wheregoes.com Open in urlscan Pro
2606:4700:3035::ac43:b70e Public Scan

ns31533570.ip-162-19-138.eu

Software

nginx/1.23.4 /

Resource Hash

a9d1242bcaaccb539ebb87332a63997ef6e4b52cf837198ca0cd65469462847c

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:44 GMT
content-encoding: gzip
an-x-request-uuid: a1328b50-abb0-48fc-a36f-42b078e4d650
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
vary: Accept-Encoding
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://wheregoes.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 45.141.152.72; 45.141.152.72; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
410 B 29ms
8ms XHR
application/json 51.38.120.206
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1702822800000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.38.120.206 Hessen, Germany, ASN16276 (OVH, FR),

Reverse DNS

ip206.ip-51-38-120.eu

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://wheregoes.com
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 433 B
773 B 187ms
118ms XHR
application/json 2602:803:c003:200::91
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=2&alt_size_ids=55&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235981082%2F&tg_i.domain=wheregoes.com&tg_i.page=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235981082%2F&tg_i.pbadslot=%2F8691100%2FWheregoes_S2S_Leaderboard_ATF_ROS%23bsa-zone_1641228026595-4_123456&tk_flint=pbjs_lite_v7.54.0&x_source.tid=0b6b8651-5284-45d0-bfe1-e3c9f65e14fc&l_pb_bid_id=22064cbed2c66e&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=0b6b8651-5284-45d0-bfe1-e3c9f65e14fc&rp_maxbids=1&p_gpid=%2F8691100%2FWheregoes_S2S_Leaderboard_ATF_ROS%23bsa-zone_1641228026595-4_123456&slots=1&rand=0.8926813721520319
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1702822800000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::91 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: b6285c35a93dc1b6a916db391a8d0a36ef3219caf91b2663c3ef6b85beffd710

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:44 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 433
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 411 B
923 B 152ms
83ms XHR
application/json 2602:803:c003:200::91
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=15&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235981082%2F&tg_i.domain=wheregoes.com&tg_i.page=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235981082%2F&tg_i.pbadslot=%2F8691100%2FWheregoes_S2S_Sidebar_ROS_Pos1%23bsa-zone_1641228120494-5_123456&tk_flint=pbjs_lite_v7.54.0&x_source.tid=2f24e1d4-1d1d-45ec-aa45-2bde7d1e57e6&l_pb_bid_id=23c39491ba96679&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=2f24e1d4-1d1d-45ec-aa45-2bde7d1e57e6&rp_maxbids=1&p_gpid=%2F8691100%2FWheregoes_S2S_Sidebar_ROS_Pos1%23bsa-zone_1641228120494-5_123456&slots=1&rand=0.1443821225932176
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1702822800000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::91 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: e97051678f78f0f782f9b3dd1a887bf883fde7a3bc53d6c7c5d676650a705808

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:44 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 411
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 442 B
781 B 395ms
327ms XHR
application/json 2602:803:c003:200::91
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=15&alt_size_ids=9%2C8%2C10&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235981082%2F&tg_i.domain=wheregoes.com&tg_i.page=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235981082%2F&tg_i.pbadslot=%2F8691100%2FWheregoes_S2S_Sticky_Sidebar_ROS_Pos2%23bsa-zone_1641318529900-6_123456&tk_flint=pbjs_lite_v7.54.0&x_source.tid=376b0a6a-9a07-4539-acfa-9a847e8bba2b&l_pb_bid_id=24f332766dd477b&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=376b0a6a-9a07-4539-acfa-9a847e8bba2b&rp_maxbids=1&p_gpid=%2F8691100%2FWheregoes_S2S_Sticky_Sidebar_ROS_Pos2%23bsa-zone_1641318529900-6_123456&slots=1&rand=0.8259638636423017
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1702822800000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::91 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 04149f680b7ac53f6a9aee9b353977a964cf538bcc4f00307f6e8bfff87933e5

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:44 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 442
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
192 B 81ms
53ms XHR
text/plain 2a02:2638:3::7
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=36&wv=7.54.0&cb=38304514695&lsavail=1

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1702822800000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::7 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://wheregoes.com
date: Sun, 17 Dec 2023 14:25:44 GMT
strict-transport-security: max-age=31536000; preload;
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Kestrel
vary: Origin

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 43 KB
9 KB 142ms
120ms XHR
application/json 34.120.63.153
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU18831I
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1702822800000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.63.153 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 153.63.120.34.bc.googleusercontent.com
Software: envoy /
Resource Hash: cd0354c6e4547cac4e31b0cad32c403945e1d69b2718a7d8111f426b0d02250c

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:44 GMT
content-encoding: gzip
via: 1.1 google
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
server: envoy
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 104
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 17 Dec 2023 14:25:44 GMT

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 24 B
400 B 57ms
23ms XHR
application/json 216.52.2.30
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_7.54.0
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1702822800000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.30 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: 8b769fbdf037dc061d8d66b580e0b2b13beacfa3a60875293d48c7f21870e8cf

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

Date: Sun, 17 Dec 2023 14:25:44 GMT
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://wheregoes.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap6ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 24

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 43 KB
13 KB 50ms
23ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

2f1ad4ec7176f493b16e0d186f222e3484248cbb48f82289c736a0877f2d5894

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:44 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 05 Dec 2023 05:12:22 GMT
server: nginx
etag: W/"656eb136-aa2f"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 18 Dec 2023 14:25:44 GMT

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 39 KB
12 KB 32ms
7ms Script
text/javascript 65.9.66.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.104 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-104.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e885badff253144e188588b5657e13cfa1135d4cd682053c9cca02b83baf1ef2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:16:06 GMT
content-encoding: gzip
via: 1.1 46546eb404789d29bf372f6a3fe43876.cloudfront.net (CloudFront)
last-modified: Wed, 06 Sep 2023 15:56:57 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
age: 36579
x-amz-server-side-encryption: AES256
etag: W/"e073e71ed7a44e6f9cdd72904fda5940"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: RhmSM3a7ucD_vIa7Dp3Qyq9Ut2wuhquc-soAaLINCK5x3m7CJyDU2A==

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ 3 KB
3 KB 62ms
10ms Script
text/javascript 2600:9000:243d:c000:a:e047:753:a221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:243d:c000:a:e047:753:a221 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 72e960baa80ec819264a604f2f8a8e5c21f81b785ebc17595211ad170d8b1bdc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-amz-version-id: KP_OVZMS6roEW_XJdOd.KnSEmM8GWiP3
Date: Sun, 17 Dec 2023 06:19:35 GMT
Via: 1.1 c9f5cfb4434d1ba72b6232f7ef6eeb0e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: DUS51-P4
Age: 29170
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 2776
Last-Modified: Thu, 19 Oct 2023 06:40:11 GMT
Server: AmazonS3
ETag: "a3a9a9ee8e72db69d54e805f0586c651"
Content-Type: text/javascript
Accept-Ranges: bytes
X-Amz-Cf-Id: S8gaZDQDKtJXzCfSEBmMqlht0snzhkyF3ggOpvrP65FQWBIJzfi6aQ==

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 28ms
6ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 18:27:07 GMT
content-encoding: gzip
age: 935917
x-guploader-uploadid: ABPtcPrGkX9WdEfraM_2GOgvO4XFku4h6LV8hSZGRCBWDldVHkLv6s4LjI-J4Ekw5y2K4Y2B5aE
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7927
last-modified: Thu, 27 May 2021 18:30:51 GMT
server: UploadServer
etag: "df5542b88bc0e368c6999754a5b9e2ba"
x-goog-generation: 1622140251693895
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
content-type: application/javascript
cache-control: no-transform
x-goog-stored-content-length: 7927
accept-ranges: bytes
expires: Thu, 05 Dec 2024 18:27:07 GMT

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 152 KB
34 KB 36ms
19ms Script
text/javascript 2606:4700:10::6816:3556
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3556 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

65d03eb82a79a732d7c0180593c4f5dc98a8fac5c20c3a5446c4f14bf93d280a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:44 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 07 Dec 2023 12:57:20 GMT
server: cloudflare
x-amz-request-id: BXQW886E0JMDRM75
age: 75
etag: W/"5fcefeebf5ddc7b2ddf2435967e63de9"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 836fd64bffcf9b9e-FRA
x-amz-id-2: C6l/7XLn98EQZ/Zj9l9kF387/ygFaO4zvyYZnP4YDLscsR/q/7QSzfA5vPS58KYId4Yr1z00NDl7/UwyqIqCiQ==

GET
H2 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
1 KB 33ms
17ms Script
application/javascript 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 2371
x-jsd-version: master
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230131-FRA
x-jsd-version-type: branch
server: cloudflare
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1cRupkEloql9IDPXZRGKo%2BEGqI3gQrVBXyscL2O%2BDKi2hFbxlsOZaT%2FB1wurn4Rp1dQ4%2FWUqAMUCpEterpzi0pC%2BHgaH2tPnpYSfZBQJs47L9O%2BnuziT7F3uAfxBg71lxO3ShsT7hel2wT2dS0Q%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 836fd64bfb0a9b39-FRA

GET
H2

200

esp Show response
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235981082%2F&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235981082%2F&rid=esp&cc=1

85 B
193 B

117ms
117ms

Fetch
application/json

34.120.107.143
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235981082%2F&rid=esp&cc=1
Protocol: H2
Server: 34.120.107.143 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 143.107.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: f91e398bcc635ba7ec9c124ce6e5d0a7e4af17969682016236ccdab8f235bd73

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:44 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-aqk5ffi80cFicc8+Lf13bWHzgaI"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

Redirect headers

date: Sun, 17 Dec 2023 14:25:44 GMT
via: 1.1 google
x-powered-by: Express
vary: Origin
access-control-allow-origin: https://wheregoes.com
location: /esp?url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235981082%2F&rid=esp&cc=1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
333 B 98ms
31ms XHR
application/json 3.248.109.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.248.109.126 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-248-109-126.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: ccacba5e660738bb4be6ea460ed77039d3010583287934d0683ad396adefd96e

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:44 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache
x-server: 10.45.20.168
access-control-allow-credentials: true
content-length: 60
expires: 0

GET
H2 204 increment Show response
id5-sync.com/api/esp/ 0
229 B 34ms
7ms XHR
text/plain 162.19.138.119
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.119 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://wheregoes.com
date: Sun, 17 Dec 2023 14:25:43 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 628F 15 KB
6 KB 46ms
13ms Document
text/html 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=wheregoes.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

fd8c1cf4274cae5e1e5a37133cc23b80392ef88c43b798d3748f43948dbb53f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 17 Dec 2023 14:25:43 GMT
server: Kestrel
server-processing-duration-in-ticks: 363373
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2

200

sid Show response
mug.criteo.com/ Frame 628F
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=wheregoes.com&sn=ChromeSyncframe&so=0&topUrl=wheregoes.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=ekH1jHxZZCs5bWp3OEg4eUtDK1U5T25adlRoOG9SSk52QzVYd0lBcmpsRlI4T0VaRERMM2dsSjlabXkwbU1GUk1Gd0Q1cWV2UkZCWXVrOGdiRTRKUWc1WFVLcTlTdXJKVUM5SlBmREVWbnNlVGlreGZBWGFsVDlOWWczWF...

