dtd=114
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
date
Wed, 20 Oct 2021 12:35:00 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
notify
rtb.nl.eu.criteo.com/google/auction/ Frame 8724 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://rtb.nl.eu.criteo.com/google/auction/notify?profile=14&payload=UOb8EOfCMMoHWp2DYgICAAAAcRifn9gGVLMQ8wxwYWTE83xY6tWzSSeYABI&wp=YXAM8wAH5d0Kd_JLAA7NJVWMzJ3moV827TfWdQ
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=90&slotname=4639160287&adk=271488381&adf=1056458448&pi=t.ma~as.4639160287&w=970&lmt=1634733299&psa=0&format=970x90&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299378&bpp=1&bdt=214&idt=110&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90%2C300x250&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=315&ady=650&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=eB7pRZ64O1&p=https%3A//xurl.es&dtd=114
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Kestrel /
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:34:59 GMT
server
Kestrel
content-length
0
server-processing-duration-in-ticks
138951
afr.php
ads.eu.criteo.com/delivery/r/ Frame C56E 		173 KB
55 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.eu.criteo.com/delivery/r/afr.php?z=YXAM8wAH5d0Kd_JLAA7NJVWMzJ3moV827TfWdQ&u=%7CjtkNbjzAHvkXI7EFplf4KgdxOu2e6rTR7NxMS3o46Gc%3D%7C&c1=TEbw32HdmhkgeNeeAzq5Zto3zNeDvGephfTH5JL0zydALMisec7v4dU5de-TFyMyKuX9u2jeaiDTb8Ze7hyMlcGgjWJAvQUHRMLNOfpWW7_gxE1dL3ewr_o2zhkXPHjXMbIwAmx8zRtN_X8wUbq8P3pAielLDl_dXqgjC6ouDApKJ0zJkm5ujvDWPyt8533LA0Ufnh5HNVn6fDW_GBkbDkWBtoRWS_l2sn-5TpS7sTFbI_YkOY8wySRCAwQQEYzLk40pEHSe1z2_v2ePMg2fFfOUIDxGRonoEvpk4cGzvWN63hrypEBN7xiLZFAULE6RBnR-70idnFlz8wrM5ESZcnLHcs_6LXKggXlmnax7_2-6Oq4z7U4XUee5zjpRBLn30wAFg07GPI4SPp08yFBrU7qEovLurzDY0aVEprudsWYfwX2VcjCLSmLUXyW5VIzXWSTAz46f_W6dpJryFwZtE5neWSakTh9yfBUJf25zxg374xVDhmgTe46Ie5Ej6uRb&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPqFy8wxwYd3LH8vk3wOlmrv4Dcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNDc5MzIwOTMzNTgzMzg2MKAB1bbS6gPIAQmpAqKX4E3MhrM-qAMBqgS2AU_Q0SXEqe2tcNJMbyHDTkPnkcxj8ToFtymGvemNjYUUn2UE2vbVzGkmSyZG4HDtOS8T2fBmV-tqvkgTNcd3m91KAd54ulW2VHng1aPxXSmifFmad7i1rfQq5NV14owj5uurd9jUHGn_Wv8P1YmofzlDWWo0DU-LiyQa1o4_PKluAEk_Om74o2Ijc387A3IEOPlHlW9eIAMG5Clo43gUa1lFCbH-24kc557bMUjrIGHJod9Vi2dTgAbUoIrLpJuoo2ygBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0BBcd5oEChYOu3-At_vGTJfTTPMQ%26client%3Dca-pub-4793209335833860%26adurl%3D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=90&slotname=4639160287&adk=271488381&adf=1056458448&pi=t.ma~as.4639160287&w=970&lmt=1634733299&psa=0&format=970x90&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299378&bpp=1&bdt=214&idt=110&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&prev_fmts=970x90%2C300x250&correlator=677329721171&frm=20&pv=1&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=315&ady=650&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=eB7pRZ64O1&p=https%3A//xurl.es&dtd=114
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::11 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Kestrel /
Resource Hash
208cec8b4d019eabc7edfa453854f35ab3960e40b13e5733dd98105b9807d0cf

Request headers

:method
GET
:authority
ads.eu.criteo.com
:scheme
https
:path
/delivery/r/afr.php?z=YXAM8wAH5d0Kd_JLAA7NJVWMzJ3moV827TfWdQ&u=%7CjtkNbjzAHvkXI7EFplf4KgdxOu2e6rTR7NxMS3o46Gc%3D%7C&c1=TEbw32HdmhkgeNeeAzq5Zto3zNeDvGephfTH5JL0zydALMisec7v4dU5de-TFyMyKuX9u2jeaiDTb8Ze7hyMlcGgjWJAvQUHRMLNOfpWW7_gxE1dL3ewr_o2zhkXPHjXMbIwAmx8zRtN_X8wUbq8P3pAielLDl_dXqgjC6ouDApKJ0zJkm5ujvDWPyt8533LA0Ufnh5HNVn6fDW_GBkbDkWBtoRWS_l2sn-5TpS7sTFbI_YkOY8wySRCAwQQEYzLk40pEHSe1z2_v2ePMg2fFfOUIDxGRonoEvpk4cGzvWN63hrypEBN7xiLZFAULE6RBnR-70idnFlz8wrM5ESZcnLHcs_6LXKggXlmnax7_2-6Oq4z7U4XUee5zjpRBLn30wAFg07GPI4SPp08yFBrU7qEovLurzDY0aVEprudsWYfwX2VcjCLSmLUXyW5VIzXWSTAz46f_W6dpJryFwZtE5neWSakTh9yfBUJf25zxg374xVDhmgTe46Ie5Ej6uRb&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPqFy8wxwYd3LH8vk3wOlmrv4Dcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNDc5MzIwOTMzNTgzMzg2MKAB1bbS6gPIAQmpAqKX4E3MhrM-qAMBqgS2AU_Q0SXEqe2tcNJMbyHDTkPnkcxj8ToFtymGvemNjYUUn2UE2vbVzGkmSyZG4HDtOS8T2fBmV-tqvkgTNcd3m91KAd54ulW2VHng1aPxXSmifFmad7i1rfQq5NV14owj5uurd9jUHGn_Wv8P1YmofzlDWWo0DU-LiyQa1o4_PKluAEk_Om74o2Ijc387A3IEOPlHlW9eIAMG5Clo43gUa1lFCbH-24kc557bMUjrIGHJod9Vi2dTgAbUoIrLpJuoo2ygBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0BBcd5oEChYOu3-At_vGTJfTTPMQ%26client%3Dca-pub-4793209335833860%26adurl%3D
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/

Response headers

date
Wed, 20 Oct 2021 12:35:00 GMT
content-type
text/html
server
Kestrel
cache-control
private, max-age=0, no-cache
pragma
no-cache
expires
Mon, 26 Jul 1997 05:00:00 GMT
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
access-control-max-age
1000
cross-origin-resource-policy
cross-origin
p3p
CP='CUR ADM OUR NOR STA NID'
report-to
{"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=A-Ub2JMlMHqFV0ggjEUVTcbks15IZHJXMfO-TDZn7y7q44a8LzXxMRaWTBuQVYHJNV84OatFkGCsEyHHZE-Ovm2G7f1lLcoDEg3US0vO5bhc3EU4hXAGM8xw2HR8gYZRhyrfuWz3Hk0wRDMOyoAiasGxv7Ec_yA0sUCBLEZH7_ELpm6zJH-iZGmlHnezbmQuU6rfybWyzsVk7K48BUGl8e-A2mqLr8iFVhCMPCN2EH6nCTy0pTI6CLgeWI1kk404eo0Lng"}], "max_age": 86400}
link
<pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
server-processing-duration-in-ticks
119513458
content-encoding
gzip
vary
Accept-Encoding
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211018/r20110914/client/ Frame CECC 		2 KB
990 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211018/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=90&slotname=4639160287&adk=271488381&adf=1839787983&pi=t.ma~as.4639160287&w=970&lmt=1634733299&psa=0&format=970x90&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299375&bpp=3&bdt=211&idt=84&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&correlator=677329721171&frm=20&pv=2&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=315&ady=166&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3r6ReJ8JPt&p=https%3A//xurl.es&dtd=102
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1b4e852fde612daeb72f1f4cca801a99cc2730875048c5ac3faa9f5ca5854155
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:22:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
759
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
885
x-xss-protection
0
server
cafe
etag
638833322182864030
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 03 Nov 2021 12:22:21 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211018/r20110914/ Frame CECC 		18 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211018/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=90&slotname=4639160287&adk=271488381&adf=1839787983&pi=t.ma~as.4639160287&w=970&lmt=1634733299&psa=0&format=970x90&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299375&bpp=3&bdt=211&idt=84&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&correlator=677329721171&frm=20&pv=2&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=315&ady=166&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3r6ReJ8JPt&p=https%3A//xurl.es&dtd=102
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8bfd018bb29e8c00faffeb3660e5cbcec66c0ba1dff56f8d2f9a1bcc47c11852
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:08:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1575
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7699
x-xss-protection
0
server
cafe
etag
16022440550062051545
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 03 Nov 2021 12:08:45 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211018/r20110914/client/ Frame CECC 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211018/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=90&slotname=4639160287&adk=271488381&adf=1839787983&pi=t.ma~as.4639160287&w=970&lmt=1634733299&psa=0&format=970x90&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299375&bpp=3&bdt=211&idt=84&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&correlator=677329721171&frm=20&pv=2&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=315&ady=166&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3r6ReJ8JPt&p=https%3A//xurl.es&dtd=102
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:09:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1517
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1426
x-xss-protection
0
server
cafe
etag
18061233391346882222
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 03 Nov 2021 12:09:43 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame CECC 		122 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=90&slotname=4639160287&adk=271488381&adf=1839787983&pi=t.ma~as.4639160287&w=970&lmt=1634733299&psa=0&format=970x90&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299375&bpp=3&bdt=211&idt=84&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&correlator=677329721171&frm=20&pv=2&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=315&ady=166&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3r6ReJ8JPt&p=https%3A//xurl.es&dtd=102
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5ec6259ce93d1583fd116bc92baa687aacfdf415efabc596b398c1ebf27c680e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:35:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
37884
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1634556853496587"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Wed, 20 Oct 2021 12:35:00 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211018/r20110914/client/ Frame CECC 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211018/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=90&slotname=4639160287&adk=271488381&adf=1839787983&pi=t.ma~as.4639160287&w=970&lmt=1634733299&psa=0&format=970x90&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299375&bpp=3&bdt=211&idt=84&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&correlator=677329721171&frm=20&pv=2&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=315&ady=166&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3r6ReJ8JPt&p=https%3A//xurl.es&dtd=102
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
bf14bee270a7c9237cc9e28deb028998a04f08aa59309ce22ef92f3ba54ac03d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:31:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
203
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6290
x-xss-protection
0
server
cafe
etag
5128541104351419840
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 03 Nov 2021 12:31:37 GMT
94b9e9edb15b7c220f12fa63d878a5af.js
www.gstatic.com/mysidia/ Frame CECC 		27 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/mysidia/94b9e9edb15b7c220f12fa63d878a5af.js?tag=mysidia_one_click_handler_one_afma_2019
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=90&slotname=4639160287&adk=271488381&adf=1839787983&pi=t.ma~as.4639160287&w=970&lmt=1634733299&psa=0&format=970x90&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299375&bpp=3&bdt=211&idt=84&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&correlator=677329721171&frm=20&pv=2&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=315&ady=166&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3r6ReJ8JPt&p=https%3A//xurl.es&dtd=102
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3d1246d2fe982f57c0a911530b2fa93a679e42c0d897151f39cffa4762c55f5d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Mon, 18 Oct 2021 12:52:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
171780
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11213
x-xss-protection
0
last-modified
Tue, 12 Oct 2021 03:34:41 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="mysidia"
expires
Sun, 16 Jan 2022 12:52:00 GMT
downsize_200k_v1
tpc.googlesyndication.com/simgad/5472953507826475334/ Frame CECC 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/5472953507826475334/downsize_200k_v1?w=195&h=102
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=90&slotname=4639160287&adk=271488381&adf=1839787983&pi=t.ma~as.4639160287&w=970&lmt=1634733299&psa=0&format=970x90&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299375&bpp=3&bdt=211&idt=84&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&correlator=677329721171&frm=20&pv=2&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=315&ady=166&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3r6ReJ8JPt&p=https%3A//xurl.es&dtd=102
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
973766985aa550284dc3001f74297e9697084aacde7fc72cb1c0eddbc087b329
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sat, 16 Oct 2021 02:21:16 GMT
x-content-type-options
nosniff
age
382424
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6119
x-xss-protection
0
last-modified
Wed, 30 Sep 2020 15:20:29 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Sun, 16 Oct 2022 02:21:16 GMT
truncated
/ Frame CECC 		209 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0cc7088b335b30f7b1fa0903bc8aa143b11cb8408032d62d28d5ab768cc68c88

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type
image/svg+xml
adview
googleads.g.doubleclick.net/pagead/ Frame CECC 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=CTySn8wxwYf_yHtSorASti47wC8qS-Ohl08XQqZQOiPng2YMdEAEgsY-IBGCV4pCCoAegAc7r8NECyAEJqQIkbMii_ICzPqgDAcgDywSqBNEBT9DNJqIRy0e8taIkWLNrbYu2EUIsR4ru-H6KiNvORyVPugQ_Ff8tco1v_6tqhCXsulFfFHYhcmCXvZSrhECddgTGOGG2RKKpKsG8dA7kv-W4arV9-DhIxRoLUJf2bJEnOJPHYzNjuhhOAEyauNyms-HvYvlKJOkoQMdRzJBDGbVProIXZ0hsh2VLeZCbpyppg1h8QgMqcbxn1OZDqNadmRA-qysSF1yvEFBMqsaLMDtlu4UDaSnQeTCMt_pm3GY1N0FIThFrwGZkOmm4SJFY_r3ABIaPup7GA5IFBAgEGAGSBQQIBRgEoAYugAealI-uAagH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgH_p6xAqgH1ckbqAemvhvYBwDyBwQQrY4E0ggJCIDhgBAQARhfgAoByAsBuBOIJ9gTDYgUAdAVAZgWAYAXAbIXHAoaCAASFHB1Yi00NzkzMjA5MzM1ODMzODYwGAA&sigh=4DTRZK-Mk5o&template_id=5000
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=90&slotname=4639160287&adk=271488381&adf=1839787983&pi=t.ma~as.4639160287&w=970&lmt=1634733299&psa=0&format=970x90&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299375&bpp=3&bdt=211&idt=84&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&correlator=677329721171&frm=20&pv=2&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=315&ady=166&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3r6ReJ8JPt&p=https%3A//xurl.es&dtd=102
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=90&slotname=4639160287&adk=271488381&adf=1839787983&pi=t.ma~as.4639160287&w=970&lmt=1634733299&psa=0&format=970x90&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299375&bpp=3&bdt=211&idt=84&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&correlator=677329721171&frm=20&pv=2&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=315&ady=166&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3r6ReJ8JPt&p=https%3A//xurl.es&dtd=102
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
date
Wed, 20 Oct 2021 12:35:00 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
truncated
/ Frame 8724 		213 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e9d27f2d7dc647a05780218c575e73fe4bde5791277a03d0bb775fb41d361c73

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame CECC 		214 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3bed0f21b387ac75d06dfb44302f644a033c6edaf5ea9cc8e307cd735daff8df

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type
image/png
4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v36/ Frame CECC 		21 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/googlesans/v36/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1abc5469f1235e85489ca1062a07fe18c7f449e3ba039d3de0da07fbb3c5892d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://googleads.g.doubleclick.net
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Mon, 18 Oct 2021 19:46:29 GMT
x-content-type-options
nosniff
age
146911
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21660
x-xss-protection
0
last-modified
Wed, 01 Sep 2021 18:07:18 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 18 Oct 2022 19:46:29 GMT
4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v36/ Frame CECC 		21 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/googlesans/v36/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://googleads.g.doubleclick.net
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Mon, 18 Oct 2021 18:21:26 GMT
x-content-type-options
nosniff
age
152014
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21424
x-xss-protection
0
last-modified
Wed, 01 Sep 2021 18:08:24 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Tue, 18 Oct 2022 18:21:26 GMT
QjHKgOpm15qTJXWLxUnNMS8wTt6682k-qtw68OFTrDs.js
pagead2.googlesyndication.com/bg/ Frame 20FA 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/QjHKgOpm15qTJXWLxUnNMS8wTt6682k-qtw68OFTrDs.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4793209335833860&output=html&h=90&slotname=4639160287&adk=271488381&adf=1839787983&pi=t.ma~as.4639160287&w=970&lmt=1634733299&psa=0&format=970x90&url=https%3A%2F%2Fxurl.es%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634733299375&bpp=3&bdt=211&idt=84&shv=r20211018&mjsv=m202110130101&ptt=9&saldr=aa&abxe=1&correlator=677329721171&frm=20&pv=2&ga_vid=446147574.1634733299&ga_sid=1634733299&ga_hid=70025016&ga_fc=1&ga_wpids=UA-266266-17&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=315&ady=166&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062944%2C31062526&oid=2&pvsid=2843641532580074&pem=238&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3r6ReJ8JPt&p=https%3A//xurl.es&dtd=102
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4231ca80ea66d79a9325758bc549cd312f304edebaf3693eaadc3af0e153ac3b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 11:57:23 GMT
content-encoding
br
x-content-type-options
nosniff
age
2257
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13301
x-xss-protection
0
last-modified
Mon, 11 Oct 2021 11:08:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="botguard-scs"
expires
Thu, 20 Oct 2022 11:57:23 GMT
reactive_library_fy2019.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/ 		143 KB
52 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/reactive_library_fy2019.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4793209335833860&plah=xurl.es
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8481816e1174442d9a0165584b4b85f6d825b40471e9e197c86665bf730ab1ce
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:35:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
52662
x-xss-protection
0
server
cafe
etag
14075018075078326199
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Wed, 20 Oct 2021 12:35:00 GMT
privacy_small.svg
static.criteo.net/flash/icon/ Frame C56E 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.criteo.net/flash/icon/privacy_small.svg
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXAM8wAH5d0Kd_JLAA7NJVWMzJ3moV827TfWdQ&u=%7CjtkNbjzAHvkXI7EFplf4KgdxOu2e6rTR7NxMS3o46Gc%3D%7C&c1=TEbw32HdmhkgeNeeAzq5Zto3zNeDvGephfTH5JL0zydALMisec7v4dU5de-TFyMyKuX9u2jeaiDTb8Ze7hyMlcGgjWJAvQUHRMLNOfpWW7_gxE1dL3ewr_o2zhkXPHjXMbIwAmx8zRtN_X8wUbq8P3pAielLDl_dXqgjC6ouDApKJ0zJkm5ujvDWPyt8533LA0Ufnh5HNVn6fDW_GBkbDkWBtoRWS_l2sn-5TpS7sTFbI_YkOY8wySRCAwQQEYzLk40pEHSe1z2_v2ePMg2fFfOUIDxGRonoEvpk4cGzvWN63hrypEBN7xiLZFAULE6RBnR-70idnFlz8wrM5ESZcnLHcs_6LXKggXlmnax7_2-6Oq4z7U4XUee5zjpRBLn30wAFg07GPI4SPp08yFBrU7qEovLurzDY0aVEprudsWYfwX2VcjCLSmLUXyW5VIzXWSTAz46f_W6dpJryFwZtE5neWSakTh9yfBUJf25zxg374xVDhmgTe46Ie5Ej6uRb&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPqFy8wxwYd3LH8vk3wOlmrv4Dcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNDc5MzIwOTMzNTgzMzg2MKAB1bbS6gPIAQmpAqKX4E3MhrM-qAMBqgS2AU_Q0SXEqe2tcNJMbyHDTkPnkcxj8ToFtymGvemNjYUUn2UE2vbVzGkmSyZG4HDtOS8T2fBmV-tqvkgTNcd3m91KAd54ulW2VHng1aPxXSmifFmad7i1rfQq5NV14owj5uurd9jUHGn_Wv8P1YmofzlDWWo0DU-LiyQa1o4_PKluAEk_Om74o2Ijc387A3IEOPlHlW9eIAMG5Clo43gUa1lFCbH-24kc557bMUjrIGHJod9Vi2dTgAbUoIrLpJuoo2ygBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0BBcd5oEChYOu3-At_vGTJfTTPMQ%26client%3Dca-pub-4793209335833860%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:35:00 GMT
content-encoding
gzip
last-modified
Tue, 11 Feb 2020 14:30:28 GMT
server
nginx
cross-origin-embedder-policy
require-corp
etag
W/"5e42ba84-6aa"
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Sat, 15 Oct 2022 12:35:00 GMT
adchoices_de.svg
static.criteo.net/flash/icon/ Frame C56E 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.criteo.net/flash/icon/adchoices_de.svg
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXAM8wAH5d0Kd_JLAA7NJVWMzJ3moV827TfWdQ&u=%7CjtkNbjzAHvkXI7EFplf4KgdxOu2e6rTR7NxMS3o46Gc%3D%7C&c1=TEbw32HdmhkgeNeeAzq5Zto3zNeDvGephfTH5JL0zydALMisec7v4dU5de-TFyMyKuX9u2jeaiDTb8Ze7hyMlcGgjWJAvQUHRMLNOfpWW7_gxE1dL3ewr_o2zhkXPHjXMbIwAmx8zRtN_X8wUbq8P3pAielLDl_dXqgjC6ouDApKJ0zJkm5ujvDWPyt8533LA0Ufnh5HNVn6fDW_GBkbDkWBtoRWS_l2sn-5TpS7sTFbI_YkOY8wySRCAwQQEYzLk40pEHSe1z2_v2ePMg2fFfOUIDxGRonoEvpk4cGzvWN63hrypEBN7xiLZFAULE6RBnR-70idnFlz8wrM5ESZcnLHcs_6LXKggXlmnax7_2-6Oq4z7U4XUee5zjpRBLn30wAFg07GPI4SPp08yFBrU7qEovLurzDY0aVEprudsWYfwX2VcjCLSmLUXyW5VIzXWSTAz46f_W6dpJryFwZtE5neWSakTh9yfBUJf25zxg374xVDhmgTe46Ie5Ej6uRb&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPqFy8wxwYd3LH8vk3wOlmrv4Dcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNDc5MzIwOTMzNTgzMzg2MKAB1bbS6gPIAQmpAqKX4E3MhrM-qAMBqgS2AU_Q0SXEqe2tcNJMbyHDTkPnkcxj8ToFtymGvemNjYUUn2UE2vbVzGkmSyZG4HDtOS8T2fBmV-tqvkgTNcd3m91KAd54ulW2VHng1aPxXSmifFmad7i1rfQq5NV14owj5uurd9jUHGn_Wv8P1YmofzlDWWo0DU-LiyQa1o4_PKluAEk_Om74o2Ijc387A3IEOPlHlW9eIAMG5Clo43gUa1lFCbH-24kc557bMUjrIGHJod9Vi2dTgAbUoIrLpJuoo2ygBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0BBcd5oEChYOu3-At_vGTJfTTPMQ%26client%3Dca-pub-4793209335833860%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:35:00 GMT
content-encoding
gzip
last-modified
Tue, 11 Feb 2020 14:27:58 GMT
server
nginx
cross-origin-embedder-policy
require-corp
etag
W/"5e42b9ee-763"
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Sat, 15 Oct 2022 12:35:00 GMT
close_button.svg
static.criteo.net/flash/icon/ Frame C56E 		308 B
608 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.criteo.net/flash/icon/close_button.svg
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXAM8wAH5d0Kd_JLAA7NJVWMzJ3moV827TfWdQ&u=%7CjtkNbjzAHvkXI7EFplf4KgdxOu2e6rTR7NxMS3o46Gc%3D%7C&c1=TEbw32HdmhkgeNeeAzq5Zto3zNeDvGephfTH5JL0zydALMisec7v4dU5de-TFyMyKuX9u2jeaiDTb8Ze7hyMlcGgjWJAvQUHRMLNOfpWW7_gxE1dL3ewr_o2zhkXPHjXMbIwAmx8zRtN_X8wUbq8P3pAielLDl_dXqgjC6ouDApKJ0zJkm5ujvDWPyt8533LA0Ufnh5HNVn6fDW_GBkbDkWBtoRWS_l2sn-5TpS7sTFbI_YkOY8wySRCAwQQEYzLk40pEHSe1z2_v2ePMg2fFfOUIDxGRonoEvpk4cGzvWN63hrypEBN7xiLZFAULE6RBnR-70idnFlz8wrM5ESZcnLHcs_6LXKggXlmnax7_2-6Oq4z7U4XUee5zjpRBLn30wAFg07GPI4SPp08yFBrU7qEovLurzDY0aVEprudsWYfwX2VcjCLSmLUXyW5VIzXWSTAz46f_W6dpJryFwZtE5neWSakTh9yfBUJf25zxg374xVDhmgTe46Ie5Ej6uRb&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPqFy8wxwYd3LH8vk3wOlmrv4Dcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNDc5MzIwOTMzNTgzMzg2MKAB1bbS6gPIAQmpAqKX4E3MhrM-qAMBqgS2AU_Q0SXEqe2tcNJMbyHDTkPnkcxj8ToFtymGvemNjYUUn2UE2vbVzGkmSyZG4HDtOS8T2fBmV-tqvkgTNcd3m91KAd54ulW2VHng1aPxXSmifFmad7i1rfQq5NV14owj5uurd9jUHGn_Wv8P1YmofzlDWWo0DU-LiyQa1o4_PKluAEk_Om74o2Ijc387A3IEOPlHlW9eIAMG5Clo43gUa1lFCbH-24kc557bMUjrIGHJod9Vi2dTgAbUoIrLpJuoo2ygBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0BBcd5oEChYOu3-At_vGTJfTTPMQ%26client%3Dca-pub-4793209335833860%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:35:00 GMT
last-modified
Fri, 14 Feb 2020 13:51:32 GMT
server
nginx
cross-origin-embedder-policy
require-corp
etag
"5e46a5e4-134"
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
308
expires
Sat, 15 Oct 2022 12:35:00 GMT
back_button.svg
static.criteo.net/flash/icon/ Frame C56E 		507 B
807 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.criteo.net/flash/icon/back_button.svg
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXAM8wAH5d0Kd_JLAA7NJVWMzJ3moV827TfWdQ&u=%7CjtkNbjzAHvkXI7EFplf4KgdxOu2e6rTR7NxMS3o46Gc%3D%7C&c1=TEbw32HdmhkgeNeeAzq5Zto3zNeDvGephfTH5JL0zydALMisec7v4dU5de-TFyMyKuX9u2jeaiDTb8Ze7hyMlcGgjWJAvQUHRMLNOfpWW7_gxE1dL3ewr_o2zhkXPHjXMbIwAmx8zRtN_X8wUbq8P3pAielLDl_dXqgjC6ouDApKJ0zJkm5ujvDWPyt8533LA0Ufnh5HNVn6fDW_GBkbDkWBtoRWS_l2sn-5TpS7sTFbI_YkOY8wySRCAwQQEYzLk40pEHSe1z2_v2ePMg2fFfOUIDxGRonoEvpk4cGzvWN63hrypEBN7xiLZFAULE6RBnR-70idnFlz8wrM5ESZcnLHcs_6LXKggXlmnax7_2-6Oq4z7U4XUee5zjpRBLn30wAFg07GPI4SPp08yFBrU7qEovLurzDY0aVEprudsWYfwX2VcjCLSmLUXyW5VIzXWSTAz46f_W6dpJryFwZtE5neWSakTh9yfBUJf25zxg374xVDhmgTe46Ie5Ej6uRb&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPqFy8wxwYd3LH8vk3wOlmrv4Dcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNDc5MzIwOTMzNTgzMzg2MKAB1bbS6gPIAQmpAqKX4E3MhrM-qAMBqgS2AU_Q0SXEqe2tcNJMbyHDTkPnkcxj8ToFtymGvemNjYUUn2UE2vbVzGkmSyZG4HDtOS8T2fBmV-tqvkgTNcd3m91KAd54ulW2VHng1aPxXSmifFmad7i1rfQq5NV14owj5uurd9jUHGn_Wv8P1YmofzlDWWo0DU-LiyQa1o4_PKluAEk_Om74o2Ijc387A3IEOPlHlW9eIAMG5Clo43gUa1lFCbH-24kc557bMUjrIGHJod9Vi2dTgAbUoIrLpJuoo2ygBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0BBcd5oEChYOu3-At_vGTJfTTPMQ%26client%3Dca-pub-4793209335833860%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
8f9a7962cf58f27b89c0627d094ee1b631ec118675f9eae1dc06031353360422