436 B
662 B

14ms
14ms

Fetch
application/json

2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=ekH1jHxZZCs5bWp3OEg4eUtDK1U5T25adlRoOG9SSk52QzVYd0lBcmpsRlI4T0VaRERMM2dsSjlabXkwbU1GUk1Gd0Q1cWV2UkZCWXVrOGdiRTRKUWc1WFVLcTlTdXJKVUM5SlBmREVWbnNlVGlreGZBWGFsVDlOWWczWFZ1b3NYRnp1blhvUnJQU1BMUWZLU05ZUjVWNDh2Y2h0dDRZeHBiRlhJTEczZUJmcnZNK3h0WXc4eUhyRzRmcFVKaVYzMzVoSkxaU3Jjb2d5QWoyTjJXYTFxdExWM1Y4eERDZXI4WTFWZ0F3bmNxbnUvT05GbndvSFdKMTV0ME1Sb2RnZ0NGSlh0dGNGV0RwUVpmbWl2cFd4RmtBcnZjbkdnSjlrWVNXZjdya0x3d0M4SmVzZz18&cppv=2

Protocol

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

003e2cf85c85f5b5c15a66d7a5161356879f18c7c9e21dac9ecbe9a72e7ea6a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:43 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1120943
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:43 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=ekH1jHxZZCs5bWp3OEg4eUtDK1U5T25adlRoOG9SSk52QzVYd0lBcmpsRlI4T0VaRERMM2dsSjlabXkwbU1GUk1Gd0Q1cWV2UkZCWXVrOGdiRTRKUWc1WFVLcTlTdXJKVUM5SlBmREVWbnNlVGlreGZBWGFsVDlOWWczWFZ1b3NYRnp1blhvUnJQU1BMUWZLU05ZUjVWNDh2Y2h0dDRZeHBiRlhJTEczZUJmcnZNK3h0WXc4eUhyRzRmcFVKaVYzMzVoSkxaU3Jjb2d5QWoyTjJXYTFxdExWM1Y4eERDZXI4WTFWZ0F3bmNxbnUvT05GbndvSFdKMTV0ME1Sb2RnZ0NGSlh0dGNGV0RwUVpmbWl2cFd4RmtBcnZjbkdnSjlrWVNXZjdya0x3d0M4SmVzZz18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 237807
content-length: 0
expires: 0

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame 9DB5 0
167 B 44ms
18ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 20
content-type: text/html
date: Sun, 17 Dec 2023 14:25:44 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 92 KB
17 KB 73ms
73ms Fetch
text/plain 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4293649511312332&correlator=4065210995020736&eid=44809527%2C31079958%2C21065724&output=ldjh&gdfp_req=1&vrg=202312060101&ptt=17&impl=fifs&iu_parts=8691100%2CWheregoes_S2S_Leaderboard_ATF_ROS%2CWheregoes_S2S_Sidebar_ROS_Pos1%2CWheregoes_S2S_Sticky_Sidebar_ROS_Pos2&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3&prev_iu_szs=728x90%7C970x90%2C300x250%2C300x250%7C120x600%7C160x600%7C300x600&ifi=1&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1702823144698&lmt=1702823144&adxs=436%2C1091%2C1091&adys=440%2C666%2C950&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0&ucis=1%7C2%7C3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235981082%2F&vis=1&psz=960x267%7C300x952%7C300x952&msz=960x90%7C300x250%7C300x600&fws=516%2C0%2C512&ohw=960%2C0%2C0&ga_vid=1291640143.1702823145&ga_sid=1702823145&ga_hid=1725383476&ga_fc=false&dlt=1702823143244&idt=1002&prev_scp=optimize_ad_unit_id%3Dbsa-zone_1641228026595-4_123456%26optimize_inview%3Dfalse%26optimize_refresh_int%3D0%7Coptimize_ad_unit_id%3Dbsa-zone_1641228120494-5_123456%26optimize_inview%3Dfalse%26optimize_refresh_int%3D0%26hb_size%3D300x250%26hb_pb%3D0.00%26hb_creative%3D381846714%26hb_adid%3D49e7bdd35193928%26hb_bidder%3Dappnexus%26_bd%3Dbid%26_pl%3D0.00%26hb_size_appnexus%3D300x250%26hb_pb_appnexus%3D0.00%26hb_adid_appnexus%3D49e7bdd35193928%26hb_bidder_appnexus%3Dappnexus%7Coptimize_ad_unit_id%3Dbsa-zone_1641318529900-6_123456%26optimize_inview%3Dfalse%26optimize_refresh_int%3D0%26hb_size%3D300x600%26hb_pb%3D0.02%26hb_creative%3DS0300080711068000300060099999900%26hb_adid%3D466d700a28937c%26hb_bidder%3Dmedianet%26_bd%3Dbid%26_pl%3D0.02%26hb_size_medianet%3D300x600%26hb_pb_medianet%3D0.02%26hb_adid_medianet%3D466d700a28937c%26hb_bidder_medianet%3Dmedianet&cust_params=optimize_refreshed%3Dfalse%26optimize_acceptable%3Dfalse%26optimize_adl_debug%3Dfalse%26optimize_ctv_debug%3Dfalse%26optimize_debug%3Dfalse%26optimize%3Dtrue%26optimize_adl_id%3D%26optimize_amp%3Dfalse%26optimize_audience%3Dtech%26optimize_env%3Dprod%26optimize_pub%3Dwheregoes%26optimize_xp%3Da&adks=1696759606%2C2861055222%2C3809685794&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ddd2b1bf030c2e21730bb348f5dc7b1da73337fbad414940f76231dbf94b7c1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:44 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17813
x-xss-protection: 0
google-lineitem-id: 5320060794,5320060794,5936457974
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138305491763,138305489837,138383349304
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 77ms
56ms XHR
application/json 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202312060101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f341e0cad07d7759c8660248e5027d10e67718cdabfe31ec25b96bd18512c715

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:44 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12254
x-xss-protection: 0

GET
H2 200 container.html Show response
a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 08E3 6 KB
3 KB 49ms
15ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 17 Dec 2023 14:25:44 GMT
expires: Mon, 16 Dec 2024 14:25:44 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 4E32 6 KB
3 KB 7ms
6ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 17 Dec 2023 14:25:44 GMT
expires: Mon, 16 Dec 2024 14:25:44 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 6720 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 17 Dec 2023 14:25:44 GMT
expires: Mon, 16 Dec 2024 14:25:44 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 6AF6 0
0 45ms
45ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssiUONrpqiwf7BuHPRSG6qUhXdU9-YYD-ZRw5CF0oRPolZCRrrRULBokrudzXJc4GiolFiNgyiOVVNf0OX0jOItfuUb-5Oxx10J7Q-OM-8ZQRIg_LW-pw0nnjOS9Z6O2xdzVCgu0ZzUCuwE0_RxWh5O8DeA5VrlYoFzSMGMd9VrVo9Fp6t5e_MVJAIz7I-gcaz4gc8aQbUxLYdQMx8gqepis6nVsaqvRP1TTcN1TaRen_UzzzOCVwATz0UhNQ2wNI5mFVdeN_xI5kgUZh0ejOhE24ADl8oxS8acSyH7uX1eeHliy1BxupbH_wU80039Rv3UvzVQ5j1DAnDXLxL9i4JJ9iYEIx5gwLWmrTko706_vxsUzCNMMA&sai=AMfl-YR2oOMdYN3Eeymk3ASPhN1HPDUXq-wAfBcdGFRq5jRqH2SB2uuuqQrKNF0bOPyzWm4xUHBt6lwVXkgEYFIEh0I0WV0QjzZxgWAZaOKG1Ywpd_wpbLMzNJCq0KSPP8WUYlceC582k4Kqw6A8DPyRVwM&sig=Cg0ArKJSzLzpCLem6uGzEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235981082/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:44 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 17 Dec 2023 14:25:44 GMT

GET
H2 200 prebid-universal-creative.js Show response
cdn4.buysellads.net/pub/ Frame 6AF6 26 KB
9 KB 25ms
25ms Script
application/javascript 64.227.70.247
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn4.buysellads.net/pub/prebid-universal-creative.js?1.13.0
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20235981082/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 64.227.70.247 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: srv-eu-nl-15.buysellads.com
Software: //srv.buysellads.com /
Resource Hash: eaf67431972d3e9d0888a562c64f1e353894aa5fd5c38afaad32003404c2f467

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:44 GMT
cache-control: public, max-age=600, stale-while-revalidate
content-encoding: gzip
server: //srv.buysellads.com
etag: 196270e7fcc49a0af36f5d62866c973b3ad33942
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6AF6 203 KB
65 KB 42ms
21ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 17 Dec 2023 14:25:44 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 105ms
84ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 17 Dec 2023 14:25:44 GMT

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 4E32 24 KB
7 KB 14ms
7ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com
URL: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 01:36:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 478155
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 11 Dec 2024 01:36:29 GMT

GET
H2 200 ttj Show response
secure.adnxs.com/ Frame 4E32 8 KB
4 KB 10ms
9ms Script
application/javascript 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?id=18678115&size=728x90&cb=1922015542&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjsuf3MGQJgYHBkAuwnNsLfOPIbZpJcWU1IQFWULOKYBWcMkQrDfx0EAEKFbq3XGQs_20zmNT01NmeN_i9fEICLQqt7PICB9V0IJjSyXkCn6uQvr3S68phLImkiL0zY9C9pai6ijXx8AjPkF12ZFRk1lofjcesuyeWz4TxmPJEtycJxtxDLeinKNQQFsL29NcwrjTsdUTQ_iphrOqRIuKWHlnPvPBPqzexA9grVj9n9MNK93zRvMrKahhCT_ZijbOgtKL5hNeAeE7ZP3hH4LL9Fme-uT5GogE4gP5m_y5YrxFwFroMXirHU1tbqF-0YOBiyd1riykV40jWxZBKjBzcGcVSzG2kFo6-15Rsg6WrA%2526sai%253DAMfl-YRRKCjMa89TsOZeVdDD3uLeKoKn7QqSMR0jwnuSDrNN0LCaAoPhSfglfw_xIuWf3X_Es9tOzd3EJXMR0vFl6_UZj1RUnMXUmkAtTzHcz7Zm_d2PJmUnfuYbMmw9xPkDSww3UxLWlDhIF_hfV5IA7oc%2526sig%253DCg0ArKJSzAf7glaRLQ_dEAE%2526fbs_aeid%253D%25255Bgw_fbsaeid%25255D%2526urlfix%253D1%2526adurl%253D

Requested by

Host: a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com
URL: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

1c49d6082bf3377c5bffdb75c89f642451963a5ed376482e7685d58d57752a5e

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:44 GMT
content-encoding: gzip
an-x-request-uuid: e9a329de-a027-4183-899a-64fff5094024
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
vary: Accept-Encoding
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 45.141.152.72; 45.141.152.72; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4E32 203 KB
64 KB 62ms
58ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com
URL: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 17 Dec 2023 14:25:44 GMT

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 6720 24 KB
6 KB 14ms
8ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com
URL: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 01:36:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 478155
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 11 Dec 2024 01:36:29 GMT

GET
H2 200 ttj Show response
secure.adnxs.com/ Frame 6720 8 KB
4 KB 8ms
8ms Script
application/javascript 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?id=18678115&size=300x250&cb=866213026&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjssVDVIZ9d-rOBp4Blbz8ezU_0zFmTpRlGiWMSbxoTMj_P0r2z8GM-67nY3tswr4Wi8Ieg3GWr22kQkEkPRsC5bY-K2hatDLNYO1P_47iT2x9f6nR0tvp13NeZ-a33-GWlgYLougWLvmXXsgBkUNhHkhBw1iL0IaElfS81zF92emcz66QWXbuoFYLjfrZ4OrhTHSQzmLoUku5JwgRpHi8akOBdR7BEDQdw2CkbP1NJKyeVd0zaO6TNsi6hI746_DiDzccO2SfBN1xTpvbfVvD9Gbqr946BfAlzkYNXUtWhR-U4awouxlQgq3-ZHpy3QcFrBldOj1hFCdiSvLagJ0_Zq3tT8jwz-CFtRjrg%2526sai%253DAMfl-YR2LF0PebNdbWYvT2knDN-1FYhZefLWewOpOcKvhgvJe1Ss15PvUZ0tWAD4GbMbpJ8lH6SKsodwd3YaEgN-Hg-_U8lQ5gy9VqvZ3F7BnENSCdWa2BhYh9GKNElGQSJ825nkX_GTG00fjFF6Y-wuF0I%2526sig%253DCg0ArKJSzPKyLdxSUXZkEAE%2526fbs_aeid%253D%25255Bgw_fbsaeid%25255D%2526urlfix%253D1%2526adurl%253D

Requested by

Host: a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com
URL: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

a88-221-124-22.deploy.static.akamaitechnologies.com

Software

nginx/1.23.4 /

Resource Hash

0598b230f6c797880ff2e5d4caded2ab03f05df5ceb5996bb51b2722de5efd3b

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:44 GMT
content-encoding: gzip
an-x-request-uuid: d8394d86-04fa-4d41-93c7-a8e1a3fd76d3
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
vary: Accept-Encoding
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 45.141.152.72; 45.141.152.72; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6720 203 KB
64 KB 60ms
57ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com
URL: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 17 Dec 2023 14:25:44 GMT

GET
H2 200 nmedianet.js Show response
contextual.media.net/ Frame D395 94 KB
36 KB 81ms
31ms Script
text/javascript 88.221.124.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/nmedianet.js?cid=8CUWMQE3H&ydspr=1

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235981082/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

88.221.124.22 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

a5f425c066bf7402ac21591a90ae7d1e73f5f4d8a127ec53cef9b2f985ed2c6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-mnt-h: 21-g4dd
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Sun, 17 Dec 2023 14:25:44 GMT
server: Apache
etag: "abc755cdfc095fcbf61aab035f9c5414"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: max-age=300
x-mnt-w: 22-s1v0
timing-allow-origin: *
content-length: 36445
expires: Sun, 17 Dec 2023 14:30:44 GMT

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ Frame D395 35 B
296 B 72ms
13ms Image
image/gif 23.216.77.36
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=dmmra&acid=45def8cbd463c0333bbb00381a6d9c65&algo=unison26&bdp=0.0500&bidfp=0.0000&capd=0&cc=DE&cid=8CU18831I&crid=742696110&ct=frankfurt%20am%20main&dc=eu_be&dfpbd=0.0260&dn=wheregoes.com&iwb=1&ogcbdp=0.0500&other_bids=0.05&other_prv=459&pbshr=100.0000&prdp=0.0260&requrl=wheregoes.com%2Ftrace%2F20235981082%2F&sat=0&sc=HE&sc_pvid=459&send_erpm=true&server=1&size=300x600&strg=harmony&totalTime=2186460&ugd=4&ver=9.6.4&cliIP=764254208&time_stamp=2023-12-17%2014%3A25%3A44&seat=BID_API&itype=prebid&req_id=c924ddf1-0f8a-4376-8ce1-c9aaba85459c&dfp_bucket=0.0&level_base=0&bdp_bucket=0.05&app_type=prod&br_id=265&o_id=101&ua=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F120.0.6099.109%20Safari%2F537.36&br_ver=120.0.6099.109&o_ver=NT%2010.0&second_bid=0.0&second_bidder=%2A&model_key=generic_prebid_1-cid_3&ogerpm=0.2000&ogerpm_used=false&rawbid=0.0500&totalTimeBucket=2&as_cache=1&sub_bidder=196&current_day=0.0&current_hour=14&cut=48&floor_bucket=0.00&model_version=202312161507_generic_prebid_1-cid_3&erpm_bucket=0.05&mul_ratio=0.0000&dmm_m4=0.0000&ogerpm_wd_bkt=0-1&visibility=2&viewability=0.3300&stid=bsa-zone_1641318529900-6_123456&pvid_seat=459_BID_API&ckfl=0&mnckfl=0&sd=-1&predicted_wr=6.8885&bdp_wider_bucket=1&splid=bsa-zone_1641318529900-6_123456&dim10=false&dmm_m9=0.0000&log_less=false&cut_bkt=85&advurl=generalsearch.net%2F&dmm_d10=0.0000&bdmm_m5=0.0000&bdmm_m6=0.0000&bdmm_m7=0.0000&bdmm_m12=0.0000&dmm_l=0.0000&dmm_r=0.0000&e_rpm=0.0000&bdr_typ=1&url_l1=trace&url_l2=20235981082&clisp=rtb-common-5c85f5bcc7-4r59v.BE&dmm_m1=2023-12-17%2014%3A25%3A44.417347194&bd_m1=0.0000&bd_m2=0.0000&bd_m3=0.0000&ss=1600x1200&ss_d1=1600&ss_d2=1200&dmm_m22=0.0500&adtyp=0&gpid_format=DEFAULT&gpid=%2F8691100%2FWheregoes_S2S_Sticky_Sidebar_ROS_Pos2%23bsa-zone_1641318529900-6_123456&gpid_sent=true&pst=EMS&bcrid=S0300080711068000300060099999900&erpm_mult=1.000000&zone=b&rc=1&sfm_key=mowx_System_459&content_context=-1&video_mindur=-1&video_maxdur=-1&vskip=-1&ctr=-1.0&vcmplrt=-1.0&vplcmtt=-1&itype_id=3&wsip=mowx-74b5d97f5b-kvbw5&rel_cut_bkt=85&djvm=9.5.8&optimal_cut=0.0&cut_cluster=0.0
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20235981082/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.216.77.36 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-216-77-36.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 17 Dec 2023 14:25:44 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Sun, 17 Dec 2023 14:25:44 GMT

GET
H2 200 release-20231121-135-adperformance.js Show response
warp.media.net/rtb/resources/ Frame 6AF6 72 KB
25 KB 499ms
162ms Script
application/javascript 2.18.160.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://warp.media.net/rtb/resources/release-20231121-135-adperformance.js

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1702822800000

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.160.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

UploadServer /

Resource Hash

1616c8cd083e6b17f6a75ab0695bd4a4573b31ae8398ffb43758288028f6a773

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=604800
content-encoding: gzip
date: Sun, 17 Dec 2023 14:25:45 GMT
x-guploader-uploadid: ABPtcPrDBFm7o7QKmX4XaSB8aYt3ZqnHxngeTSt83ozGJDQNyOKFWA_aTOKADcSChCGSVn_JGg
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 25147
server: UploadServer
etag: "841dabce0b477a93d9cf7379b9eb1368"
vary: Accept-Encoding
x-goog-hash: md5=hB2rzgtHepPZz3N5uesTaA==, crc32c=iBXD1A==
content-type: application/javascript
x-goog-generation: 1700562102250666
cache-control: max-age=3600
x-goog-stored-content-length: 73447
expires: Sun, 17 Dec 2023 15:25:45 GMT

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ 35 B
296 B 72ms
14ms Image
image/gif 23.216.77.36
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=projectevents&project=prebid&acid=c924ddf1-0f8a-4376-8ce1-c9aaba85459c&cid=8CU18831I&crid=742696110&adunit_count=1&dn=wheregoes.com&requrl=https://wheregoes.com/trace/20235981082/&istop=true&event=client_bid_won&value=0.026&rd=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.216.77.36 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-216-77-36.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 17 Dec 2023 14:25:44 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Sun, 17 Dec 2023 14:25:44 GMT