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:35:00 GMT
last-modified
Thu, 01 Apr 2021 14:03:13 GMT
server
nginx
cross-origin-embedder-policy
require-corp
etag
"6065d2a1-1fb"
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
507
expires
Sat, 15 Oct 2022 12:35:00 GMT
m
secure-gl.imrworldwide.com/cgi-bin/ Frame C56E 		0
461 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure-gl.imrworldwide.com/cgi-bin/m?ca=nlsn184820&cr=crtve&ce=criteo&pc=criteo_plc0001&ci=nlsnci162&am=3&at=view&rt=banner&st=image&r=1634733300
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXAM8wAH5d0Kd_JLAA7NJVWMzJ3moV827TfWdQ&u=%7CjtkNbjzAHvkXI7EFplf4KgdxOu2e6rTR7NxMS3o46Gc%3D%7C&c1=TEbw32HdmhkgeNeeAzq5Zto3zNeDvGephfTH5JL0zydALMisec7v4dU5de-TFyMyKuX9u2jeaiDTb8Ze7hyMlcGgjWJAvQUHRMLNOfpWW7_gxE1dL3ewr_o2zhkXPHjXMbIwAmx8zRtN_X8wUbq8P3pAielLDl_dXqgjC6ouDApKJ0zJkm5ujvDWPyt8533LA0Ufnh5HNVn6fDW_GBkbDkWBtoRWS_l2sn-5TpS7sTFbI_YkOY8wySRCAwQQEYzLk40pEHSe1z2_v2ePMg2fFfOUIDxGRonoEvpk4cGzvWN63hrypEBN7xiLZFAULE6RBnR-70idnFlz8wrM5ESZcnLHcs_6LXKggXlmnax7_2-6Oq4z7U4XUee5zjpRBLn30wAFg07GPI4SPp08yFBrU7qEovLurzDY0aVEprudsWYfwX2VcjCLSmLUXyW5VIzXWSTAz46f_W6dpJryFwZtE5neWSakTh9yfBUJf25zxg374xVDhmgTe46Ie5Ej6uRb&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPqFy8wxwYd3LH8vk3wOlmrv4Dcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNDc5MzIwOTMzNTgzMzg2MKAB1bbS6gPIAQmpAqKX4E3MhrM-qAMBqgS2AU_Q0SXEqe2tcNJMbyHDTkPnkcxj8ToFtymGvemNjYUUn2UE2vbVzGkmSyZG4HDtOS8T2fBmV-tqvkgTNcd3m91KAd54ulW2VHng1aPxXSmifFmad7i1rfQq5NV14owj5uurd9jUHGn_Wv8P1YmofzlDWWo0DU-LiyQa1o4_PKluAEk_Om74o2Ijc387A3IEOPlHlW9eIAMG5Clo43gUa1lFCbH-24kc557bMUjrIGHJod9Vi2dTgAbUoIrLpJuoo2ygBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0BBcd5oEChYOu3-At_vGTJfTTPMQ%26client%3Dca-pub-4793209335833860%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:3200:1e:a43d:b640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Oct 2021 12:35:00 GMT
via
1.1 ba77f90aac0ddbc2c4c2c02062fac762.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
FRA50-C1
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://secure-gl.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin
*
cache-control
no-cache
cross-origin-resource-policy
cross-origin
x-cache
Miss from cloudfront
content-length
0
x-amz-cf-id
zdzzxOo_yFLPs9R7dme4XFtJXK8YqHmFKEHaxuSr5EdUNIZX67TciQ==
expires
Thu, 01 Dec 1994 16:00:00 GMT
lg.php
cat.nl.eu.criteo.com/delivery/ Frame C56E 		43 B
344 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cat.nl.eu.criteo.com/delivery/lg.php?cppv=3&cpp=hM0dj_H16oF6k3Eq4qjkoectffQkepn5eNDOMxJLbPkxPmYfw6UqYPYkSdK2V7TTLY8tYpa7OeCYqSvgYAJXByjDMt194GEHB2wTR5EefP2apKNThlJAsAX9auWAo5FPZIVwWqlz5v21CnaxrPtBQbXZ5kMexBjDuHMy7fsplS5q6HsXmedGYrPjLlYeI7OxmyXEJClCCWGGtsjer56Ysad6JdrfS_sokK9gH9mHz5_0hYk8OZhw9B_toUT1ZsCBVAQY4qgboWRBm8DeguhmP0AJAV2Es0-Y9J5x9fiZDgCKJW7WRo_3MM3vfw9RKQ0s9bSuMBnTTqCDPNiiJBTuTBHRPFjqgDuaGoPNgY6Z9kjka9A_ApU5_fz24dWhJMvEKoPcXcTAs8uqGDPRSvlDzpjVTDvMiyXurKRyQQ_CyyPMPOvrNXuyG-X5oYhBDFxssSV6Eg
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXAM8wAH5d0Kd_JLAA7NJVWMzJ3moV827TfWdQ&u=%7CjtkNbjzAHvkXI7EFplf4KgdxOu2e6rTR7NxMS3o46Gc%3D%7C&c1=TEbw32HdmhkgeNeeAzq5Zto3zNeDvGephfTH5JL0zydALMisec7v4dU5de-TFyMyKuX9u2jeaiDTb8Ze7hyMlcGgjWJAvQUHRMLNOfpWW7_gxE1dL3ewr_o2zhkXPHjXMbIwAmx8zRtN_X8wUbq8P3pAielLDl_dXqgjC6ouDApKJ0zJkm5ujvDWPyt8533LA0Ufnh5HNVn6fDW_GBkbDkWBtoRWS_l2sn-5TpS7sTFbI_YkOY8wySRCAwQQEYzLk40pEHSe1z2_v2ePMg2fFfOUIDxGRonoEvpk4cGzvWN63hrypEBN7xiLZFAULE6RBnR-70idnFlz8wrM5ESZcnLHcs_6LXKggXlmnax7_2-6Oq4z7U4XUee5zjpRBLn30wAFg07GPI4SPp08yFBrU7qEovLurzDY0aVEprudsWYfwX2VcjCLSmLUXyW5VIzXWSTAz46f_W6dpJryFwZtE5neWSakTh9yfBUJf25zxg374xVDhmgTe46Ie5Ej6uRb&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPqFy8wxwYd3LH8vk3wOlmrv4Dcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNDc5MzIwOTMzNTgzMzg2MKAB1bbS6gPIAQmpAqKX4E3MhrM-qAMBqgS2AU_Q0SXEqe2tcNJMbyHDTkPnkcxj8ToFtymGvemNjYUUn2UE2vbVzGkmSyZG4HDtOS8T2fBmV-tqvkgTNcd3m91KAd54ulW2VHng1aPxXSmifFmad7i1rfQq5NV14owj5uurd9jUHGn_Wv8P1YmofzlDWWo0DU-LiyQa1o4_PKluAEk_Om74o2Ijc387A3IEOPlHlW9eIAMG5Clo43gUa1lFCbH-24kc557bMUjrIGHJod9Vi2dTgAbUoIrLpJuoo2ygBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0BBcd5oEChYOu3-At_vGTJfTTPMQ%26client%3Dca-pub-4793209335833860%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.148 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Oct 2021 12:34:59 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control
no-cache
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
5849
content-type
image/gif
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT
animejs.js
static.criteo.net/animejs/ Frame C56E 		12 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/animejs/animejs.js
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXAM8wAH5d0Kd_JLAA7NJVWMzJ3moV827TfWdQ&u=%7CjtkNbjzAHvkXI7EFplf4KgdxOu2e6rTR7NxMS3o46Gc%3D%7C&c1=TEbw32HdmhkgeNeeAzq5Zto3zNeDvGephfTH5JL0zydALMisec7v4dU5de-TFyMyKuX9u2jeaiDTb8Ze7hyMlcGgjWJAvQUHRMLNOfpWW7_gxE1dL3ewr_o2zhkXPHjXMbIwAmx8zRtN_X8wUbq8P3pAielLDl_dXqgjC6ouDApKJ0zJkm5ujvDWPyt8533LA0Ufnh5HNVn6fDW_GBkbDkWBtoRWS_l2sn-5TpS7sTFbI_YkOY8wySRCAwQQEYzLk40pEHSe1z2_v2ePMg2fFfOUIDxGRonoEvpk4cGzvWN63hrypEBN7xiLZFAULE6RBnR-70idnFlz8wrM5ESZcnLHcs_6LXKggXlmnax7_2-6Oq4z7U4XUee5zjpRBLn30wAFg07GPI4SPp08yFBrU7qEovLurzDY0aVEprudsWYfwX2VcjCLSmLUXyW5VIzXWSTAz46f_W6dpJryFwZtE5neWSakTh9yfBUJf25zxg374xVDhmgTe46Ie5Ej6uRb&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPqFy8wxwYd3LH8vk3wOlmrv4Dcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNDc5MzIwOTMzNTgzMzg2MKAB1bbS6gPIAQmpAqKX4E3MhrM-qAMBqgS2AU_Q0SXEqe2tcNJMbyHDTkPnkcxj8ToFtymGvemNjYUUn2UE2vbVzGkmSyZG4HDtOS8T2fBmV-tqvkgTNcd3m91KAd54ulW2VHng1aPxXSmifFmad7i1rfQq5NV14owj5uurd9jUHGn_Wv8P1YmofzlDWWo0DU-LiyQa1o4_PKluAEk_Om74o2Ijc387A3IEOPlHlW9eIAMG5Clo43gUa1lFCbH-24kc557bMUjrIGHJod9Vi2dTgAbUoIrLpJuoo2ygBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0BBcd5oEChYOu3-At_vGTJfTTPMQ%26client%3Dca-pub-4793209335833860%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:35:00 GMT
content-encoding
gzip
last-modified
Tue, 26 Mar 2019 17:44:11 GMT
server
nginx
cross-origin-embedder-policy
require-corp
etag
W/"5c9a64eb-3181"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Sat, 15 Oct 2022 12:35:00 GMT
img
pix.eu.criteo.net/img/ Frame C56E 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pix.eu.criteo.net/img/img?h=176&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fstatic.nl.eu.criteo.net%2Fdesign%2Fdt%2F2861%2F190124%2F79f2c646e3f74b54931cff1f39d769d0_blue.png&v=3&w=256&s=9ACZDkBN5yZSSGrFyguWDdCY
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXAM8wAH5d0Kd_JLAA7NJVWMzJ3moV827TfWdQ&u=%7CjtkNbjzAHvkXI7EFplf4KgdxOu2e6rTR7NxMS3o46Gc%3D%7C&c1=TEbw32HdmhkgeNeeAzq5Zto3zNeDvGephfTH5JL0zydALMisec7v4dU5de-TFyMyKuX9u2jeaiDTb8Ze7hyMlcGgjWJAvQUHRMLNOfpWW7_gxE1dL3ewr_o2zhkXPHjXMbIwAmx8zRtN_X8wUbq8P3pAielLDl_dXqgjC6ouDApKJ0zJkm5ujvDWPyt8533LA0Ufnh5HNVn6fDW_GBkbDkWBtoRWS_l2sn-5TpS7sTFbI_YkOY8wySRCAwQQEYzLk40pEHSe1z2_v2ePMg2fFfOUIDxGRonoEvpk4cGzvWN63hrypEBN7xiLZFAULE6RBnR-70idnFlz8wrM5ESZcnLHcs_6LXKggXlmnax7_2-6Oq4z7U4XUee5zjpRBLn30wAFg07GPI4SPp08yFBrU7qEovLurzDY0aVEprudsWYfwX2VcjCLSmLUXyW5VIzXWSTAz46f_W6dpJryFwZtE5neWSakTh9yfBUJf25zxg374xVDhmgTe46Ie5Ej6uRb&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPqFy8wxwYd3LH8vk3wOlmrv4Dcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNDc5MzIwOTMzNTgzMzg2MKAB1bbS6gPIAQmpAqKX4E3MhrM-qAMBqgS2AU_Q0SXEqe2tcNJMbyHDTkPnkcxj8ToFtymGvemNjYUUn2UE2vbVzGkmSyZG4HDtOS8T2fBmV-tqvkgTNcd3m91KAd54ulW2VHng1aPxXSmifFmad7i1rfQq5NV14owj5uurd9jUHGn_Wv8P1YmofzlDWWo0DU-LiyQa1o4_PKluAEk_Om74o2Ijc387A3IEOPlHlW9eIAMG5Clo43gUa1lFCbH-24kc557bMUjrIGHJod9Vi2dTgAbUoIrLpJuoo2ygBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0BBcd5oEChYOu3-At_vGTJfTTPMQ%26client%3Dca-pub-4793209335833860%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
pix.am5.vip.prod.criteo.com
Software
Finatra /
Resource Hash
52f3ea846e97001993e527b3f19d26cdc768af17dc17a0c1adcbda7210bf491e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:35:00 GMT
last-modified
Wed, 4 Jun 2008 06:06:06 GMT
server
Finatra
vary
Origin
content-type
image/png
cache-control
public, max-age=28953712
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
9247
expires
Tue, 20 Sep 2022 15:16:53 GMT
img
pix.eu.criteo.net/img/ Frame C56E 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FB%2FlogoBarmherzige-Bruder-Trier-gGmbH-138366DE.gif%3Feb%3D1&v=3&w=400&s=18mokc4_6qm3oB3KOjxei_8u&b=400
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXAM8wAH5d0Kd_JLAA7NJVWMzJ3moV827TfWdQ&u=%7CjtkNbjzAHvkXI7EFplf4KgdxOu2e6rTR7NxMS3o46Gc%3D%7C&c1=TEbw32HdmhkgeNeeAzq5Zto3zNeDvGephfTH5JL0zydALMisec7v4dU5de-TFyMyKuX9u2jeaiDTb8Ze7hyMlcGgjWJAvQUHRMLNOfpWW7_gxE1dL3ewr_o2zhkXPHjXMbIwAmx8zRtN_X8wUbq8P3pAielLDl_dXqgjC6ouDApKJ0zJkm5ujvDWPyt8533LA0Ufnh5HNVn6fDW_GBkbDkWBtoRWS_l2sn-5TpS7sTFbI_YkOY8wySRCAwQQEYzLk40pEHSe1z2_v2ePMg2fFfOUIDxGRonoEvpk4cGzvWN63hrypEBN7xiLZFAULE6RBnR-70idnFlz8wrM5ESZcnLHcs_6LXKggXlmnax7_2-6Oq4z7U4XUee5zjpRBLn30wAFg07GPI4SPp08yFBrU7qEovLurzDY0aVEprudsWYfwX2VcjCLSmLUXyW5VIzXWSTAz46f_W6dpJryFwZtE5neWSakTh9yfBUJf25zxg374xVDhmgTe46Ie5Ej6uRb&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPqFy8wxwYd3LH8vk3wOlmrv4Dcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNDc5MzIwOTMzNTgzMzg2MKAB1bbS6gPIAQmpAqKX4E3MhrM-qAMBqgS2AU_Q0SXEqe2tcNJMbyHDTkPnkcxj8ToFtymGvemNjYUUn2UE2vbVzGkmSyZG4HDtOS8T2fBmV-tqvkgTNcd3m91KAd54ulW2VHng1aPxXSmifFmad7i1rfQq5NV14owj5uurd9jUHGn_Wv8P1YmofzlDWWo0DU-LiyQa1o4_PKluAEk_Om74o2Ijc387A3IEOPlHlW9eIAMG5Clo43gUa1lFCbH-24kc557bMUjrIGHJod9Vi2dTgAbUoIrLpJuoo2ygBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0BBcd5oEChYOu3-At_vGTJfTTPMQ%26client%3Dca-pub-4793209335833860%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
pix.am5.vip.prod.criteo.com
Software
Finatra /
Resource Hash
083de68ee64611b01365cccdcd48ad90da316f29cf896cad50d5d4235dd1bf41