GET
H2 200 log
hblg.media.net/ Frame 6AF6 35 B
191 B 501ms
161ms Image
image/gif 2.18.160.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/log?logid=kfke&evtid=plutol1&__q=AYYEIwKELAQCAAABAAAAAgAAAAAAAAEABgAAQIABAAgAMNAATjEyMjI2NDA2NDE5MDM4XzIwNjQ3NDAyNjlfNzQyNjk2MTEwNDU5MUA0NWRlZjhjYmQ0NjNjMDMzM2JiYjAwMzgxYTZkOWM2NZYHmpmZmZmZqT9QaHR0cHM6Ly93aGVyZWdvZXMuY29tL3RyYWNlLzIwMjM1OTgxMDgyLwRERRp3aGVyZWdvZXMuY29tEjhDVTE4ODMxSQgOMzAweDYwMAowLjAyNgpldV9iZQxQUkVCSUQGYWRtAAAAAAAAgEBAsK_Zgo9jAjIAAAAAAADwvzxydGItY29tbW9uLTVjODVmNWJjYzctNHI1OXYuQkVAUzAzMDAwODA3MTEwNjgwMDAzMDAwNjAwOTk5OTk5MDACEDZjODE3ZjlmAmIC&cpr=0.5520172560813943

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235981082/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.160.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:45 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Sun, 17 Dec 2023 14:25:45 GMT

GET
H2 200 clog
hblg.media.net/ Frame 6AF6 35 B
191 B 545ms
205ms Image
image/gif 2.18.160.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/clog?pixel_len_bucket=6085&logid=awlog&lper=1&itypeid=3&itype=PREBID&cc=DE&cid=8CU18831I&reqid=c924ddf1-0f8a-4376-8ce1-c9aaba85459c&vid=c924ddf1-0f8a-4376-8ce1-c9aaba85459c&dn=wheregoes.com&rawDn=wheregoes.com&requrl_dn=wheregoes.com&pid=8PRW23HG5&ugd=4&fleet=common&requrl=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235981082%2F&cliIPType=v4&coppa_status=N&coppa_applied=N&coppa_enf=true&lmt_enf=true&dnt_enf=false&geo_source=2&sc=HE&ct=frankfurt+am+main&zip=60326&pubid=pub-8CU18831I&tgtval=pub-8CU18831I&csip=rtb-common-5c85f5bcc7-4r59v.BE&dtc=eu_be&zone=b&sd=-1&ptype=23&tmax=2500&xtmax=345&gdpr=1&gsi=0&gpp_present=false&csex=0&app=0&sat=0&screeninfo=1600x1200&asn=9009&sckfl=0&sckfl2=0&usp_status=0&usp_enf=1&mspa_enforced=true&pexid=PREBID-8CU18831I&geoll=false&is_ortb=false&s_city=Frankfurt&commit_id=6c817f9f&ocurr=USD&omul=1.0&currsrc=API&currsrc_date=2023-12-15+00%3A00%3A00&pbasrc=0&schain_cmpl=1&schain_nodes_count=1&dummy_vsid=false&second_call=false&ipcc=DE&is_msnnative_src=false&proxy=envoy&rtttime=101&req_tid_present=false&pvid=459&prvAccId=151714331&prvApiId=8CUWMQE3H&adj0=0.0&adj1=0.0&adj2=0.0&pst=0&crid=742696110&prspt=headerBid&prvReqId=12226406419038_2064740269_7426961104591&size=300x600&chnl=HARMONY&bdp=0.050&bid_uuid=e8740592f3269a8c9a0c9970bbaceb04&cbdp=0.026&og_cbdp=0.050&ogbdp=0.05&pv_adtype=0&res_mtype=0&mnet_ckfl=0&ckfl=0&be=0&advUrl=https%3A%2F%2Fgeneralsearch.net&dfpBd=0.026&dsrc=-2&dp=0&dbf=1&epc=151714331&s=1&snm=SUCCESS&pcrid=8CUWMQE3H-151714331-51-1&tpbTkn=false&exid=217&bidflr=0.000&pbidflr=0.000&opbidflr=0.000&spbf=0&viewability=33&sbdrid=196&bdata=sd2%3Dnull%7Eiurl_l%3D20%7Eogerpm%3D0.2%7Evis_sd%3D416%7Erf_cnt%3D1%7Edc2%3D1%7Eistm%3D2%7Ebat%3D0%2C0%2C0%7Escd%3Dhe%7Ev_asn%3D9009%7Evl2r_sd%3D2023121707%7Eiurl_b%3D8228.42%7Eurl_tkc%3D0%7Estd%3Dbsa-zone_1641318529900-6_123456%7Elast%3D%7Ecvog%3D0.59%7Evis_url_b%3D0.62%7Evl2r_i_sd%3D2023121707%7Eip%3DPIJqM%7Efbb%3D0%7Evis_url_l%3D20%7Eriipua%3D0%2C0%7Eet%3D19%7Erc%3D1%7Emtid%3DPO000012%7Evl2r_i_b%3D0.01%7Erps_sd%3D2023121516%7Evis_b%3D544%7Eurl_b%3D0.12%7Evl2r_url_b%3D0%7Evl2r_url_vi%3D1E-16%7Eurl_tvi%3D0%7Eurl_l%3D20%7Eslv%3D0%7Egcat%3D-1%7Ebb%3D196%7Evv%3D0%7Ecvl2r_sd%3D417%7Erfv%3D0%7El2r_b%3D1000%7Eerpm%3D0.05%7Evl2r_url_kc%3D0E0%7Ebm%3D0.25%7Ea3p_b%3D3.34%2C107.56%7Esid%3D151714331%7Esd%3D-1%7Euid%3D22d5GhTJWwk1nJFghY%7Ecvl2r_b%3D0.59%7Ebtd%3D3079991045420708567498520639038129913224030488907179144399357366227752680726580540338594429584209743872%7Evwu%3D-1%7Ed2p_l%3D10%7Ecvl2%3D0.59%7E3pcf%3D1000%7Euim%3D0%7Evw_med%3D0.33%7Edmm_strg%3Dharmony%7Ed2p_b%3D0.98%7Eogd2p_b%3D0.96%7Evurl_b%3D0.24%7Ess%3D1600x1200%7Ecc%3DDE%7Euiw%3D-1%7Ece%3D0%7Erps_b%3D107.56%7Ercv%3D37.29%7Evurl_l%3D20%7Erps_url_b%3D62.83%7ECI%3D3062%7Ekb_uc%3D-2%7Ents%3D1%7Ekb_ccks%3D-2%7Ect%3Dfrankfurt+am+main%7Ebss_KTW%3DNA%2CNA%7Ebasis2%3D196%7Ebasis1%3D196%7EisRef%3D0%7Eivurl_b%3D4.16%7Eisif%3D0%7Ebid%3D0.05%7Erps_url_l%3D20%7Edc%3D7%7Evl2r_b%3D3.34%7Eivurl_l%3D20%7Ecbdp%3D0.026%7Esd%3D-1%7Eitype_id%3D3%7Eseller_tag_id%3Dbsa-zone_1641318529900-6_123456%7Esupply_tag_id%3Dbsa-zone_1641318529900-6_123456%7Epos%3D3%7Eref_cnt%3D1%7EcarrierId%3D0%7Eogbid%3D0.050%7Ebflr%3D0.000%7Edtc%3Deu_be%7Edmm_erpm%3Dfalse%7Edmm%3Dharmony%7Ebdpcapd%3D0%7Edalg%3Dunison26%7Esobp%3D%7Ehtml%3D1%7Edcut%3D85%7Edogb%3D0-1%7Eibc%3D1%7Ensz%3D1%7Etgs%3D300x600%7Ebsb%3D0%7Ebsp%3D0%7Etmx%3D289&exp=ssProfile%3D0%7Csfl%3Dfalse%7CssBucket%3D0%7Cbfl%3D-100%7Csch%3D1%7Cclt%3D3%7Ctpi%3D1%7Cfl_rl%3D1%7Cdbr%3D1%7Csfl%3Dfalse%7Cbfl%3D-100%7Ctpi%3D1&mnrf=0&ortbseat=BID_API&brsrclk=0&bidrestime=1702823144408&fpuReq=1&bfs=103&acsn=1&ybnca_erpm=0.05&dmm_erpm=true&dmm_ogerpm=false&bcrid=S0300080711068000300060099999900&strg=HARMONY&stagid=bsa-zone_1641318529900-6_123456&vls=0&scrid=S0300080711068000300060099999900&mang=1&pvdTmax=289&fpusp=false&ae=false&epcexp=false&moau=true&ucrid_ver=2&omid=0&mnet_static_share=0.0&apTags%3C%3E=75&dt=O&mx_svc_mode=http&incentive_type=0&aogbdp=0.0&spIvt=3&spSource=0&spTo=3&spIsReq=3&spFst=0&spCst=0&mx_sdr=false&mx_sbp=-10.0&mx_sua_cvg=0000000&mx_tid_sent=false&mx_epbc=8CUWMQE3H&mx_SPRIG=0&mx_bsBucket=0&mx_ssProfile=0&mx_lr=0&mx_TAS=1&mx_ep_sent%3C%3E=badv&mx_g_one_uid_sent=None&mx_uid_sent=0&mx_bsBucketRa=0&mx_sid=8CU18831I&mx_SC=0&mx_lr_seg_deal=0&mx_aqcpl_crid=0&mx_nsz=1&mx_GCID=0&mx_maq_call=false&mx_aurt=0&mx_bsBucketKtwRl=0&mx_divid=bsa-zone_1641318529900-6_123456&mx_tgs=300x600&mx_bsProfileRa=0&mx_IAB2=0&mx_gpid_format=DEFAULT&mx_bss_algos%3C%3E=0&mx_aurl_hc=0&mx_aabpc=0&mx_PC=1&mx_UCC=1&mx_gpid=%2F8691100%2FWheregoes_S2S_Sticky_Sidebar_ROS_Pos2%23bsa-zone_1641318529900-6_123456&mx_isLossNtf=false&mx_bsProfileKtwRl=0&mx_bsProfile=0&mx_ssBucket=0&mx_TAF=3&mx_gpid_sent=true&mx_commit_id=e647832764&mx_exp_tokens%3C%3E=IPBLOCK_DM%3AGCS%23%23ctx_canonical_exp%3Atrue%23%23prll_req%3Afalse%23%23NedCkflWithData%3ADEFAULT%23%23launchexp%3Atoken2%23%23bsNed%3AvalidBid%23%23NedCkfl%3ADEFAULT%23%23BssTgtMig%3ADEFAULT&native_ver=1.1&acid=45def8cbd463c0333bbb00381a6d9c65&rtime=21.0&wsip=mowx-74b5d97f5b-kvbw5&ltime=80.0&act=headerBid&abs=0%7C0%7Cnxblock%3D-1%7Cxtmax%3D345%7Cbrr%3D0&adtypes=0&impId=33af9765b7fcda2&reftime=15000&reftype=0&dsid=bsa-zone_1641318529900-6_123456&gpid=%2F8691100%2FWheregoes_S2S_Sticky_Sidebar_ROS_Pos2%23bsa-zone_1641318529900-6_123456&mowxReqId=45def8cbd463c0333bbb00381a6d9c65_3&req_size=300x250%7C120x600%7C160x600%7C300x600&renderer=0&ifst=0&iframingState=0&ifdp=0&slotVisibility=2&adpos=3&media=0&native_asset=0&req_mtype%3C%3E=0&ctr=-1.0&rfc=1&skadidfl=0&dfpDiv=bsa-zone_1641318529900-6_123456&feedback_id=376b0a6a-9a07-4539-acfa-9a847e8bba2b&supplyTagId=742696110&pub_pbslot=%2F8691100%2FWheregoes_S2S_Sticky_Sidebar_ROS_Pos2%23bsa-zone_1641318529900-6_123456&mnrfc=1&viewability_vendor=MEDIA.NET+EXCHANGE&viewability_mnet=33&v_mkey=gen-vblt_prebid_test_2_0&v_mver=202312171042_gen-vblt_prebid_test_2&v_alg=gen-vblt_prebid_all&vcmplrt=-1.0&imp_tid_present=true&debug_ts=2023-12-17+14%3A25%3A44&__expireat=1702823744671&mview=1&lo_pvid=%5B459%5D&lo_dp=0&lo_bdp=0.050&lo_cbdp=0.026&actltime=88&rme=adm&utime=422&sf=0&cpr=0.6391550841235347

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235981082/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.160.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:45 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Sun, 17 Dec 2023 14:25:45 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 4E32 0
0 45ms
45ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss3tYYr1ZzbV-BZZ9HRIiOF164ixUI-upbdkYLtTUTxt5Tro4Hd8LvxhtZuutMUA8iOoUYs--CCTfxaUh4idl-Ujo6mr2foZPpDG4AxWH1qN6xZvwqVA5_ROcmcz74MTZyncE4C6SZrseGu_fc3byI9-JvPxrnwDMrg_fth5dxmSBifMgcwz1NSUyBUXvLJQENOn44QZF8bNZLWSzKJFHy1OtfkL6t3qNBkD0kyxdAqqSJ1nUy7MZlEnPBxIfAB9JfLdy4dfs3rfl0oI2iIeFDU3JSTeT7kcTbz_yGQMHIp-1bzcKnlv2CUZhVRgSuHaOYzTgZihijH-Jqkupx4tLf-yyvQNgKizw48yIDcLUNQTQ&sai=AMfl-YQdrc1AmsAKN9Jm4iEI-ZGQw0xo-ITAIsol-mUyJJ1rzR48b8S7j09xMc4nvJag6RTs-sLVhwPjaG1BEDR26Tkm_GtZhEMObex2vE6oqoYTxHYK-64OeVR1BwM3R27YOvORxFtID3gJflqhBaxBzLw&sig=Cg0ArKJSzNqqumUf5Q-SEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com
URL: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:44 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 17 Dec 2023 14:25:44 GMT

GET
H2 200 sync Show response
gum.criteo.com/ Frame 4E32 51 B
292 B 14ms
14ms Script
text/javascript 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?c=30&r=2&j=cr_handle_data_a

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?id=18678115&size=728x90&cb=1922015542&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjsuf3MGQJgYHBkAuwnNsLfOPIbZpJcWU1IQFWULOKYBWcMkQrDfx0EAEKFbq3XGQs_20zmNT01NmeN_i9fEICLQqt7PICB9V0IJjSyXkCn6uQvr3S68phLImkiL0zY9C9pai6ijXx8AjPkF12ZFRk1lofjcesuyeWz4TxmPJEtycJxtxDLeinKNQQFsL29NcwrjTsdUTQ_iphrOqRIuKWHlnPvPBPqzexA9grVj9n9MNK93zRvMrKahhCT_ZijbOgtKL5hNeAeE7ZP3hH4LL9Fme-uT5GogE4gP5m_y5YrxFwFroMXirHU1tbqF-0YOBiyd1riykV40jWxZBKjBzcGcVSzG2kFo6-15Rsg6WrA%2526sai%253DAMfl-YRRKCjMa89TsOZeVdDD3uLeKoKn7QqSMR0jwnuSDrNN0LCaAoPhSfglfw_xIuWf3X_Es9tOzd3EJXMR0vFl6_UZj1RUnMXUmkAtTzHcz7Zm_d2PJmUnfuYbMmw9xPkDSww3UxLWlDhIF_hfV5IA7oc%2526sig%253DCg0ArKJSzAf7glaRLQ_dEAE%2526fbs_aeid%253D%25255Bgw_fbsaeid%25255D%2526urlfix%253D1%2526adurl%253D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

acb5d519051cc13618e992a7df4bce6a980036dfbe2e17a970ec716194329f6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:43 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 857507
expires: 60

GET
H2 200 ttj Show response
secure.adnxs.com/ Frame 4E32 8 KB
5 KB 170ms
170ms Script
application/javascript 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?ttjb=1&bdc=1702823144&bdh=dz4vF9Bu5gcyu_Dw1fSFXsVarzA.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2Fa42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&&id=18678115&size=728x90&cb=1922015542&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsuf3MGQJgYHBkAuwnNsLfOPIbZpJcWU1IQFWULOKYBWcMkQrDfx0EAEKFbq3XGQs_20zmNT01NmeN_i9fEICLQqt7PICB9V0IJjSyXkCn6uQvr3S68phLImkiL0zY9C9pai6ijXx8AjPkF12ZFRk1lofjcesuyeWz4TxmPJEtycJxtxDLeinKNQQFsL29NcwrjTsdUTQ_iphrOqRIuKWHlnPvPBPqzexA9grVj9n9MNK93zRvMrKahhCT_ZijbOgtKL5hNeAeE7ZP3hH4LL9Fme-uT5GogE4gP5m_y5YrxFwFroMXirHU1tbqF-0YOBiyd1riykV40jWxZBKjBzcGcVSzG2kFo6-15Rsg6WrA%2526sai%253DAMfl-YRRKCjMa89TsOZeVdDD3uLeKoKn7QqSMR0jwnuSDrNN0LCaAoPhSfglfw_xIuWf3X_Es9tOzd3EJXMR0vFl6_UZj1RUnMXUmkAtTzHcz7Zm_d2PJmUnfuYbMmw9xPkDSww3UxLWlDhIF_hfV5IA7oc%2526sig%253DCg0ArKJSzAf7glaRLQ_dEAE%2526fbs_aeid%253D%25255Bgw_fbsaeid%25255D%2526urlfix%253D1%2526adurl%253D

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

3255ec7a6b4dbd7ce61f7e383bd5e9c7222415c212a4c16e5ddc47d7981ab17c

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:45 GMT
content-encoding: gzip
x-creative-id: 240772436
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
x-proxy-origin: 45.141.152.72; 45.141.152.72; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
x-xss-protection: 0
pragma: no-cache
an-x-request-uuid: 7fc1d12d-5ef1-4df9-a3c1-990de4bc7d91
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 6720 0
0 45ms
44ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssLC7K9Qga8YQbchxijDPqfH-U6631rnccvYYoWrzN-_-oIVXLzSWlBPxw14_83oFGhb1C9gN495H0vsq6h15cz8HZyWYu7Xg4ZouzrRndwh6sc3X3d4DqxOxFE-k81bOu814wZmGjPqIW6bNChSBYShtYn0-jvEa0wZE9VtDeSGgb9bBacC9bhWA_Rfq6owklz_bz4UsHNWDprzask_KJbVeyhqCBvtKYftADSlgqfIZFM71FFsMZs1xy6NLBcushdH2C-Yy2WGJXGru_B4y_kfEd0Ib2hwVRlmPoQ6iIBEyOt3Yw06izTmmBQYYvYoXA7GDJUaFKu8GJ8H_gWj8EFFlsCVaJzsKbcUlyX1Q&sai=AMfl-YSh0PLMmzAOMghqWk8fQWGpfWE-zSuZ9CBmL25PYvlF_rx-VE32Ynw9EZ9MLUMrlhhObFmuAuF5-mYf7wWyUgUZnM5BrPvDFvp6ZWEKCVKfA9XFLhY6QY-n81GEItPeH2h-uC5Dg1E9_OdN-5kJblc&sig=Cg0ArKJSzB2Y57fGG-ygEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com
URL: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:44 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 17 Dec 2023 14:25:44 GMT

GET
H2 200 sync Show response
gum.criteo.com/ Frame 6720 51 B
293 B 18ms
17ms Script
text/javascript 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?c=30&r=2&j=cr_handle_data_a

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?id=18678115&size=300x250&cb=866213026&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjssVDVIZ9d-rOBp4Blbz8ezU_0zFmTpRlGiWMSbxoTMj_P0r2z8GM-67nY3tswr4Wi8Ieg3GWr22kQkEkPRsC5bY-K2hatDLNYO1P_47iT2x9f6nR0tvp13NeZ-a33-GWlgYLougWLvmXXsgBkUNhHkhBw1iL0IaElfS81zF92emcz66QWXbuoFYLjfrZ4OrhTHSQzmLoUku5JwgRpHi8akOBdR7BEDQdw2CkbP1NJKyeVd0zaO6TNsi6hI746_DiDzccO2SfBN1xTpvbfVvD9Gbqr946BfAlzkYNXUtWhR-U4awouxlQgq3-ZHpy3QcFrBldOj1hFCdiSvLagJ0_Zq3tT8jwz-CFtRjrg%2526sai%253DAMfl-YR2LF0PebNdbWYvT2knDN-1FYhZefLWewOpOcKvhgvJe1Ss15PvUZ0tWAD4GbMbpJ8lH6SKsodwd3YaEgN-Hg-_U8lQ5gy9VqvZ3F7BnENSCdWa2BhYh9GKNElGQSJ825nkX_GTG00fjFF6Y-wuF0I%2526sig%253DCg0ArKJSzPKyLdxSUXZkEAE%2526fbs_aeid%253D%25255Bgw_fbsaeid%25255D%2526urlfix%253D1%2526adurl%253D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

acb5d519051cc13618e992a7df4bce6a980036dfbe2e17a970ec716194329f6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:44 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 4750095
expires: 60