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:34:59 GMT
last-modified
Wed, 4 Jun 2008 06:06:06 GMT
server
Finatra
vary
Origin
content-type
image/webp
cache-control
public, max-age=2506
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
1492
expires
Wed, 20 Oct 2021 13:16:47 GMT
img
pix.eu.criteo.net/img/ Frame C56E 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2F8%2FlogoMarien-Service-GmbH-264661DE-2105121225.gif%3Feb%3D1&v=3&w=400&s=zNBzpbsxtZrSY9lgScCFKEQV&b=400
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXAM8wAH5d0Kd_JLAA7NJVWMzJ3moV827TfWdQ&u=%7CjtkNbjzAHvkXI7EFplf4KgdxOu2e6rTR7NxMS3o46Gc%3D%7C&c1=TEbw32HdmhkgeNeeAzq5Zto3zNeDvGephfTH5JL0zydALMisec7v4dU5de-TFyMyKuX9u2jeaiDTb8Ze7hyMlcGgjWJAvQUHRMLNOfpWW7_gxE1dL3ewr_o2zhkXPHjXMbIwAmx8zRtN_X8wUbq8P3pAielLDl_dXqgjC6ouDApKJ0zJkm5ujvDWPyt8533LA0Ufnh5HNVn6fDW_GBkbDkWBtoRWS_l2sn-5TpS7sTFbI_YkOY8wySRCAwQQEYzLk40pEHSe1z2_v2ePMg2fFfOUIDxGRonoEvpk4cGzvWN63hrypEBN7xiLZFAULE6RBnR-70idnFlz8wrM5ESZcnLHcs_6LXKggXlmnax7_2-6Oq4z7U4XUee5zjpRBLn30wAFg07GPI4SPp08yFBrU7qEovLurzDY0aVEprudsWYfwX2VcjCLSmLUXyW5VIzXWSTAz46f_W6dpJryFwZtE5neWSakTh9yfBUJf25zxg374xVDhmgTe46Ie5Ej6uRb&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPqFy8wxwYd3LH8vk3wOlmrv4Dcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNDc5MzIwOTMzNTgzMzg2MKAB1bbS6gPIAQmpAqKX4E3MhrM-qAMBqgS2AU_Q0SXEqe2tcNJMbyHDTkPnkcxj8ToFtymGvemNjYUUn2UE2vbVzGkmSyZG4HDtOS8T2fBmV-tqvkgTNcd3m91KAd54ulW2VHng1aPxXSmifFmad7i1rfQq5NV14owj5uurd9jUHGn_Wv8P1YmofzlDWWo0DU-LiyQa1o4_PKluAEk_Om74o2Ijc387A3IEOPlHlW9eIAMG5Clo43gUa1lFCbH-24kc557bMUjrIGHJod9Vi2dTgAbUoIrLpJuoo2ygBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0BBcd5oEChYOu3-At_vGTJfTTPMQ%26client%3Dca-pub-4793209335833860%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
pix.am5.vip.prod.criteo.com
Software
Finatra /
Resource Hash
5ff4ea35e5a339f5113ed7107381c3749635252af1890695dd3c6d88da2e2a2f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:35:00 GMT
last-modified
Wed, 4 Jun 2008 06:06:06 GMT
server
Finatra
vary
Origin
content-type
image/webp
cache-control
public, max-age=2423407
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
1642
expires
Wed, 17 Nov 2021 13:45:07 GMT
img
pix.eu.criteo.net/img/ Frame C56E 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FF%2FlogoFinanz_Informatik_Solutions_Plus_GmbH____84566DE.gif%3Feb%3D1&v=3&w=400&s=w5A47AzlFkpLFPPpankpskLd&b=400
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXAM8wAH5d0Kd_JLAA7NJVWMzJ3moV827TfWdQ&u=%7CjtkNbjzAHvkXI7EFplf4KgdxOu2e6rTR7NxMS3o46Gc%3D%7C&c1=TEbw32HdmhkgeNeeAzq5Zto3zNeDvGephfTH5JL0zydALMisec7v4dU5de-TFyMyKuX9u2jeaiDTb8Ze7hyMlcGgjWJAvQUHRMLNOfpWW7_gxE1dL3ewr_o2zhkXPHjXMbIwAmx8zRtN_X8wUbq8P3pAielLDl_dXqgjC6ouDApKJ0zJkm5ujvDWPyt8533LA0Ufnh5HNVn6fDW_GBkbDkWBtoRWS_l2sn-5TpS7sTFbI_YkOY8wySRCAwQQEYzLk40pEHSe1z2_v2ePMg2fFfOUIDxGRonoEvpk4cGzvWN63hrypEBN7xiLZFAULE6RBnR-70idnFlz8wrM5ESZcnLHcs_6LXKggXlmnax7_2-6Oq4z7U4XUee5zjpRBLn30wAFg07GPI4SPp08yFBrU7qEovLurzDY0aVEprudsWYfwX2VcjCLSmLUXyW5VIzXWSTAz46f_W6dpJryFwZtE5neWSakTh9yfBUJf25zxg374xVDhmgTe46Ie5Ej6uRb&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPqFy8wxwYd3LH8vk3wOlmrv4Dcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNDc5MzIwOTMzNTgzMzg2MKAB1bbS6gPIAQmpAqKX4E3MhrM-qAMBqgS2AU_Q0SXEqe2tcNJMbyHDTkPnkcxj8ToFtymGvemNjYUUn2UE2vbVzGkmSyZG4HDtOS8T2fBmV-tqvkgTNcd3m91KAd54ulW2VHng1aPxXSmifFmad7i1rfQq5NV14owj5uurd9jUHGn_Wv8P1YmofzlDWWo0DU-LiyQa1o4_PKluAEk_Om74o2Ijc387A3IEOPlHlW9eIAMG5Clo43gUa1lFCbH-24kc557bMUjrIGHJod9Vi2dTgAbUoIrLpJuoo2ygBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0BBcd5oEChYOu3-At_vGTJfTTPMQ%26client%3Dca-pub-4793209335833860%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
pix.am5.vip.prod.criteo.com
Software
Finatra /
Resource Hash
39826435f54a24b28f021517c3b07707a7afc5400660e40b7b02a0db7ac89d60

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:34:59 GMT
last-modified
Wed, 4 Jun 2008 06:06:06 GMT
server
Finatra
vary
Origin
content-type
image/webp
cache-control
public, max-age=2499497
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
2066
expires
Thu, 18 Nov 2021 10:53:17 GMT
img
pix.eu.criteo.net/img/ Frame C56E 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FT%2FlogoToray-Resins-Europe-GmbH-176013DE.gif%3Feb%3D1&v=3&w=400&s=TP5n1ZPh4UvZypNd7K6GxOZ9&b=400
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXAM8wAH5d0Kd_JLAA7NJVWMzJ3moV827TfWdQ&u=%7CjtkNbjzAHvkXI7EFplf4KgdxOu2e6rTR7NxMS3o46Gc%3D%7C&c1=TEbw32HdmhkgeNeeAzq5Zto3zNeDvGephfTH5JL0zydALMisec7v4dU5de-TFyMyKuX9u2jeaiDTb8Ze7hyMlcGgjWJAvQUHRMLNOfpWW7_gxE1dL3ewr_o2zhkXPHjXMbIwAmx8zRtN_X8wUbq8P3pAielLDl_dXqgjC6ouDApKJ0zJkm5ujvDWPyt8533LA0Ufnh5HNVn6fDW_GBkbDkWBtoRWS_l2sn-5TpS7sTFbI_YkOY8wySRCAwQQEYzLk40pEHSe1z2_v2ePMg2fFfOUIDxGRonoEvpk4cGzvWN63hrypEBN7xiLZFAULE6RBnR-70idnFlz8wrM5ESZcnLHcs_6LXKggXlmnax7_2-6Oq4z7U4XUee5zjpRBLn30wAFg07GPI4SPp08yFBrU7qEovLurzDY0aVEprudsWYfwX2VcjCLSmLUXyW5VIzXWSTAz46f_W6dpJryFwZtE5neWSakTh9yfBUJf25zxg374xVDhmgTe46Ie5Ej6uRb&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPqFy8wxwYd3LH8vk3wOlmrv4Dcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNDc5MzIwOTMzNTgzMzg2MKAB1bbS6gPIAQmpAqKX4E3MhrM-qAMBqgS2AU_Q0SXEqe2tcNJMbyHDTkPnkcxj8ToFtymGvemNjYUUn2UE2vbVzGkmSyZG4HDtOS8T2fBmV-tqvkgTNcd3m91KAd54ulW2VHng1aPxXSmifFmad7i1rfQq5NV14owj5uurd9jUHGn_Wv8P1YmofzlDWWo0DU-LiyQa1o4_PKluAEk_Om74o2Ijc387A3IEOPlHlW9eIAMG5Clo43gUa1lFCbH-24kc557bMUjrIGHJod9Vi2dTgAbUoIrLpJuoo2ygBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0BBcd5oEChYOu3-At_vGTJfTTPMQ%26client%3Dca-pub-4793209335833860%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
pix.am5.vip.prod.criteo.com
Software
Finatra /
Resource Hash
bd885d2a8260008fc42a69102c6860d689d47387adbd60a552181f658234b9cd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:35:00 GMT
last-modified
Wed, 4 Jun 2008 06:06:06 GMT
server
Finatra
vary
Origin
content-type
image/webp
cache-control
public, max-age=1972273
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
2122
expires
Fri, 12 Nov 2021 08:26:13 GMT
img
pix.eu.criteo.net/img/ Frame C56E 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FB%2FlogoJust-Spices-GmbH-164641DE-2011111011.gif%3Feb%3D1&v=3&w=400&s=6ZjzLLyqHqmqSFW_dCABjkAD&b=400
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXAM8wAH5d0Kd_JLAA7NJVWMzJ3moV827TfWdQ&u=%7CjtkNbjzAHvkXI7EFplf4KgdxOu2e6rTR7NxMS3o46Gc%3D%7C&c1=TEbw32HdmhkgeNeeAzq5Zto3zNeDvGephfTH5JL0zydALMisec7v4dU5de-TFyMyKuX9u2jeaiDTb8Ze7hyMlcGgjWJAvQUHRMLNOfpWW7_gxE1dL3ewr_o2zhkXPHjXMbIwAmx8zRtN_X8wUbq8P3pAielLDl_dXqgjC6ouDApKJ0zJkm5ujvDWPyt8533LA0Ufnh5HNVn6fDW_GBkbDkWBtoRWS_l2sn-5TpS7sTFbI_YkOY8wySRCAwQQEYzLk40pEHSe1z2_v2ePMg2fFfOUIDxGRonoEvpk4cGzvWN63hrypEBN7xiLZFAULE6RBnR-70idnFlz8wrM5ESZcnLHcs_6LXKggXlmnax7_2-6Oq4z7U4XUee5zjpRBLn30wAFg07GPI4SPp08yFBrU7qEovLurzDY0aVEprudsWYfwX2VcjCLSmLUXyW5VIzXWSTAz46f_W6dpJryFwZtE5neWSakTh9yfBUJf25zxg374xVDhmgTe46Ie5Ej6uRb&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPqFy8wxwYd3LH8vk3wOlmrv4Dcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNDc5MzIwOTMzNTgzMzg2MKAB1bbS6gPIAQmpAqKX4E3MhrM-qAMBqgS2AU_Q0SXEqe2tcNJMbyHDTkPnkcxj8ToFtymGvemNjYUUn2UE2vbVzGkmSyZG4HDtOS8T2fBmV-tqvkgTNcd3m91KAd54ulW2VHng1aPxXSmifFmad7i1rfQq5NV14owj5uurd9jUHGn_Wv8P1YmofzlDWWo0DU-LiyQa1o4_PKluAEk_Om74o2Ijc387A3IEOPlHlW9eIAMG5Clo43gUa1lFCbH-24kc557bMUjrIGHJod9Vi2dTgAbUoIrLpJuoo2ygBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0BBcd5oEChYOu3-At_vGTJfTTPMQ%26client%3Dca-pub-4793209335833860%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
pix.am5.vip.prod.criteo.com
Software
Finatra /
Resource Hash
e549f9cce9169088c8eb101243d359f327597988627c463efab310ba7fef0388

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:34:59 GMT
last-modified
Wed, 4 Jun 2008 06:06:06 GMT
server
Finatra
vary
Origin
content-type
image/png
cache-control
public, max-age=55034
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
2280
expires
Thu, 21 Oct 2021 03:52:15 GMT
img
pix.eu.criteo.net/img/ Frame C56E 		507 B
741 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FD%2FlogoDB_Mobility_Logistics_AG_60544DE.gif%3Feb%3D1&v=3&w=400&s=qejL_9Irgvb-0KwTC4SpoEgt&b=400
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXAM8wAH5d0Kd_JLAA7NJVWMzJ3moV827TfWdQ&u=%7CjtkNbjzAHvkXI7EFplf4KgdxOu2e6rTR7NxMS3o46Gc%3D%7C&c1=TEbw32HdmhkgeNeeAzq5Zto3zNeDvGephfTH5JL0zydALMisec7v4dU5de-TFyMyKuX9u2jeaiDTb8Ze7hyMlcGgjWJAvQUHRMLNOfpWW7_gxE1dL3ewr_o2zhkXPHjXMbIwAmx8zRtN_X8wUbq8P3pAielLDl_dXqgjC6ouDApKJ0zJkm5ujvDWPyt8533LA0Ufnh5HNVn6fDW_GBkbDkWBtoRWS_l2sn-5TpS7sTFbI_YkOY8wySRCAwQQEYzLk40pEHSe1z2_v2ePMg2fFfOUIDxGRonoEvpk4cGzvWN63hrypEBN7xiLZFAULE6RBnR-70idnFlz8wrM5ESZcnLHcs_6LXKggXlmnax7_2-6Oq4z7U4XUee5zjpRBLn30wAFg07GPI4SPp08yFBrU7qEovLurzDY0aVEprudsWYfwX2VcjCLSmLUXyW5VIzXWSTAz46f_W6dpJryFwZtE5neWSakTh9yfBUJf25zxg374xVDhmgTe46Ie5Ej6uRb&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPqFy8wxwYd3LH8vk3wOlmrv4Dcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNDc5MzIwOTMzNTgzMzg2MKAB1bbS6gPIAQmpAqKX4E3MhrM-qAMBqgS2AU_Q0SXEqe2tcNJMbyHDTkPnkcxj8ToFtymGvemNjYUUn2UE2vbVzGkmSyZG4HDtOS8T2fBmV-tqvkgTNcd3m91KAd54ulW2VHng1aPxXSmifFmad7i1rfQq5NV14owj5uurd9jUHGn_Wv8P1YmofzlDWWo0DU-LiyQa1o4_PKluAEk_Om74o2Ijc387A3IEOPlHlW9eIAMG5Clo43gUa1lFCbH-24kc557bMUjrIGHJod9Vi2dTgAbUoIrLpJuoo2ygBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0BBcd5oEChYOu3-At_vGTJfTTPMQ%26client%3Dca-pub-4793209335833860%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
pix.am5.vip.prod.criteo.com
Software
Finatra /
Resource Hash
a3d7dfa849b8539970bb742e68fa6c8460185f28380960d8e27a0d822cdd2871