GET
H2 200 ttj Show response
secure.adnxs.com/ Frame 6720 0
646 B 7ms
6ms Script
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?ttjb=1&bdc=1702823144&bdh=dz4vF9Bu5gcyu_Dw1fSFXsVarzA.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2Fa42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&&id=18678115&size=300x250&cb=866213026&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjssVDVIZ9d-rOBp4Blbz8ezU_0zFmTpRlGiWMSbxoTMj_P0r2z8GM-67nY3tswr4Wi8Ieg3GWr22kQkEkPRsC5bY-K2hatDLNYO1P_47iT2x9f6nR0tvp13NeZ-a33-GWlgYLougWLvmXXsgBkUNhHkhBw1iL0IaElfS81zF92emcz66QWXbuoFYLjfrZ4OrhTHSQzmLoUku5JwgRpHi8akOBdR7BEDQdw2CkbP1NJKyeVd0zaO6TNsi6hI746_DiDzccO2SfBN1xTpvbfVvD9Gbqr946BfAlzkYNXUtWhR-U4awouxlQgq3-ZHpy3QcFrBldOj1hFCdiSvLagJ0_Zq3tT8jwz-CFtRjrg%2526sai%253DAMfl-YR2LF0PebNdbWYvT2knDN-1FYhZefLWewOpOcKvhgvJe1Ss15PvUZ0tWAD4GbMbpJ8lH6SKsodwd3YaEgN-Hg-_U8lQ5gy9VqvZ3F7BnENSCdWa2BhYh9GKNElGQSJ825nkX_GTG00fjFF6Y-wuF0I%2526sig%253DCg0ArKJSzPKyLdxSUXZkEAE%2526fbs_aeid%253D%25255Bgw_fbsaeid%25255D%2526urlfix%253D1%2526adurl%253D

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

a88-221-124-22.deploy.static.akamaitechnologies.com

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:44 GMT
an-x-request-uuid: cb5959c4-0b2b-4b29-ac4a-07112613d070
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 45.141.152.72; 45.141.152.72; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 6720 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b68f1beaa33a389a4548ffa05578646a3340e3a71f49c4e899410f64ef430cc4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 6720 0
0 59ms
45ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu9EZiAh2dIDO44FHSlfCk99QWthJHA1Ec6nlVfZtMxJDRGCiHc6LpCaFij34EiyLNDDSpcHWJX5hzGyEBZT2_T-BmMt3xB47YF6q3wGkSsbxfSziS1bdJ_yq6Qd9rOH3Vo_pEyCZpAXQjQs-5Vrqs-2zBqTP8xgahFn9phDziqyttHYofv44OuRzLjUqAO9Sx9JwxF17DEIfWbzvC5hAPpaK-OaJlTh-ImdjAjDDsYQgvE5QUBZwDCnWCjrWizJtrzjAAuTQ7H-dXIW62_fQP1TQzZk7g6h2kcOz_aImCS6g4wL7t5iN2Wd3cbZbyISXNmMyxqZloV5TY2xHkyE5UnrKIXIxEP2TqxZWOOentF&sai=AMfl-YSg0cf3Eyucq7GCtj-TyTDGO4H1sqov1bi6Dir80MAKXzjrVlo9LZNnG4Se5u_aQVKeUjTN9VhAS971zBJa9WRXabWZW5B89lCTD-0EnVoWX-1am4S0T-1Y2ZVQHpkClOCMPI-01VAMKpWnPGD_Nfw&sig=Cg0ArKJSzGORTw8NFsTdEAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:44 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 17 Dec 2023 14:25:44 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 7A31 13 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 20552
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 17 Dec 2023 08:43:12 GMT
expires: Mon, 16 Dec 2024 08:43:12 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 2B07 829 B
1 KB 35ms
16ms Document
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

e3568014f7c3e0f48ffe600268f8be3b0f7f66bfa9c72679aefd566f1d805c43

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-rk_0iuwcrGfVrIuLha2fwA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-rk_0iuwcrGfVrIuLha2fwA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 17 Dec 2023 14:25:44 GMT
expires: Sun, 17 Dec 2023 14:25:44 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 7A31 39 KB
15 KB 21ms
7ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sat, 16 Dec 2023 12:52:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 92009
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 15 Dec 2024 12:52:15 GMT

GET
H2 200 SAFEFRAME.html Show response
contextual.media.net/sr/2722522032/ Frame D336 75 KB
29 KB 347ms
347ms Document
text/html 88.221.124.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=2428&&kkdd=*h%7CW%7C9uA3Hh*n&Ke=hVkTCTUhGGSUGU2USkh&mzWE=h&xuWR=k&yzK=hhUk&juyX=-Uck&yez=Ci5bLY~Up&yWyz=L)6dS)bg*TU(g2zVH1z)Um%3D%3D&yEez=hchVhGUUh&uenX=Ukk*Skk&yy=q~&uy=p~&ya_x=pPIL3Or&Wez=C03i-2hS-&jWez=F0S7T5S&ajjWu=h&EEE=jnIDa-y!D-2pW0WJC.Y(r!xyVEy3.HTFGs6VTG~5~K3mzf2bgMuUcbRV)-pw-QFy&fvEQ=ajjWu%3A%2F%2FvaXEXmHXu8yHx&XfvEQ=vVV~Y%3AJJ(v.-.sx.Y8Oxr&_uX=c&!v=h&omz=G&Rzjh=Ci5hCCUh)&RzjT=VGTS2Shhk&BzRjR=uzT%3D_o!!ZeoE!M!%3DTkZHmXEWx%3Dk8TZKeuMuz%3DGhSZEQMy_j%3DhZzyT%3DhZeujx%3DTZBRj%3Dk%2Ck%2CkZuyz%3DaXZKMRu_%3D2kk2ZK!TEMuz%3DTkTUhThVkVZeoE!MB%3DCTTC8GTZoE!Mjfy%3DkZujz%3DBuRDnH_XMhSGhUhCcT22kkDSMhTUGcSZ!Ruj%3DZyKHm%3Dk8c2ZKeuMoE!MB%3Dk8STZK!TEMeMuz%3DTkTUhThVkVZeW%3D0).6LZQBB%3DkZKeuMoE!M!%3DTkZEeeWoR%3Dk%2CkZXj%3Dh2ZEy%3DhZxjez%3D03kkkkhTZK!TEMeMB%3Dk8khZEWuMuz%3DTkTUhThchSZKeuMB%3DcGGZoE!MB%3Dk8hTZK!TEMoE!MB%3DkZK!TEMoE!MKe%3Dh~DhSZoE!MjKe%3DkZoE!M!%3DTkZu!K%3DkZmyRj%3DDhZBB%3Dh2SZKK%3DkZyK!TEMuz%3DGhVZEQK%3DkZ!TEMB%3DhkkkZXEWx%3Dk8kcZK!TEMoE!Mfy%3Dk~kZBx%3Dk8TcZRUWMB%3DU8UG%2ChkV8cSZuez%3DhchVhGUUhZuz%3DDhZoez%3DTTzc7aF.bvfh_.gmarZyK!TEMB%3Dk8c2ZBjz%3DUkV222hkGcGTkVkCcSVG2CcTkSU2kUChT22hUTTGkUkGCC2kVhV2hGGU22UcVUSSTTVVcTSCkVTScCkcGkUUCc2GGT2cCGTk2VGUCVTZKvo%3DDhZzTWM!%3DhkZyK!T%3Dk8c2ZUWyQ%3DhkkkZoex%3DkZKvMxXz%3Dk8UUZzxxMujEm%3DaRExH_sZzTWMB%3Dk82CZHmzTWMB%3Dk82SZKoE!MB%3Dk8TGZuu%3DhSkk*hTkkZyy%3Dq~Zoev%3DDhZyX%3DkZEWuMB%3DhkV8cSZEyK%3DUV8T2ZKoE!M!%3DTkZEWuMoE!MB%3DST8CUZi)%3DUkSTZfBMoy%3DDTZ_ju%3DhZfBMyyfu%3DDTZyj%3DQER_fQoEj%20Rx%20xRe_ZBuuMAFb%3DOP%2COPZBRueuT%3Dh2SZBRueuh%3Dh2SZeuIXQ%3DkZeKoE!MB%3DG8hSZeueQ%3DkZBez%3Dk8kcZEWuMoE!M!%3DTkZzy%3DVZK!TEMB%3DU8UGZeKoE!M!%3DTkZyBzW%3Dk8kTSZuz%3DDhZejsWXMez%3DUZuX!!XEMjRmMez%3DBuRDnH_XMhSGhUhCcT22kkDSMhTUGcSZuoWW!sMjRmMez%3DBuRDnH_XMhSGhUhCcT22kkDSMhTUGcSZWHu%3DUZEXQMy_j%3DhZyREEeXE)z%3DkZHmBez%3Dk8kckZBQ!E%3Dk8kkkZzjy%3DXoMBXZzxxMXEWx%3DQR!uXZzxx%3DaRExH_sZBzWyRWz%3DkZzR!m%3Do_euH_TSZuHBW%3DZajx!%3DhZzyoj%3DCcZzHmB%3DkDhZeBy%3DhZ_un%3DhZjmu%3DUkk*SkkZBuB%3DkZBuW%3DkZjx*%3DTC2&_jK=k&xxx=olHuOQ)q6~f%3D&ev=Ukk&e_)QE=h&BzE)z=Gc2&Bez=UGChGh&fjj!X=FERyX%20IXuo!ju%20%7C%20baXEX7HXu&xyQ=VSc2T&szuWE=h&BRX=(*Xm6m%2F*OO&fRjWEX=h&fRjBez=DhkU&yRzHxRe_=jnIDa-y!D-CAj3-G.1HeiAaCjyUPWnoUWwCeWkXG0n~%3D&sW!W=h&euez=c&Wmez=WhG2TChGSVCjTkTUhThVhGTc&uu!z=%7B%22uueW%22%3A%22Gc8hGh8hcT8k%22%2C%22uuyy%22%3A%22q~%22%2C%22uuuy%22%3A%22p~%22%2C%22uuyjs%22%3A%22QER_fQoEj%20Rx%20xRe_%22%7D&ajx!uEy=h&sflct=8062825&ure=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/nmedianet.js?cid=8CUWMQE3H&ydspr=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