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:34:59 GMT
last-modified
Wed, 4 Jun 2008 06:06:06 GMT
server
Finatra
vary
Origin
content-type
image/png
cache-control
public, max-age=461122
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
507
expires
Mon, 25 Oct 2021 20:40:23 GMT
img
pix.eu.criteo.net/img/ Frame C56E 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2F3%2FlogoStepStone-GmbH-148733DE.gif%3Feb%3D1&v=3&w=400&s=wSPXg05NAm7YwFBXI_4Y57ix&b=400
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXAM8wAH5d0Kd_JLAA7NJVWMzJ3moV827TfWdQ&u=%7CjtkNbjzAHvkXI7EFplf4KgdxOu2e6rTR7NxMS3o46Gc%3D%7C&c1=TEbw32HdmhkgeNeeAzq5Zto3zNeDvGephfTH5JL0zydALMisec7v4dU5de-TFyMyKuX9u2jeaiDTb8Ze7hyMlcGgjWJAvQUHRMLNOfpWW7_gxE1dL3ewr_o2zhkXPHjXMbIwAmx8zRtN_X8wUbq8P3pAielLDl_dXqgjC6ouDApKJ0zJkm5ujvDWPyt8533LA0Ufnh5HNVn6fDW_GBkbDkWBtoRWS_l2sn-5TpS7sTFbI_YkOY8wySRCAwQQEYzLk40pEHSe1z2_v2ePMg2fFfOUIDxGRonoEvpk4cGzvWN63hrypEBN7xiLZFAULE6RBnR-70idnFlz8wrM5ESZcnLHcs_6LXKggXlmnax7_2-6Oq4z7U4XUee5zjpRBLn30wAFg07GPI4SPp08yFBrU7qEovLurzDY0aVEprudsWYfwX2VcjCLSmLUXyW5VIzXWSTAz46f_W6dpJryFwZtE5neWSakTh9yfBUJf25zxg374xVDhmgTe46Ie5Ej6uRb&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPqFy8wxwYd3LH8vk3wOlmrv4Dcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNDc5MzIwOTMzNTgzMzg2MKAB1bbS6gPIAQmpAqKX4E3MhrM-qAMBqgS2AU_Q0SXEqe2tcNJMbyHDTkPnkcxj8ToFtymGvemNjYUUn2UE2vbVzGkmSyZG4HDtOS8T2fBmV-tqvkgTNcd3m91KAd54ulW2VHng1aPxXSmifFmad7i1rfQq5NV14owj5uurd9jUHGn_Wv8P1YmofzlDWWo0DU-LiyQa1o4_PKluAEk_Om74o2Ijc387A3IEOPlHlW9eIAMG5Clo43gUa1lFCbH-24kc557bMUjrIGHJod9Vi2dTgAbUoIrLpJuoo2ygBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0BBcd5oEChYOu3-At_vGTJfTTPMQ%26client%3Dca-pub-4793209335833860%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
pix.am5.vip.prod.criteo.com
Software
Finatra /
Resource Hash
b733e3553987d967191eeec093811223193ad600018893ac3776c3c9db0fd979

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:35:00 GMT
last-modified
Wed, 4 Jun 2008 06:06:06 GMT
server
Finatra
vary
Origin
content-type
image/webp
cache-control
public, max-age=2413754
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
1776
expires
Wed, 17 Nov 2021 11:04:15 GMT
img
pix.eu.criteo.net/img/ Frame C56E 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FJ%2FlogoJS_Deutschland_GmbH_24984DE.gif%3Feb%3D1&v=3&w=400&s=t5TW_8UYa2eFuuuPo_Q7nmQe&b=400
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXAM8wAH5d0Kd_JLAA7NJVWMzJ3moV827TfWdQ&u=%7CjtkNbjzAHvkXI7EFplf4KgdxOu2e6rTR7NxMS3o46Gc%3D%7C&c1=TEbw32HdmhkgeNeeAzq5Zto3zNeDvGephfTH5JL0zydALMisec7v4dU5de-TFyMyKuX9u2jeaiDTb8Ze7hyMlcGgjWJAvQUHRMLNOfpWW7_gxE1dL3ewr_o2zhkXPHjXMbIwAmx8zRtN_X8wUbq8P3pAielLDl_dXqgjC6ouDApKJ0zJkm5ujvDWPyt8533LA0Ufnh5HNVn6fDW_GBkbDkWBtoRWS_l2sn-5TpS7sTFbI_YkOY8wySRCAwQQEYzLk40pEHSe1z2_v2ePMg2fFfOUIDxGRonoEvpk4cGzvWN63hrypEBN7xiLZFAULE6RBnR-70idnFlz8wrM5ESZcnLHcs_6LXKggXlmnax7_2-6Oq4z7U4XUee5zjpRBLn30wAFg07GPI4SPp08yFBrU7qEovLurzDY0aVEprudsWYfwX2VcjCLSmLUXyW5VIzXWSTAz46f_W6dpJryFwZtE5neWSakTh9yfBUJf25zxg374xVDhmgTe46Ie5Ej6uRb&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPqFy8wxwYd3LH8vk3wOlmrv4Dcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNDc5MzIwOTMzNTgzMzg2MKAB1bbS6gPIAQmpAqKX4E3MhrM-qAMBqgS2AU_Q0SXEqe2tcNJMbyHDTkPnkcxj8ToFtymGvemNjYUUn2UE2vbVzGkmSyZG4HDtOS8T2fBmV-tqvkgTNcd3m91KAd54ulW2VHng1aPxXSmifFmad7i1rfQq5NV14owj5uurd9jUHGn_Wv8P1YmofzlDWWo0DU-LiyQa1o4_PKluAEk_Om74o2Ijc387A3IEOPlHlW9eIAMG5Clo43gUa1lFCbH-24kc557bMUjrIGHJod9Vi2dTgAbUoIrLpJuoo2ygBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0BBcd5oEChYOu3-At_vGTJfTTPMQ%26client%3Dca-pub-4793209335833860%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
pix.am5.vip.prod.criteo.com
Software
Finatra /
Resource Hash
58ca6dbc3cc6c1a971b9d7bdd35702f7768cb4dbdd872a8c5181aaa2cf2d0383

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:35:00 GMT
last-modified
Wed, 4 Jun 2008 06:06:06 GMT
server
Finatra
vary
Origin
content-type
image/webp
cache-control
public, max-age=2320850
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
1100
expires
Tue, 16 Nov 2021 09:15:50 GMT
img
pix.eu.criteo.net/img/ Frame C56E 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2F8%2FlogoSDB-Soziale-Dienstleistungen-Becker-GmbH-273620DE-2108191329.gif%3Feb%3D1&v=3&w=400&s=upRUNzVVRayGi0qQ1kvGPPmM&b=400
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXAM8wAH5d0Kd_JLAA7NJVWMzJ3moV827TfWdQ&u=%7CjtkNbjzAHvkXI7EFplf4KgdxOu2e6rTR7NxMS3o46Gc%3D%7C&c1=TEbw32HdmhkgeNeeAzq5Zto3zNeDvGephfTH5JL0zydALMisec7v4dU5de-TFyMyKuX9u2jeaiDTb8Ze7hyMlcGgjWJAvQUHRMLNOfpWW7_gxE1dL3ewr_o2zhkXPHjXMbIwAmx8zRtN_X8wUbq8P3pAielLDl_dXqgjC6ouDApKJ0zJkm5ujvDWPyt8533LA0Ufnh5HNVn6fDW_GBkbDkWBtoRWS_l2sn-5TpS7sTFbI_YkOY8wySRCAwQQEYzLk40pEHSe1z2_v2ePMg2fFfOUIDxGRonoEvpk4cGzvWN63hrypEBN7xiLZFAULE6RBnR-70idnFlz8wrM5ESZcnLHcs_6LXKggXlmnax7_2-6Oq4z7U4XUee5zjpRBLn30wAFg07GPI4SPp08yFBrU7qEovLurzDY0aVEprudsWYfwX2VcjCLSmLUXyW5VIzXWSTAz46f_W6dpJryFwZtE5neWSakTh9yfBUJf25zxg374xVDhmgTe46Ie5Ej6uRb&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPqFy8wxwYd3LH8vk3wOlmrv4Dcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNDc5MzIwOTMzNTgzMzg2MKAB1bbS6gPIAQmpAqKX4E3MhrM-qAMBqgS2AU_Q0SXEqe2tcNJMbyHDTkPnkcxj8ToFtymGvemNjYUUn2UE2vbVzGkmSyZG4HDtOS8T2fBmV-tqvkgTNcd3m91KAd54ulW2VHng1aPxXSmifFmad7i1rfQq5NV14owj5uurd9jUHGn_Wv8P1YmofzlDWWo0DU-LiyQa1o4_PKluAEk_Om74o2Ijc387A3IEOPlHlW9eIAMG5Clo43gUa1lFCbH-24kc557bMUjrIGHJod9Vi2dTgAbUoIrLpJuoo2ygBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0BBcd5oEChYOu3-At_vGTJfTTPMQ%26client%3Dca-pub-4793209335833860%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
pix.am5.vip.prod.criteo.com
Software
Finatra /
Resource Hash
7056276556bbb443bd7021730cc6053d7969fa69860c6d221e5eab1b4c78cd42

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:35:00 GMT
last-modified
Wed, 4 Jun 2008 06:06:06 GMT
server
Finatra
vary
Origin
content-type
image/png
cache-control
public, max-age=274672
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
8763
expires
Sat, 23 Oct 2021 16:52:52 GMT
img
pix.eu.criteo.net/img/ Frame C56E 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2F3%2FlogoLBS-Landesbausparkasse-Sudwest-276669DE-2109071104.gif%3Feb%3D1&v=3&w=400&s=92NWuTiPa4tlw03anIFFKZBU&b=400
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXAM8wAH5d0Kd_JLAA7NJVWMzJ3moV827TfWdQ&u=%7CjtkNbjzAHvkXI7EFplf4KgdxOu2e6rTR7NxMS3o46Gc%3D%7C&c1=TEbw32HdmhkgeNeeAzq5Zto3zNeDvGephfTH5JL0zydALMisec7v4dU5de-TFyMyKuX9u2jeaiDTb8Ze7hyMlcGgjWJAvQUHRMLNOfpWW7_gxE1dL3ewr_o2zhkXPHjXMbIwAmx8zRtN_X8wUbq8P3pAielLDl_dXqgjC6ouDApKJ0zJkm5ujvDWPyt8533LA0Ufnh5HNVn6fDW_GBkbDkWBtoRWS_l2sn-5TpS7sTFbI_YkOY8wySRCAwQQEYzLk40pEHSe1z2_v2ePMg2fFfOUIDxGRonoEvpk4cGzvWN63hrypEBN7xiLZFAULE6RBnR-70idnFlz8wrM5ESZcnLHcs_6LXKggXlmnax7_2-6Oq4z7U4XUee5zjpRBLn30wAFg07GPI4SPp08yFBrU7qEovLurzDY0aVEprudsWYfwX2VcjCLSmLUXyW5VIzXWSTAz46f_W6dpJryFwZtE5neWSakTh9yfBUJf25zxg374xVDhmgTe46Ie5Ej6uRb&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPqFy8wxwYd3LH8vk3wOlmrv4Dcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNDc5MzIwOTMzNTgzMzg2MKAB1bbS6gPIAQmpAqKX4E3MhrM-qAMBqgS2AU_Q0SXEqe2tcNJMbyHDTkPnkcxj8ToFtymGvemNjYUUn2UE2vbVzGkmSyZG4HDtOS8T2fBmV-tqvkgTNcd3m91KAd54ulW2VHng1aPxXSmifFmad7i1rfQq5NV14owj5uurd9jUHGn_Wv8P1YmofzlDWWo0DU-LiyQa1o4_PKluAEk_Om74o2Ijc387A3IEOPlHlW9eIAMG5Clo43gUa1lFCbH-24kc557bMUjrIGHJod9Vi2dTgAbUoIrLpJuoo2ygBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0BBcd5oEChYOu3-At_vGTJfTTPMQ%26client%3Dca-pub-4793209335833860%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
pix.am5.vip.prod.criteo.com
Software
Finatra /
Resource Hash
f0c2342cc334224b345d3e7322b0738573fa83ed6efec0502def76386838db07

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:35:00 GMT
last-modified
Wed, 4 Jun 2008 06:06:06 GMT
server
Finatra
vary
Origin
content-type
image/webp
cache-control
public, max-age=31104000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
1862
expires
Sat, 15 Oct 2022 12:35:00 GMT
all
csm.eu.criteo.net/ Frame C56E 		0
99 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://csm.eu.criteo.net/all?cppv=3&cpp=A-Ub2JMlMHqFV0ggjEUVTcbks15IZHJXMfO-TDZn7y7q44a8LzXxMRaWTBuQVYHJNV84OatFkGCsEyHHZE-Ovm2G7f1lLcoDEg3US0vO5bhc3EU4hXAGM8xw2HR8gYZRhyrfuWz3Hk0wRDMOyoAiasGxv7Ec_yA0sUCBLEZH7_ELpm6zJH-iZGmlHnezbmQuU6rfybWyzsVk7K48BUGl8e-A2mqLr8iFVhCMPCN2EH6nCTy0pTI6CLgeWI1kk404eo0Lng&sds=2&rev=79130.1&sendBeacon=true
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXAM8wAH5d0Kd_JLAA7NJVWMzJ3moV827TfWdQ&u=%7CjtkNbjzAHvkXI7EFplf4KgdxOu2e6rTR7NxMS3o46Gc%3D%7C&c1=TEbw32HdmhkgeNeeAzq5Zto3zNeDvGephfTH5JL0zydALMisec7v4dU5de-TFyMyKuX9u2jeaiDTb8Ze7hyMlcGgjWJAvQUHRMLNOfpWW7_gxE1dL3ewr_o2zhkXPHjXMbIwAmx8zRtN_X8wUbq8P3pAielLDl_dXqgjC6ouDApKJ0zJkm5ujvDWPyt8533LA0Ufnh5HNVn6fDW_GBkbDkWBtoRWS_l2sn-5TpS7sTFbI_YkOY8wySRCAwQQEYzLk40pEHSe1z2_v2ePMg2fFfOUIDxGRonoEvpk4cGzvWN63hrypEBN7xiLZFAULE6RBnR-70idnFlz8wrM5ESZcnLHcs_6LXKggXlmnax7_2-6Oq4z7U4XUee5zjpRBLn30wAFg07GPI4SPp08yFBrU7qEovLurzDY0aVEprudsWYfwX2VcjCLSmLUXyW5VIzXWSTAz46f_W6dpJryFwZtE5neWSakTh9yfBUJf25zxg374xVDhmgTe46Ie5Ej6uRb&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPqFy8wxwYd3LH8vk3wOlmrv4Dcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNDc5MzIwOTMzNTgzMzg2MKAB1bbS6gPIAQmpAqKX4E3MhrM-qAMBqgS2AU_Q0SXEqe2tcNJMbyHDTkPnkcxj8ToFtymGvemNjYUUn2UE2vbVzGkmSyZG4HDtOS8T2fBmV-tqvkgTNcd3m91KAd54ulW2VHng1aPxXSmifFmad7i1rfQq5NV14owj5uurd9jUHGn_Wv8P1YmofzlDWWo0DU-LiyQa1o4_PKluAEk_Om74o2Ijc387A3IEOPlHlW9eIAMG5Clo43gUa1lFCbH-24kc557bMUjrIGHJod9Vi2dTgAbUoIrLpJuoo2ygBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0BBcd5oEChYOu3-At_vGTJfTTPMQ%26client%3Dca-pub-4793209335833860%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.150 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Finatra /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.eu.criteo.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
*
date
Wed, 20 Oct 2021 12:34:59 GMT
cross-origin-resource-policy
cross-origin
server
Finatra
content-length
0
criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame C56E 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.criteo.net/flash/icon/criteo_logo_2021.svg
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXAM8wAH5d0Kd_JLAA7NJVWMzJ3moV827TfWdQ&u=%7CjtkNbjzAHvkXI7EFplf4KgdxOu2e6rTR7NxMS3o46Gc%3D%7C&c1=TEbw32HdmhkgeNeeAzq5Zto3zNeDvGephfTH5JL0zydALMisec7v4dU5de-TFyMyKuX9u2jeaiDTb8Ze7hyMlcGgjWJAvQUHRMLNOfpWW7_gxE1dL3ewr_o2zhkXPHjXMbIwAmx8zRtN_X8wUbq8P3pAielLDl_dXqgjC6ouDApKJ0zJkm5ujvDWPyt8533LA0Ufnh5HNVn6fDW_GBkbDkWBtoRWS_l2sn-5TpS7sTFbI_YkOY8wySRCAwQQEYzLk40pEHSe1z2_v2ePMg2fFfOUIDxGRonoEvpk4cGzvWN63hrypEBN7xiLZFAULE6RBnR-70idnFlz8wrM5ESZcnLHcs_6LXKggXlmnax7_2-6Oq4z7U4XUee5zjpRBLn30wAFg07GPI4SPp08yFBrU7qEovLurzDY0aVEprudsWYfwX2VcjCLSmLUXyW5VIzXWSTAz46f_W6dpJryFwZtE5neWSakTh9yfBUJf25zxg374xVDhmgTe46Ie5Ej6uRb&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPqFy8wxwYd3LH8vk3wOlmrv4Dcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNDc5MzIwOTMzNTgzMzg2MKAB1bbS6gPIAQmpAqKX4E3MhrM-qAMBqgS2AU_Q0SXEqe2tcNJMbyHDTkPnkcxj8ToFtymGvemNjYUUn2UE2vbVzGkmSyZG4HDtOS8T2fBmV-tqvkgTNcd3m91KAd54ulW2VHng1aPxXSmifFmad7i1rfQq5NV14owj5uurd9jUHGn_Wv8P1YmofzlDWWo0DU-LiyQa1o4_PKluAEk_Om74o2Ijc387A3IEOPlHlW9eIAMG5Clo43gUa1lFCbH-24kc557bMUjrIGHJod9Vi2dTgAbUoIrLpJuoo2ygBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0BBcd5oEChYOu3-At_vGTJfTTPMQ%26client%3Dca-pub-4793209335833860%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:35:00 GMT
content-encoding
gzip
last-modified
Thu, 27 May 2021 13:21:59 GMT
server
nginx
cross-origin-embedder-policy
require-corp
etag
W/"60af9cf7-891"
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Sat, 15 Oct 2022 12:35:00 GMT
privacy.svg
static.criteo.net/flash/icon/ Frame C56E 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.criteo.net/flash/icon/privacy.svg
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXAM8wAH5d0Kd_JLAA7NJVWMzJ3moV827TfWdQ&u=%7CjtkNbjzAHvkXI7EFplf4KgdxOu2e6rTR7NxMS3o46Gc%3D%7C&c1=TEbw32HdmhkgeNeeAzq5Zto3zNeDvGephfTH5JL0zydALMisec7v4dU5de-TFyMyKuX9u2jeaiDTb8Ze7hyMlcGgjWJAvQUHRMLNOfpWW7_gxE1dL3ewr_o2zhkXPHjXMbIwAmx8zRtN_X8wUbq8P3pAielLDl_dXqgjC6ouDApKJ0zJkm5ujvDWPyt8533LA0Ufnh5HNVn6fDW_GBkbDkWBtoRWS_l2sn-5TpS7sTFbI_YkOY8wySRCAwQQEYzLk40pEHSe1z2_v2ePMg2fFfOUIDxGRonoEvpk4cGzvWN63hrypEBN7xiLZFAULE6RBnR-70idnFlz8wrM5ESZcnLHcs_6LXKggXlmnax7_2-6Oq4z7U4XUee5zjpRBLn30wAFg07GPI4SPp08yFBrU7qEovLurzDY0aVEprudsWYfwX2VcjCLSmLUXyW5VIzXWSTAz46f_W6dpJryFwZtE5neWSakTh9yfBUJf25zxg374xVDhmgTe46Ie5Ej6uRb&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPqFy8wxwYd3LH8vk3wOlmrv4Dcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNDc5MzIwOTMzNTgzMzg2MKAB1bbS6gPIAQmpAqKX4E3MhrM-qAMBqgS2AU_Q0SXEqe2tcNJMbyHDTkPnkcxj8ToFtymGvemNjYUUn2UE2vbVzGkmSyZG4HDtOS8T2fBmV-tqvkgTNcd3m91KAd54ulW2VHng1aPxXSmifFmad7i1rfQq5NV14owj5uurd9jUHGn_Wv8P1YmofzlDWWo0DU-LiyQa1o4_PKluAEk_Om74o2Ijc387A3IEOPlHlW9eIAMG5Clo43gUa1lFCbH-24kc557bMUjrIGHJod9Vi2dTgAbUoIrLpJuoo2ygBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0BBcd5oEChYOu3-At_vGTJfTTPMQ%26client%3Dca-pub-4793209335833860%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:35:00 GMT
content-encoding
gzip
last-modified
Wed, 19 Feb 2020 10:57:21 GMT
server
nginx
cross-origin-embedder-policy
require-corp
etag
W/"5e4d1491-646"
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Sat, 15 Oct 2022 12:35:00 GMT
integrator.js
adservice.google.de/adsid/ 		107 B
165 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=xurl.es
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4793209335833860&plah=xurl.es
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 20 Oct 2021 12:35:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		107 B
165 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=xurl.es
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4793209335833860&plah=xurl.es
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 20 Oct 2021 12:35:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
100
x-xss-protection
0
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20211018/r20110914/ Frame 0655 		10 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20211018/r20110914/zrt_lookup.html?fsb=1
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4793209335833860&plah=xurl.es
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1437cdd25532919299784f840c613a46dbcf783903d558bcf5386defd7cceb1c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/html/r20211018/r20110914/zrt_lookup.html?fsb=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://xurl.es/
accept-encoding
gzip, deflate, br
cookie
IDE=AHWqTUk4RxDY8d8XhCbteOyQKePxogAt07MTmpln0lIFPo8GJGaawTEjWIprb1v1e7Q; DSID=NO_DATA; test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Tue, 19 Oct 2021 14:41:42 GMT
expires
Tue, 02 Nov 2021 14:41:42 GMT
content-type
text/html; charset=UTF-8
etag
15765991816257340444
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
4703
x-xss-protection
0
age
78798
cache-control
public, max-age=1209600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20211018/r20110914/ Frame 28B6 		10 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20211018/r20110914/zrt_lookup.html?fsb=1
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4793209335833860&plah=xurl.es
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1437cdd25532919299784f840c613a46dbcf783903d558bcf5386defd7cceb1c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/html/r20211018/r20110914/zrt_lookup.html?fsb=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://xurl.es/
accept-encoding
gzip, deflate, br
cookie
IDE=AHWqTUk4RxDY8d8XhCbteOyQKePxogAt07MTmpln0lIFPo8GJGaawTEjWIprb1v1e7Q; DSID=NO_DATA; test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Tue, 19 Oct 2021 14:41:42 GMT
expires
Tue, 02 Nov 2021 14:41:42 GMT
content-type
text/html; charset=UTF-8
etag
15765991816257340444
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
4703
x-xss-protection
0
age
78798
cache-control
public, max-age=1209600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
css2
fonts.googleapis.com/ Frame 0655 		4 KB
708 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211018/r20110914/zrt_lookup.html?fsb=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
last-modified
Wed, 20 Oct 2021 11:23:54 GMT
server
ESF
date
Wed, 20 Oct 2021 12:35:00 GMT
x-frame-options
SAMEORIGIN
report-to
{"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only
same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires
Wed, 20 Oct 2021 12:35:00 GMT
feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 0655 		205 B
492 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211018/r20110914/zrt_lookup.html?fsb=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 09:19:09 GMT
x-content-type-options
nosniff
age
11751
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
205
x-xss-protection
0
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
vary
Origin
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Thu, 20 Oct 2022 09:19:09 GMT
settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 0655 		604 B
695 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211018/r20110914/zrt_lookup.html?fsb=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 06:58:49 GMT
x-content-type-options
nosniff
age
20171
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
604
x-xss-protection
0
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
vary
Origin
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Thu, 20 Oct 2022 06:58:49 GMT
interstitial_ad_frame_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211018/r20110914/elements/html/ Frame 0655 		18 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211018/r20110914/elements/html/interstitial_ad_frame_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211018/r20110914/zrt_lookup.html?fsb=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
73a87e1c0cffc78b42a822667206698e68ef4c25cd521d9082fc41ad87b14b26
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 11:59:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2147
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7871
x-xss-protection
0
server
cafe
etag
5766211372787435734
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 03 Nov 2021 11:59:13 GMT
index.html
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7991778744330195530/ Frame 5FB4 		28 KB
9 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7991778744330195530/index.html
Requested by
Host: xurl.es
URL: https://xurl.es/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3a2b5a369547c3935a351a315db91b9fcf3da7fe3173d5664a108db3de2209a6
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sadbundle/$csp%3Der3$/7991778744330195530/index.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-type
text/html
access-control-allow-origin
*
content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
timing-allow-origin
*
date
Mon, 18 Oct 2021 23:26:06 GMT
expires
Tue, 18 Oct 2022 23:26:06 GMT
last-modified
Sat, 25 Sep 2021 10:01:13 GMT
x-content-type-options
nosniff
x-dns-prefetch-control
off
content-encoding
gzip
server
sffe
x-xss-protection
0
content-length
7565
age
133734
cache-control
public, max-age=31536000
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
adview
googleads.g.doubleclick.net/pagead/ Frame 28B6 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=CZueu8wxwYbqTIKaBjuwPv_-_0AfTjvruZa2Fy-K1Drf88_0IEAEgsY-IBGCV4pCCoAegAe7eod0DyAEJqQKil-BNzIazPqgDAcgDSKoE1wFP0OBcvUsJkD8gXQlrAsVjLMoAy40DofTT9rTCOPjMFp2fzu1akW6PyJoVCW6y4OP_92o5suRcOs9VFVkVYjZKCHex-r3sV_bxz2cO4AAzdsy3i3XNoYvNtkjk7kt9-_0NX0rsFrEeUPxYkW-XbzxhM_O3DCfIAFmZAF6KajDDLU6QqCCnIVCQJWSeGBHD7ooKB8xJpvbpVDqVLkx_XdB9VIWLYfgQHs0LfxHwPPZD07XHgc79GDUOH_27-k0kZzbuWJULsKU2l1rWxd521RUiIeTXA4NqL8AE8u3Qx-YDkgUECAQYAZIFBAgFGASgBi6AB_qg3iKoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB9XJG6gHpr4b2AcA8gcEEMrfCNIICQiA4YAQEAEYX4AKAcgLAdgTDYgUAdAVAZgWAYAXAbIXHAoaCAASFHB1Yi00NzkzMjA5MzM1ODMzODYwGAA&sigh=Ra3CKAJuqv0&uach_m=[UACH]&template_id=419
Requested by
Host: xurl.es
URL: https://xurl.es/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/html/r20211018/r20110914/zrt_lookup.html?fsb=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
date
Wed, 20 Oct 2021 12:35:00 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211018/r20110914/ Frame 28B6 		18 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211018/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211018/r20110914/zrt_lookup.html?fsb=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8bfd018bb29e8c00faffeb3660e5cbcec66c0ba1dff56f8d2f9a1bcc47c11852
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:08:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1575
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7699
x-xss-protection
0
server
cafe
etag
16022440550062051545
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 03 Nov 2021 12:08:45 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211018/r20110914/client/ Frame 28B6 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211018/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211018/r20110914/zrt_lookup.html?fsb=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:09:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1517
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1426
x-xss-protection
0
server
cafe
etag
18061233391346882222
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 03 Nov 2021 12:09:43 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 28B6 		122 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211018/r20110914/zrt_lookup.html?fsb=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5ec6259ce93d1583fd116bc92baa687aacfdf415efabc596b398c1ebf27c680e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:35:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
37884
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1634556853496587"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Wed, 20 Oct 2021 12:35:00 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211018/r20110914/client/ Frame 28B6 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211018/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211018/r20110914/zrt_lookup.html?fsb=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
bf14bee270a7c9237cc9e28deb028998a04f08aa59309ce22ef92f3ba54ac03d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:31:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
203
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6290
x-xss-protection
0
server
cafe
etag
5128541104351419840
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 03 Nov 2021 12:31:37 GMT
css
fonts.googleapis.com/ Frame DFDC 		3 KB
652 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211018/r20110914/zrt_lookup.html?fsb=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
last-modified
Wed, 20 Oct 2021 11:21:22 GMT
server
ESF
date
Wed, 20 Oct 2021 12:35:00 GMT
x-frame-options
SAMEORIGIN
report-to
{"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only
same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires
Wed, 20 Oct 2021 12:35:00 GMT
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211018/r20110914/client/ Frame DFDC 		2 KB
945 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211018/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211018/r20110914/zrt_lookup.html?fsb=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1b4e852fde612daeb72f1f4cca801a99cc2730875048c5ac3faa9f5ca5854155
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:22:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
759
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
885
x-xss-protection
0
server
cafe
etag
638833322182864030
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 03 Nov 2021 12:22:21 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211018/r20110914/ Frame DFDC 		18 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211018/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211018/r20110914/zrt_lookup.html?fsb=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8bfd018bb29e8c00faffeb3660e5cbcec66c0ba1dff56f8d2f9a1bcc47c11852
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:08:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1575
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7699
x-xss-protection
0
server
cafe
etag
16022440550062051545
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 03 Nov 2021 12:08:45 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211018/r20110914/client/ Frame DFDC 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211018/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211018/r20110914/zrt_lookup.html?fsb=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:09:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1517
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1426
x-xss-protection
0
server
cafe
etag
18061233391346882222
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 03 Nov 2021 12:09:43 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame DFDC 		122 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211018/r20110914/zrt_lookup.html?fsb=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5ec6259ce93d1583fd116bc92baa687aacfdf415efabc596b398c1ebf27c680e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:35:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
37884
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1634556853496587"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Wed, 20 Oct 2021 12:35:00 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211018/r20110914/client/ Frame DFDC 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211018/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211018/r20110914/zrt_lookup.html?fsb=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
bf14bee270a7c9237cc9e28deb028998a04f08aa59309ce22ef92f3ba54ac03d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:31:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
203
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6290
x-xss-protection
0
server
cafe
etag
5128541104351419840
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 03 Nov 2021 12:31:37 GMT
94b9e9edb15b7c220f12fa63d878a5af.js
www.gstatic.com/mysidia/ Frame DFDC 		27 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/mysidia/94b9e9edb15b7c220f12fa63d878a5af.js?tag=mysidia_one_click_handler_one_afma_2019
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211018/r20110914/zrt_lookup.html?fsb=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3d1246d2fe982f57c0a911530b2fa93a679e42c0d897151f39cffa4762c55f5d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Mon, 18 Oct 2021 12:52:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
171780
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11213
x-xss-protection
0
last-modified
Tue, 12 Oct 2021 03:34:41 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="mysidia"
expires
Sun, 16 Jan 2022 12:52:00 GMT
s
googleads.g.doubleclick.net/pagead/drt/ Frame C0E4 		143 B
202 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211018/r20110914/zrt_lookup.html?fsb=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/drt/s?v=r20120211
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/pagead/html/r20211018/r20110914/zrt_lookup.html?fsb=1
accept-encoding
gzip, deflate, br
cookie
IDE=AHWqTUk4RxDY8d8XhCbteOyQKePxogAt07MTmpln0lIFPo8GJGaawTEjWIprb1v1e7Q; DSID=NO_DATA; test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/html/r20211018/r20110914/zrt_lookup.html?fsb=1