88.221.124.22 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

6c2c125dc2547c235be3c338f3ea61810b0f4331692b59c82389f463fa228483

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-encoding: gzip
content-length: 29197
content-type: text/html
date: Sun, 17 Dec 2023 14:25:45 GMT
expires: Sun, 17 Dec 2023 14:25:45 GMT
pragma: no-cache
strict-transport-security: max-age=31536000
timing-allow-origin: *
vary: Accept-Encoding
x-sc-h: 22-6vmg

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 96AF 16 KB
6 KB 29ms
27ms Document
text/html 88.221.124.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&ckdel=1&cs=2&cv=31&cid=8CUWMQE3H&https=1&itype=CM

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235981082/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

88.221.124.22 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a88-221-124-22.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

1ff431fe8ec11f34c7c0dc7a78163543975eaa19c08a09781eeff31fa00e6e99

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 5967
content-type: text/html; charset=UTF-8
date: Sun, 17 Dec 2023 14:25:44 GMT
expires: Tue, 19 Dec 2023 14:25:44 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H/1.1 200
OK bping.php
lg3.media.net/ Frame D395 35 B
338 B 84ms
23ms Image
image/gif 2.18.160.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?vgd_len=2202&&vgd_cdv=1130&vgd_cage=4&vgd_tsce=L350&vgd_mcf=76592&gdpr=1&mspa=0&prid=8PRVCXX19&cid=8CUWMQE3H&crid=151714331&vi=1702823144634393601&ugd=4&lf=6&kwrf=https%3A%2F%2Fwheregoes.com&cc=DE&sc=HE&lper=100&wsip=170785191&r=1702823144960&rrr=tzR-hLcl-L9HpPpS8JQBYlmc7rcOJo2T4yq724EUEvOgdk9WF_s35Wa7ILHVLfTc&requrl=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235981082%2F&vgde_bdata=QOfvzxjj~8xLjMjvf9~myJLEYv9.f~e8QMQOvHuF~LkMNz7vu~ONfvu~8Q7Yvf~G17v9%2C9%2C9~QNOvwJ~eM1Qzvi99i~ejfLMQOvf9fAufuh9h~8xLjMGvWffW.Hf~xLjM7UNv9~Q7OvGQ1olmzJMuFHuAuWXfii99oFMufAHXF~j1Q7v~Nemyv9.Xi~e8QMxLjMGv9.Ff~ejfLM8MQOvf9fAufuh9h~8Ev0V6%20c~kGGv9~e8QMxLjMjvf9~L88Ex1v9%2C9~J7vui~LNvu~Y78Ov0a9999uf~ejfLM8MGv9.9u~LEQMQOvf9fAufuXuF~e8QMGvXHH~xLjMGv9.uf~ejfLMxLjMGv9~ejfLMxLjMe8vu4ouF~xLjM7e8v9~xLjMjvf9~Qjev9~yN17vou~GGvuiF~eev9~NejfLMQOvHuh~Lkev9~jfLMGvu999~JLEYv9.9X~ejfLMxLjMUNv949~GYv9.fX~1AEMGvA.AH%2Cu9h.XF~Q8OvuXuhuHAAu~QOvou~x8OvffOXZw_6pBUuz6syw3~NejfLMGv9.Xi~G7OvA9hiiiu9HXHf9h9WXFhHiWXf9FAi9AWufiiuAffH9A9HWWi9huhiuHHAiiAXhAFFffhhXfFW9hfFXW9XH9AAWXiHHfiXWHf9ihHAWhf~eBxvou~OfEMjvu9~Nejfv9.Xi~AENkvu999~x8Yv9~eBMYJOv9.AA~OYYMQ7Lyvw1LYmz5~OfEMGv9.iW~myOfEMGv9.iF~exLjMGv9.fH~QQvuF99-uf99~NNvr4~x8Bvou~NJv9~LEQMGvu9h.XF~LNevAh.fi~exLjMjvf9~LEQMxLjMGvFf.WA~%3DVvA9Ff~UGMxNvof~z7Qvu~UGMNNUQvof~N7vkL1zUkxL7n1YnY18z~GQQMC_pvIK%2CIK~G1Q8QfvuiF~G1Q8QuvuiF~8QDJkv9~8exLjMGvH.uF~8Q8kv9~G8Ov9.9X~LEQMxLjMjvf9~ONvh~ejfLMGvA.AH~8exLjMjvf9~NGOEv9.9fF~QOvou~875EJM8OvA~QJjjJLM71yM8OvGQ1olmzJMuFHuAuWXfii99oFMufAHXF~QxEEj5M71yM8OvGQ1olmzJMuFHuAuWXfii99oFMufAHXF~EmQvA~LJkMNz7vu~N1LL8JLVOv9~myG8Ov9.9X9~GkjLv9.999~O7NvJxMGJ~OYYMJLEYvk1jQJ~OYYvw1LYmz5~GOEN1EOv9~O1jyvxz8QmzfF~QmGEv~w7Yjvu~ONx7vWX~OmyGv9ou~8GNvu~zQlvu~7yQvA99-F99~GQGv9~GQEv9~7Y-vfWi&ssld=%7B%22QQ8E%22%3A%22HX.uHu.uXf.9%22%2C%22QQNN%22%3A%22r4%22%2C%22QQQN%22%3A%22q4%22%2C%22QQN75%22%3A%22kL1zUkxL7n1YnY18z%22%7D&vgd_bid=348141&vgd_ydspr=1&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=9009&vgd_rakh=1702823144123107831&vgd_l1rhst=contextual.media.net&vgd_rpth=%2Fnmedianet.js&vgd_hb_audit_1=8CU18831I&vgd_hb_audit_2=742696110&vgd_pgid=p1492814678t202312171425&vgd_pgids=1&vgd_uspa=0&hvsid=00001702823144958007642542086904&gdpr=1&mspa=0&vgd_l2type=scs_newfl&vgd_end=1

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235981082/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2.18.160.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

server-18-154-63-95.dus51.r.cloudfront.net

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=21600
Date: Sun, 17 Dec 2023 14:25:45 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Sun, 17 Dec 2023 14:25:45 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 2B07 0
0 41ms
41ms Image
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202312060101&jk=4293649511312332&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 7A31 0
10 B 6ms
6ms Image
text/plain 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?bGCqWA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:45 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame 4E32 18 KB
8 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1702823144&bdh=dz4vF9Bu5gcyu_Dw1fSFXsVarzA.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2Fa42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&&id=18678115&size=728x90&cb=1922015542&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsuf3MGQJgYHBkAuwnNsLfOPIbZpJcWU1IQFWULOKYBWcMkQrDfx0EAEKFbq3XGQs_20zmNT01NmeN_i9fEICLQqt7PICB9V0IJjSyXkCn6uQvr3S68phLImkiL0zY9C9pai6ijXx8AjPkF12ZFRk1lofjcesuyeWz4TxmPJEtycJxtxDLeinKNQQFsL29NcwrjTsdUTQ_iphrOqRIuKWHlnPvPBPqzexA9grVj9n9MNK93zRvMrKahhCT_ZijbOgtKL5hNeAeE7ZP3hH4LL9Fme-uT5GogE4gP5m_y5YrxFwFroMXirHU1tbqF-0YOBiyd1riykV40jWxZBKjBzcGcVSzG2kFo6-15Rsg6WrA%2526sai%253DAMfl-YRRKCjMa89TsOZeVdDD3uLeKoKn7QqSMR0jwnuSDrNN0LCaAoPhSfglfw_xIuWf3X_Es9tOzd3EJXMR0vFl6_UZj1RUnMXUmkAtTzHcz7Zm_d2PJmUnfuYbMmw9xPkDSww3UxLWlDhIF_hfV5IA7oc%2526sig%253DCg0ArKJSzAf7glaRLQ_dEAE%2526fbs_aeid%253D%25255Bgw_fbsaeid%25255D%2526urlfix%253D1%2526adurl%253D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62cf47440cbf69b9d0a37c238c923e6544394913a5e5e615d017b1537aa06ec2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:00:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1503
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7823
x-xss-protection: 0
last-modified: Thu, 02 Nov 2023 23:04:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Sun, 17 Dec 2023 15:00:42 GMT

GET
H2 200 apn
beacon.sojern.com/imp/ Frame 4E32 42 B
199 B 91ms
18ms Image
image/gif 107.178.244.119
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.sojern.com/imp/apn?auc=8202293120251464771&cr=240772436&seg=&st=0&bp=0.00997&pp=0.00997&aaid=&idfa=&ord=768721279
Requested by: Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1702823144&bdh=dz4vF9Bu5gcyu_Dw1fSFXsVarzA.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2Fa42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&&id=18678115&size=728x90&cb=1922015542&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsuf3MGQJgYHBkAuwnNsLfOPIbZpJcWU1IQFWULOKYBWcMkQrDfx0EAEKFbq3XGQs_20zmNT01NmeN_i9fEICLQqt7PICB9V0IJjSyXkCn6uQvr3S68phLImkiL0zY9C9pai6ijXx8AjPkF12ZFRk1lofjcesuyeWz4TxmPJEtycJxtxDLeinKNQQFsL29NcwrjTsdUTQ_iphrOqRIuKWHlnPvPBPqzexA9grVj9n9MNK93zRvMrKahhCT_ZijbOgtKL5hNeAeE7ZP3hH4LL9Fme-uT5GogE4gP5m_y5YrxFwFroMXirHU1tbqF-0YOBiyd1riykV40jWxZBKjBzcGcVSzG2kFo6-15Rsg6WrA%2526sai%253DAMfl-YRRKCjMa89TsOZeVdDD3uLeKoKn7QqSMR0jwnuSDrNN0LCaAoPhSfglfw_xIuWf3X_Es9tOzd3EJXMR0vFl6_UZj1RUnMXUmkAtTzHcz7Zm_d2PJmUnfuYbMmw9xPkDSww3UxLWlDhIF_hfV5IA7oc%2526sig%253DCg0ArKJSzAf7glaRLQ_dEAE%2526fbs_aeid%253D%25255Bgw_fbsaeid%25255D%2526urlfix%253D1%2526adurl%253D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.178.244.119 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:45 GMT
via: 1.1 google
vary: Accept-Encoding
content-type: image/gif
access-control-allow-origin: *
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H2 200 ca Show response
choices.truste.com/ Frame 4E32 2 KB
2 KB 161ms
108ms Script
text/javascript 18.154.63.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://choices.truste.com/ca?pid=sojern01&aid=sojern02_d&cid=0&c=768721279&sz=728x90&js=st_dapp