Response headers

content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Wed, 20 Oct 2021 11:54:37 GMT
server
cafe
content-length
145
x-xss-protection
0
cache-control
public, max-age=3600
age
2423
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
exitapi-impl.js
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame 5FB4 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7991778744330195530/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 19 Oct 2021 13:46:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
82097
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3271
x-xss-protection
0
server
cafe
etag
7483759447172721109
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=86400
timing-allow-origin
*
expires
Wed, 20 Oct 2021 13:46:43 GMT
addata.js
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 5FB4 		26 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7991778744330195530/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 19 Oct 2021 13:46:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
82091
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10382
x-xss-protection
0
server
cafe
etag
12806417668659483808
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=86400
timing-allow-origin
*
expires
Wed, 20 Oct 2021 13:46:49 GMT
css
fonts.googleapis.com/ Frame 5FB4 		6 KB
893 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans%7cSquada+One%7cPT+Sans+Narrow:regular,700
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7991778744330195530/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
bd56f68e764496c9355cc27296e45971f2fa6a4ba22876d95e38ee0225e279e4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
last-modified
Wed, 20 Oct 2021 12:02:19 GMT
server
ESF
date
Wed, 20 Oct 2021 12:35:00 GMT
x-frame-options
SAMEORIGIN
report-to
{"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only
same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires
Wed, 20 Oct 2021 12:35:00 GMT
image2.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7991778744330195530/ Frame 5FB4 		14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7991778744330195530/image2.jpg
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7991778744330195530/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ad561d2d406ea6c156051a3aacbea3986a1b9188575b618f1b07668cb739176b
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options
nosniff
age
133733
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13918
x-xss-protection
0
last-modified
Sat, 25 Sep 2021 10:01:13 GMT
server
sffe
date
Mon, 18 Oct 2021 23:26:07 GMT
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Tue, 18 Oct 2022 23:26:07 GMT
bg1_1.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7991778744330195530/ Frame 5FB4 		711 B
808 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7991778744330195530/bg1_1.png
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7991778744330195530/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0efd6c2e8c40af6f87f85a294cb92e40bb56c93d72356258eae5b7851063396f
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options
nosniff
age
446873
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
711
x-xss-protection
0
last-modified
Sat, 25 Sep 2021 10:01:13 GMT
server
sffe
date
Fri, 15 Oct 2021 08:27:07 GMT
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Sat, 15 Oct 2022 08:27:07 GMT
bg2_1.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7991778744330195530/ Frame 5FB4 		639 B
736 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7991778744330195530/bg2_1.png
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7991778744330195530/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
97ea5f893bccfdb7685621f8188374da40658def7bcfa1f765a492724bb12acf
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options
nosniff
age
9864
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
639
x-xss-protection
0
last-modified
Sat, 25 Sep 2021 10:01:13 GMT
server
sffe
date
Wed, 20 Oct 2021 09:50:36 GMT
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Thu, 20 Oct 2022 09:50:36 GMT
logo-de.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7991778744330195530/ Frame 5FB4 		12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7991778744330195530/logo-de.png
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7991778744330195530/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1559c220a5abcf68675dc5732aed02e625d8e4d9bd3181128e9fac89e962a0f8
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options
nosniff
age
22320
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12566
x-xss-protection
0
last-modified
Sat, 25 Sep 2021 10:01:13 GMT
server
sffe
date
Wed, 20 Oct 2021 06:23:00 GMT
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Thu, 20 Oct 2022 06:23:00 GMT
yellowbox.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7991778744330195530/ Frame 5FB4 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7991778744330195530/yellowbox.png
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7991778744330195530/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9ee29270e7cf2101f374b8f4af6a611794616f8f8be4aaad023ae991f8cf3c6f
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options
nosniff
age
39849
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3386
x-xss-protection
0
last-modified
Sat, 25 Sep 2021 10:01:13 GMT
server
sffe
date
Wed, 20 Oct 2021 01:30:51 GMT
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Thu, 20 Oct 2022 01:30:51 GMT
truncated
/ Frame 28B6 		218 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4e0e2b5db0ec9b59a6922b7454d068998f72f1e537042d79635e23f14eaa15fa

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type
image/png
BngRUXNadjH0qYEzV7ab-oWlsbCGwR0.woff2
fonts.gstatic.com/s/ptsansnarrow/v12/ Frame 5FB4 		35 KB
36 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/ptsansnarrow/v12/BngRUXNadjH0qYEzV7ab-oWlsbCGwR0.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%7cSquada+One%7cPT+Sans+Narrow:regular,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5818f55583b8a82745bf0b1d9cbc07c0411088fb5a837ff5a15b5a745ccdcd58
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
null
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Mon, 18 Oct 2021 07:15:16 GMT
x-content-type-options
nosniff
age
191984
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36268
x-xss-protection
0
last-modified
Thu, 10 Sep 2020 17:08:52 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 18 Oct 2022 07:15:16 GMT
BngSUXNadjH0qYEzV7ab-oWlsbg95AiFW_0.woff2
fonts.gstatic.com/s/ptsansnarrow/v12/ Frame 5FB4 		50 KB
50 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/ptsansnarrow/v12/BngSUXNadjH0qYEzV7ab-oWlsbg95AiFW_0.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%7cSquada+One%7cPT+Sans+Narrow:regular,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
70df9226028499e81eb4f790fda66f0ff0071b2961dcb6ec73ae88714d5f644f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
null
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sun, 17 Oct 2021 11:56:45 GMT
x-content-type-options
nosniff
age
261495
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
51128
x-xss-protection
0
last-modified
Thu, 10 Sep 2020 17:07:15 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Mon, 17 Oct 2022 11:56:45 GMT
memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
fonts.gstatic.com/s/opensans/v26/ Frame 5FB4 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v26/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%7cSquada+One%7cPT+Sans+Narrow:regular,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
53bb85849942fe0fdb6998300d0c68f1727a6f34a3bdcd9f6f8f12476f64b1e9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
null
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 14 Oct 2021 17:06:43 GMT
x-content-type-options
nosniff
age
502097
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
16736
x-xss-protection
0
last-modified
Thu, 23 Sep 2021 16:50:15 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Fri, 14 Oct 2022 17:06:43 GMT
si
googleads.g.doubleclick.net/pagead/drt/ Frame C0E4
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
225 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211018/r20110914/zrt_lookup.html?fsb=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/drt/si?st=NO_DATA
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
cookie
IDE=AHWqTUk4RxDY8d8XhCbteOyQKePxogAt07MTmpln0lIFPo8GJGaawTEjWIprb1v1e7Q; DSID=NO_DATA; test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Wed, 20 Oct 2021 12:35:00 GMT
server
cafe
content-length
0
x-xss-protection
0
set-cookie
DSID=NO_DATA; expires=Wed, 20-Oct-2021 13:35:00 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Wed, 20 Oct 2021 12:35:00 GMT
cache-control
private

Redirect headers

location
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control
private
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Wed, 20 Oct 2021 12:35:00 GMT
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
QjHKgOpm15qTJXWLxUnNMS8wTt6682k-qtw68OFTrDs.js
pagead2.googlesyndication.com/bg/ Frame 7B1E 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/QjHKgOpm15qTJXWLxUnNMS8wTt6682k-qtw68OFTrDs.js
Requested by
Host: xurl.es
URL: https://xurl.es/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4231ca80ea66d79a9325758bc549cd312f304edebaf3693eaadc3af0e153ac3b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 11:57:23 GMT
content-encoding
br
x-content-type-options
nosniff
age
2257
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13301
x-xss-protection
0
last-modified
Mon, 11 Oct 2021 11:08:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="botguard-scs"
expires
Thu, 20 Oct 2022 11:57:23 GMT
QjHKgOpm15qTJXWLxUnNMS8wTt6682k-qtw68OFTrDs.js
pagead2.googlesyndication.com/bg/ Frame 5FB4 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/QjHKgOpm15qTJXWLxUnNMS8wTt6682k-qtw68OFTrDs.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4231ca80ea66d79a9325758bc549cd312f304edebaf3693eaadc3af0e153ac3b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 11:57:23 GMT
content-encoding
br
x-content-type-options
nosniff
age
2257
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13301
x-xss-protection
0
last-modified
Mon, 11 Oct 2021 11:08:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="botguard-scs"
expires
Thu, 20 Oct 2022 11:57:23 GMT
sodar
pagead2.googlesyndication.com/getconfig/ 		11 KB
9 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20211018&st=env
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4793209335833860&plah=xurl.es
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d01bcd975f43d304c9fb4433669dcea4b325b6c8e43303f14f85d084c19317d6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 20 Oct 2021 12:35:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8504
x-xss-protection
0
sodar2.js
tpc.googlesyndication.com/sodar/ 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110130101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4793209335833860&plah=xurl.es
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 12:35:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1624308425655142"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6467
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
expires
Wed, 20 Oct 2021 12:35:01 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame F4C7 		42 B
174 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuCvtos0oIexH_5CYe6twT33K5DYsr-lE74avQ329TJAYE0IN50-yhn3KYKtB7azF5ghYYA32SW0Izgb_kHV5yc1mWIXoNVb2gJLcOcxtwPq0XuuwvB1Q&sai=AMfl-YRL-CjmVRpmHqtqUbFjpcqz9WgqwFBtN6JCQa2YC1uPkHrX3oGcNGLJDVrTqG0w6opdnXF2y5Y1skOT&sig=Cg0ArKJSzIHcp-2UYjQTEAE&id=lidar2&mcvt=1000&p=0,0,250,300&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20211018&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=4&adk=2257642287&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1634733299487&rpt=470&met=mue&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Oct 2021 12:35:00 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 8724 		42 B
108 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvO9BCGsMRqcQb4e9zlbGzl6JvVMoCUispVzT81QbfLiBFurU_6ekTpJAdzd2ud5jcmUfeN75OkG57BRBnS4s7V&sig=Cg0ArKJSzPhkQleHFTH5EAE&id=lidar2&mcvt=1000&p=0,0,90,970&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20211018&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=271488381&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1634733299493&rpt=767&met=ie&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Oct 2021 12:35:01 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame CECC 		42 B
108 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstdKV2LSV-BLnXZ-AureyRsx9P5A9yvB7eQORG-m77iKKhlHegeJdPmxwPhDrUOCCSx9Sll3HuEDJl7v3Vwb5zAz7IToQcs3zzBwQdkjHNoJr1fnmVbjA&sai=AMfl-YR3WjbaB5VsQnpomAQsEpISaOwBs1eQcDaQ6BSTiipL-EIsHSizmADJUcqagwkHpNpuX_-vwOLCJvzL&sig=Cg0ArKJSzFhuzUgbADhzEAE&id=lidar2&mcvt=1000&p=0,0,90,970&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20211018&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=271488381&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1634733299478&rpt=841&met=mue&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Oct 2021 12:35:01 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
all
csm.eu.criteo.net/ Frame C56E 		0
99 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://csm.eu.criteo.net/all?cppv=3&cpp=A-Ub2JMlMHqFV0ggjEUVTcbks15IZHJXMfO-TDZn7y7q44a8LzXxMRaWTBuQVYHJNV84OatFkGCsEyHHZE-Ovm2G7f1lLcoDEg3US0vO5bhc3EU4hXAGM8xw2HR8gYZRhyrfuWz3Hk0wRDMOyoAiasGxv7Ec_yA0sUCBLEZH7_ELpm6zJH-iZGmlHnezbmQuU6rfybWyzsVk7K48BUGl8e-A2mqLr8iFVhCMPCN2EH6nCTy0pTI6CLgeWI1kk404eo0Lng&sds=2&rev=79130.1&sendBeacon=true
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXAM8wAH5d0Kd_JLAA7NJVWMzJ3moV827TfWdQ&u=%7CjtkNbjzAHvkXI7EFplf4KgdxOu2e6rTR7NxMS3o46Gc%3D%7C&c1=TEbw32HdmhkgeNeeAzq5Zto3zNeDvGephfTH5JL0zydALMisec7v4dU5de-TFyMyKuX9u2jeaiDTb8Ze7hyMlcGgjWJAvQUHRMLNOfpWW7_gxE1dL3ewr_o2zhkXPHjXMbIwAmx8zRtN_X8wUbq8P3pAielLDl_dXqgjC6ouDApKJ0zJkm5ujvDWPyt8533LA0Ufnh5HNVn6fDW_GBkbDkWBtoRWS_l2sn-5TpS7sTFbI_YkOY8wySRCAwQQEYzLk40pEHSe1z2_v2ePMg2fFfOUIDxGRonoEvpk4cGzvWN63hrypEBN7xiLZFAULE6RBnR-70idnFlz8wrM5ESZcnLHcs_6LXKggXlmnax7_2-6Oq4z7U4XUee5zjpRBLn30wAFg07GPI4SPp08yFBrU7qEovLurzDY0aVEprudsWYfwX2VcjCLSmLUXyW5VIzXWSTAz46f_W6dpJryFwZtE5neWSakTh9yfBUJf25zxg374xVDhmgTe46Ie5Ej6uRb&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPqFy8wxwYd3LH8vk3wOlmrv4Dcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNDc5MzIwOTMzNTgzMzg2MKAB1bbS6gPIAQmpAqKX4E3MhrM-qAMBqgS2AU_Q0SXEqe2tcNJMbyHDTkPnkcxj8ToFtymGvemNjYUUn2UE2vbVzGkmSyZG4HDtOS8T2fBmV-tqvkgTNcd3m91KAd54ulW2VHng1aPxXSmifFmad7i1rfQq5NV14owj5uurd9jUHGn_Wv8P1YmofzlDWWo0DU-LiyQa1o4_PKluAEk_Om74o2Ijc387A3IEOPlHlW9eIAMG5Clo43gUa1lFCbH-24kc557bMUjrIGHJod9Vi2dTgAbUoIrLpJuoo2ygBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0BBcd5oEChYOu3-At_vGTJfTTPMQ%26client%3Dca-pub-4793209335833860%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.150 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Finatra /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.eu.criteo.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
*
date
Wed, 20 Oct 2021 12:35:01 GMT
cross-origin-resource-policy
cross-origin
server
Finatra
content-length
0
runner.html
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 7E25 		12 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/224/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://xurl.es/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length
5029
date
Wed, 20 Oct 2021 12:25:02 GMT
expires
Thu, 20 Oct 2022 12:25:02 GMT
last-modified
Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
599
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
aframe
www.google.com/recaptcha/api2/ Frame DF83 		783 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
3943f2395d1c4079d0e9587004f6f53a03a5d13470fda1bdb7bd473e44848b2f
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-wg6gJJhHpH2flGemkBLsuQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/aframe
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://xurl.es/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/

Response headers

cross-origin-resource-policy
cross-origin
cross-origin-embedder-policy-report-only
require-corp; report-to="recaptcha"
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires
Wed, 20 Oct 2021 12:35:01 GMT
date
Wed, 20 Oct 2021 12:35:01 GMT
cache-control
private, max-age=300
content-type
text/html; charset=utf-8
content-security-policy
script-src 'report-sample' 'nonce-wg6gJJhHpH2flGemkBLsuQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
512
server
GSE
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
QjHKgOpm15qTJXWLxUnNMS8wTt6682k-qtw68OFTrDs.js
pagead2.googlesyndication.com/bg/ Frame 7E25 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/QjHKgOpm15qTJXWLxUnNMS8wTt6682k-qtw68OFTrDs.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4231ca80ea66d79a9325758bc549cd312f304edebaf3693eaadc3af0e153ac3b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 11:57:23 GMT
content-encoding
br
x-content-type-options
nosniff
age
2258
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13301
x-xss-protection
0
last-modified
Mon, 11 Oct 2021 11:08:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="botguard-scs"
expires
Thu, 20 Oct 2022 11:57:23 GMT
sodar
pagead2.googlesyndication.com/pagead/ Frame DF83 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gda_r20211018&jk=2843641532580074&rc=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers
gen_204
pagead2.googlesyndication.com/pagead/ 		0
119 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gda_r20211018&jk=2843641532580074&bg=!VValVhLNAAao6lBpqOo7ACkAdvg8WpBTuyUGavnWmEunG198E9Ty7Y6ivSwXEnz_gQKet3GHnAFx2AIAAABbUgAAAAtoAQeZArCXe3iCuIKLYue_h9WIThH7ikjwh_k85PqRDiI8cB5yKGAjHGzVusiaErDO3hZwUbdQV9JSMqhiQCBZkA6e8CwIYWBM8A-2IKmVeOMJYRYlrQO5yweHQB5QWB-c96LGXsb8myoWWghEwdSkJud_NDPLh52G3Q-W_zh7YrMHt71nZy9LEt5kzO6YVTTHt4bxcP7RmGS-er2OC6cCy3qKkl1KAzjHEhVWvBJXFXDr4ZagN47ReyPQMx9kPeewkxk93lF0fINYp2YrlvDAvYnRCNmMNP6ZcAzM2RCYaugtdDgxHkTN58zCpW3rBkN44ULBPyhhb60oUFS0WRghSRb2kMivXDFhqXruzxA2wsE2s3au71RMACDqpgpWkJxnzVgNZoxBrYCKIiKzXoV-c8ZZdI_Z2bT-I64r468f8OOKodFAkvWrjpsD02mLkxtX9M4vgqwlVD8PJqi1gi7qa2wiqcuI5QdmWuCtPOHg2ir8YT3QZ7NT0HZrKVdBtCToCR4oZ2V2I_ML2LfrKF_eF2DWWk8Q57_UCLPWYt2SsDFB3uSCglp9aMh2gCsXLJbteQIBykfLjo51UJ5ggoYh6dEx7Q5XDxTSJQWQt2BCsFyQ_wq_kiAB4U-rUGbnBv4pRujlimN8dGVLl_5u35UweHIabQNL65m3HMyfuJM1JQGPpDA9SWk1b39kNroBqsCQpTvDhD0NKHw3UXcs7InNZ3xhS-nyYlPBoDZ-gn06ROb4JrXd6-PQmxioGdAnfPGxX04DWjZwENHX4Ey1jUjsIouSI751G_o_m8ndrwQhzIz0tXZN8t_gYTgNyzOgQW1Vm3xe33DyyJjkbLE5gd11FvxBuwz35t0_NVqDSv8B3jp7Xjl6sqtPO-fe6iWY10Rj9K_fFwqWR5bLYqzGp6J6XbWTv1br
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://xurl.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Oct 2021 12:35:01 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 28B6 		42 B
108 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssL2Ukw1DOII7eSIg_j8iBAUxQgdTCLDi0h3MZImoEZwemk2sG3ISidyHzjk-XfBcd62qvIGbZaINS_yTK6Itix3OWhq1FQ5jSUMxaxhI-Mj7zXVkExPQ&sai=AMfl-YT6mNyVKakxmGTNHlU8_oWpu7k34fH5GScezpjicA0CNhIUq8hEDRtw_ROfDCNnXyXttAfisOdkLUYN&sig=Cg0ArKJSzNiH4wBDWvjaEAE&id=lidar2&mcvt=1000&p=0,1,124.25,1006&mtos=0,765,1000,1122,1277&tos=0,765,235,122,155&v=20211018&bin=7&avms=nio&bs=0,0&mc=0.76&if=1&app=0&itpl=2&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1634733300506&rpt=126&met=mue&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Oct 2021 12:35:01 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

76 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| onbeforexrselect boolean| originAgentCluster object| theDate object| oneYearLater string| expiryDate function| getCookie boolean| enProceso object| http boolean| enProceso2 object| http2 boolean| enProceso3 object| http3 boolean| enProceso4 object| http4 function| AjaxObject function| hazConAjax function| recogeRespuesta function| quieroCod function| recogeCodigo function| quieroPersonal function| recogePersonal function| ultURL function| recogeUltURL function| masAjax function| recogeStats function| enfoca string| google_analytics_uacct object| adsbygoogle object| FB string| gaJsHost object| _gat object| _gaq object| pageTracker object| gaGlobal object| google_js_reporting_queue number| google_srt object| google_logging_queue object| google_ad_modifications object| ggeac boolean| google_measure_js_timing object| google_reactive_ads_global_state boolean| _gfp_a_ object| google_sa_queue object| google_sl_win function| google_process_slots boolean| google_apltlad function| google_spfd number| google_lpabyc number| google_unique_id object| google_sv_map object| google_persistent_state_async string| google_user_agent_client_hint function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter function| google_sa_impl object| googleToken object| googleIMState boolean| _gfp_p_ function| processGoogleToken number| google_global_correlator object| google_prev_clients object| ampInaboxIframes object| ampInaboxPendingMessages object| googletag object| google_llp object| GoogleGcLKhOms object| google_image_requests

8 Cookies

Domain/Path Name / Value
.xurl.es/ Name: __utma
Value: 253530880.446147574.1634733299.1634733299.1634733299.1
.xurl.es/ Name: __utmc
Value: 253530880
.xurl.es/ Name: __utmz
Value: 253530880.1634733299.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
.xurl.es/ Name: __utmt
Value: 1
.xurl.es/ Name: __utmb
Value: 253530880.1.10.1634733299
.xurl.es/ Name: __gads
Value: ID=91dddbbc6de78c02-22542f9af9ca0011:T=1634733299:RT=1634733299:S=ALNI_MaYUgBxd-pbksNbX2o0ksNOaBnWTQ
.doubleclick.net/ Name: IDE
Value: AHWqTUk4RxDY8d8XhCbteOyQKePxogAt07MTmpln0lIFPo8GJGaawTEjWIprb1v1e7Q
.doubleclick.net/ Name: DSID
Value: NO_DATA

4 Console Messages

Source Level URL
Text
javascript warning URL: https://xurl.es/(Line 200)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ssl.google-analytics.com/ga.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://xurl.es/(Line 200)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ssl.google-analytics.com/ga.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
other error URL: chrome-error://chromewebdata/
Message:
Refused to display 'https://www.facebook.com/' in a frame because it set 'X-Frame-Options' to 'deny'.
security error URL: https://googleads.g.doubleclick.net/pagead/html/r20211018/r20110914/zrt_lookup.html?fsb=1(Line 22)
Message:
The Content Security Policy 'child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7991778744330195530/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7991778744330195530/index.html' was delivered via a <meta> element outside the document's <head>, which is disallowed. The policy has been ignored.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.eu.criteo.com
adservice.google.com
adservice.google.de
cat.nl.eu.criteo.com
connect.facebook.net
csm.eu.criteo.net
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
pagead2.googlesyndication.com
partner.googleadservices.com
pix.eu.criteo.net
rtb.nl.eu.criteo.com
secure-gl.imrworldwide.com
ssl.google-analytics.com
static.criteo.net
tpc.googlesyndication.com
www.facebook.com
www.google.com
www.googletagservices.com
www.gstatic.com
www.paypalobjects.com
xurl.es
142.250.184.226
151.101.194.133
178.250.2.135
178.250.2.148
178.250.2.150
2600:9000:2156:3200:1e:a43d:b640:93a1
2a00:1450:4001:809::2008
2a00:1450:4001:80e::2002
2a00:1450:4001:811::2003
2a00:1450:4001:812::2002
2a00:1450:4001:827::200a
2a00:1450:4001:828::2002
2a00:1450:4001:829::2003
2a00:1450:4001:82a::2004
2a00:1450:4001:82f::2001
2a00:1450:4001:830::2002
2a00:1450:4001:831::2002
2a02:2638:1::11
2a02:2638:1::2
2a02:2638:1::3
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
82.223.3.178
0712a327424e57302c3e5634b02583f54153e0744da7879b6eaca1b80d36749c
083de68ee64611b01365cccdcd48ad90da316f29cf896cad50d5d4235dd1bf41
084bc5b07a6e44bd37f8c82e18d999d40c0c055d2567606fff11b4434c78661d
095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6
0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d
0c1ce4dd3afaa97d8627ecebc2e255fe5c1b3c2038f6961a86d10f0381056cc7
0cc7088b335b30f7b1fa0903bc8aa143b11cb8408032d62d28d5ab768cc68c88
0efd6c2e8c40af6f87f85a294cb92e40bb56c93d72356258eae5b7851063396f
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
1437cdd25532919299784f840c613a46dbcf783903d558bcf5386defd7cceb1c
1559c220a5abcf68675dc5732aed02e625d8e4d9bd3181128e9fac89e962a0f8
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1aaaa76604e8cce1fc24df8b27d6124fc780575f15aeb5a05089277ba25cccec
1abc5469f1235e85489ca1062a07fe18c7f449e3ba039d3de0da07fbb3c5892d
1b4e852fde612daeb72f1f4cca801a99cc2730875048c5ac3faa9f5ca5854155
208cec8b4d019eabc7edfa453854f35ab3960e40b13e5733dd98105b9807d0cf
21c293e6df6dde82c613e769026a9d9e4d1a67511d217141afa59f3838926318
2aa55152e026608daa26a646305a1904735719414b4e0e2ff9fbb64e4e00715b
2f1203fbb212151117c369f929efe26af29a3bda4b4f286d207da7d4eb74833d
2f4ae1a03362ff6799b7c608778377e95820b2e74f38791bf51b87c253701ef8
32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb
3943f2395d1c4079d0e9587004f6f53a03a5d13470fda1bdb7bd473e44848b2f
39826435f54a24b28f021517c3b07707a7afc5400660e40b7b02a0db7ac89d60
3a2b5a369547c3935a351a315db91b9fcf3da7fe3173d5664a108db3de2209a6
3bed0f21b387ac75d06dfb44302f644a033c6edaf5ea9cc8e307cd735daff8df
3d1246d2fe982f57c0a911530b2fa93a679e42c0d897151f39cffa4762c55f5d
4231ca80ea66d79a9325758bc549cd312f304edebaf3693eaadc3af0e153ac3b
4a111a9457fa1840f6fe07aa190976ea50916cad4f6cb241b282d5eba91ff04e
4c23b6931c720f5e0ab729ff415e6dc68ddb3ea447fe4be460118d8a6f0dbfa7
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e0e2b5db0ec9b59a6922b7454d068998f72f1e537042d79635e23f14eaa15fa
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
529ae4f38c76e38b64a96590b61528af7e519acacf5b9726bc1151bfc7677b43
52f3ea846e97001993e527b3f19d26cdc768af17dc17a0c1adcbda7210bf491e
53bb85849942fe0fdb6998300d0c68f1727a6f34a3bdcd9f6f8f12476f64b1e9
54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23
55e834b88453616e75ede9c2de230c607d5869f80d7a14b35e16f681a56bbffe
5818f55583b8a82745bf0b1d9cbc07c0411088fb5a837ff5a15b5a745ccdcd58
58ca6dbc3cc6c1a971b9d7bdd35702f7768cb4dbdd872a8c5181aaa2cf2d0383
5b6afa5549088c078f3382b47fd0bc2ec9a38243f01085249a7a4204206c619f
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5c5fc0560c5d4acaea1cadae07be72f5ad5919a471e794a8a512b7f2cc9811e6
5ec6259ce93d1583fd116bc92baa687aacfdf415efabc596b398c1ebf27c680e
5ff4ea35e5a339f5113ed7107381c3749635252af1890695dd3c6d88da2e2a2f
7056276556bbb443bd7021730cc6053d7969fa69860c6d221e5eab1b4c78cd42
70df9226028499e81eb4f790fda66f0ff0071b2961dcb6ec73ae88714d5f644f
73a87e1c0cffc78b42a822667206698e68ef4c25cd521d9082fc41ad87b14b26
7529f421b38083855086bd50c4373e5ade8a3afed02fda87cab44c4cb324eadd
755d11b5326ae3a32401be8099b7ccf2c45f196bbbe7d7b756c5281a006a606b
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8481816e1174442d9a0165584b4b85f6d825b40471e9e197c86665bf730ab1ce
88193f110768212d8a6526b7566b24f207bfb3eddd45df7fc2581b9d4ac4eff5
8bfd018bb29e8c00faffeb3660e5cbcec66c0ba1dff56f8d2f9a1bcc47c11852
8d2c59f31aa243378eabc1a7da1187c0f0aec68390a463c2a2e7c3e80dc82be1
8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395
8f9a7962cf58f27b89c0627d094ee1b631ec118675f9eae1dc06031353360422
973766985aa550284dc3001f74297e9697084aacde7fc72cb1c0eddbc087b329
97ea5f893bccfdb7685621f8188374da40658def7bcfa1f765a492724bb12acf
99bc13458990137777412f543d96fa3e68c7e276e8bbb4c9173bd495481f49e4
9e56d22c4c632bd0b72bbaf1fed2472ddb3707287435fe92bb00ec97f13ca8f9
9ee29270e7cf2101f374b8f4af6a611794616f8f8be4aaad023ae991f8cf3c6f
a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553
a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6
a3d7dfa849b8539970bb742e68fa6c8460185f28380960d8e27a0d822cdd2871
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37
aa5cce745f29df17c235f1341d0c9302da0c56d79bf056561a914129a89cbffc
ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370
ad561d2d406ea6c156051a3aacbea3986a1b9188575b618f1b07668cb739176b
b0e1406dcd3f5a51fba5bddd8f1dcfa3094ce89092cb038c1e50afa46a1c4024
b733e3553987d967191eeec093811223193ad600018893ac3776c3c9db0fd979
bd56f68e764496c9355cc27296e45971f2fa6a4ba22876d95e38ee0225e279e4
bd885d2a8260008fc42a69102c6860d689d47387adbd60a552181f658234b9cd
bf14bee270a7c9237cc9e28deb028998a04f08aa59309ce22ef92f3ba54ac03d
c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f
d01bcd975f43d304c9fb4433669dcea4b325b6c8e43303f14f85d084c19317d6
d2edcfae0fb84452b9f1b8bc52e938e1f759b0b5302c4a9abea0784d24fb2065
d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01
d6eea55f702d79866f785453b1e53fa20cfd7efb1885886779ce8cc3f0685979
e104549615301e3d036b6fb975b6a8c7d9f5b784fb2b4a9179367c5e96eef974
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e549f9cce9169088c8eb101243d359f327597988627c463efab310ba7fef0388
e77e235669fece8e6008a8f5d31ce9e44fd390032778ff6727b73938425a6941
e9d27f2d7dc647a05780218c575e73fe4bde5791277a03d0bb775fb41d361c73
e9db20bbabb13b4e4b498940023db919362dee26fbaf2adc10b65eed78e6f09a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f072eaaf91a5ea9eb15baf3e94ccf8ae36e44c6152e0aba2f1103b3a6b7a60bc
f0c2342cc334224b345d3e7322b0738573fa83ed6efec0502def76386838db07
f138232191786a1c6d362de031b33fac03d9a97be15539e752de4c41e167af00
f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1
f7bb63c973d338f040a400d5272bf397ae8b1cf52d2a9d79a6870281cc27cd98
fe1d024495ba096cf231a9bb3d9e942f16327d55cf1c65c7d562dbe0901eeb6b