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.154.63.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

3cef1864f3b4a587c446729a5ee0eb8ae906ec76154e956b797e467c653d0024

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 3e1c75dd4bc1e056caa1604e0e55ea30.cloudfront.net (CloudFront)
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop: DUS51-P4
cross-origin-embedder-policy: unsafe-none
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 918
x-xss-protection: 1; mode=block
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=31536000
x-frame-options: SAMEORIGIN
vary: Accept-Encoding, Origin
content-type: text/javascript;charset=UTF-8
cache-control: max-age=3600
permissions-policy: geolocation=(), microphone=(), payment=()
x-amz-cf-id: Pnn7LaS9QE-4Q6QyhQdwGiRs4emPL7yDOOsmGkW0ZCPefc3tTfJPGg==
expires: Sun, 17 Dec 2023 15:25:44 GMT

GET
H2 200 it
fra1-ib.adnxs.com/ Frame 4E32 0
645 B 23ms
7ms Image
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fra1-ib.adnxs.com/it?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QLeD_BM3gcAAAMA1gAFAQjoifyrBhDDmOCBqsSZ6nEYyp7f-amC1_tnKjYJ7GmHvyZrhD8ROeFvxQ_fez8ZAAAAQOF6xD8hOeFvxQ_fez8p7GkJJAAxCRuwhD8w44L0CDjKQUDqP0gCUNTK53JYmNVSYABokfdreIPYBYABAYoBA1VTRJIBAQbwQJgB2AWgAVqoAQGwAQC4AQLAAQXIAQLQAQDYAQDgAQDqAcYFaHR0cHMlM0ElMkYlMkZhZGNsaWNrLmcuZG91YmxlCQ4sbmV0JTJGcGNzJTJGBRIcJTI1M0Z4YWkBCPR1AURBS0FPanN1ZjNNR1FKZ1lIQmtBdXduTnNMZk9QSWJacEpjV1UxSVFGV1VMT0tZQldjTWtRckRmeDBFQUVLRmJxM1hHUXNfMjB6bU5UMDFObWVOX2k5ZkVJQ0xRcXQ3UElDQjlWMElKalN5WGtDbjZ1UXZyM1M2OHBoTElta2lMMHpZOUM5cGFpNmlqWHg4QWpQa0YxMlpGUmsxbG9mamNlc3V5ZVd6NFR4bVBKRXR5Y0p4dHhETGVpbktOUVFGc0wyOU5jd3JqVHNkVVRRX2lwaHJPcVJJdUtXSGxuUHZQQlBxemV4QTlnclZqOW45TU5LOTN6UnZNckthaGhDVF9aaWpiT2d0S0w1aE5lQWVFN1pQM2hINExMOUZtZS11VDVHb2dFNGdQNW1feTVZcnhGd0Zyb01YaXJIVTF0YnFGLTBZT0JpeWQxcml5a1Y0MGpXeFpCS2pCemNHY1ZTekcya0ZvNi0xNVJzZzZXckElMjUyNnNhLXv0NAFNZmwtWVJSS0NqTWE4OVRzT1plVmRERDN1TGVLb0tuN1FxU01SMGp3bnVTRHJOTjBMQ2FBb1BoU2ZnbGZ3X3hJdVdmM1hfRXM5dE96ZDNFSlhNUjB2Rmw2X1VaajFSVW5NWFVta0F0VHpIY3o3Wm1fZDJQSm1VbmZ1WWJNbXc5eFBrRFN3dzNVeExXbERoSUZfaGZWNUlBN29jJTI1MjZzaWclMjUzRENnMEFyS0pTekFmN2dsYVJMUV9kRUFFJTI1MjZmYnNfYWVpZCUyNTNEJTI1MjU1Qmd3X2Zic2FlaWQlMjUyNTVEJTI1MjZ1cmxmaXglMjUzRDElMjUyNmFkdXJsJTI1M0TwAQCKAlN1ZignYScsIDQ4MTk5MDUsIDApO3VmKCdpJywgNDgyNDk2OSwgMCkFFDxnJywgMTI3MzU3ODQsIDApBRUwcicsIDI0MDc3MjQzNgUW8IaSAokEITZWMjZoUWlBNmRRVkVOVEs1M0lZQUNDWTFWSXdBRGdBUUFCSTZqOVE0NEwwQ0ZnQVlESm9BSEFBZUFDQUFRQ0lBUUNRQVFHWUFRR2dBUUdvQVFHd0FRQzVBWTBoR2JJcmE0UV93UUdOSVJteUsydUVQOGtCQUFBQUFBQUE4RF9aQVENDXRQQV80QUdKdjZZQzlRRllXU004bUFJQW9BSUJ0UUkFJQB2DQjwVXdBSUF5QUlBMEFJQTJBSUE0QUlBNkFJQS1BSUFnQU1CbUFNQnVnTUpSbEpCTVRvMU16RXg0QU9kUllBRTZPX0ZCSWdFbVBqTEJKQUVBWmdFQWNFRUFBBWMUQUFBREpCAQcNARgyQVFBOFFRDQ4oQUFBSWdGdnltcEIRExRQQV9zUVUBGgkBOE1FRnVCNkY2MUc0ampfSgUoHElEM1JPVV8wLigACE5rRgkxwEFBOERfZ0JlVUg4QVdvcW9rRy1BWEJsNllDZ2dZRFZWTkVpQVlFa0FZQm1BWUFvUVkRNyxBQUtnR0JMSUdKQWsZFABCHcsEQmsZGABDHRgYTGdHQ29FSRmoMDgumgKVASFzeENLcGc2DQIkbU5WU0lBQW9BRB1BBERvMl0BEFFKMUZTPREAVREMDEFBQVcdDABZHQwAYR0MAGMdDBBlQUNKQREQNFBBX9gCAOACn_A_6gIWpdDw1zovL3doZXJlZ29lcy5jb20vgAMAiAMBkAMAmAMZoAMBqgMAwAPYBMgDANgDxdTyAeADAOgDAPgDAYAEAJIEBC90dGqYBACiBA00NS4xNDEuMTUyLjcyqAQAsgQMCAAQABgAIAAwADgAuAQAwAQAyAQA0gQOODE3MCNGUkExOjUzMTHaBAIIAeAEAPAE1MrncogFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBdn-O_oFBAgAEACQBgCYBgC4BgDBBgEhATEg0AboKdoGFgoQCREZAXQQABgA4AYB8gYCCACABwGIBwCgBwHIB4PYBdIHDQkRKAEmCNoHBgnKuOAHAOoHAggA8AeI3QOKCAIQAJUIAACAP5gIAcAIANIIDgiBgoSIkKDAgAEQABgA&s=d3e1104c426eba9782daa4649ec43d4cfc2c83e8

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:45 GMT
an-x-request-uuid: ed609a2a-c621-4821-b2e8-ccc14548a724
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 45.141.152.72; 45.141.152.72; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/240/ Frame 4E32 80 KB
28 KB 43ms
6ms Script
application/x-javascript 151.101.1.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/240/trk.js
Requested by: Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1702823144&bdh=dz4vF9Bu5gcyu_Dw1fSFXsVarzA.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2Fa42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&&id=18678115&size=728x90&cb=1922015542&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsuf3MGQJgYHBkAuwnNsLfOPIbZpJcWU1IQFWULOKYBWcMkQrDfx0EAEKFbq3XGQs_20zmNT01NmeN_i9fEICLQqt7PICB9V0IJjSyXkCn6uQvr3S68phLImkiL0zY9C9pai6ijXx8AjPkF12ZFRk1lofjcesuyeWz4TxmPJEtycJxtxDLeinKNQQFsL29NcwrjTsdUTQ_iphrOqRIuKWHlnPvPBPqzexA9grVj9n9MNK93zRvMrKahhCT_ZijbOgtKL5hNeAeE7ZP3hH4LL9Fme-uT5GogE4gP5m_y5YrxFwFroMXirHU1tbqF-0YOBiyd1riykV40jWxZBKjBzcGcVSzG2kFo6-15Rsg6WrA%2526sai%253DAMfl-YRRKCjMa89TsOZeVdDD3uLeKoKn7QqSMR0jwnuSDrNN0LCaAoPhSfglfw_xIuWf3X_Es9tOzd3EJXMR0vFl6_UZj1RUnMXUmkAtTzHcz7Zm_d2PJmUnfuYbMmw9xPkDSww3UxLWlDhIF_hfV5IA7oc%2526sig%253DCg0ArKJSzAf7glaRLQ_dEAE%2526fbs_aeid%253D%25255Bgw_fbsaeid%25255D%2526urlfix%253D1%2526adurl%253D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 519e50788224b3422c6e6b1cce48d5decb83eece248558b54e48f88491e48aa4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Expires: Thu, 14 Nov 2024 14:07:00 GMT
Date: Sun, 17 Dec 2023 14:25:45 GMT
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Age: 2765925
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 27680
X-Served-By: cache-lga21956-LGA, cache-fra-eddf8230052-FRA
Last-Modified: Wed, 15 Nov 2023 14:06:46 GMT
Server: AkamaiNetStorage
X-Timer: S1702823145.063393,VS0,VE0
ETag: "ccac3ab7f323b8743d099010fcce15a4:1700057206.383562"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000
Accept-Ranges: bytes
X-Cache-Hits: 7, 1891804

GET
H2 200 impl_v99.js Show response
www.googletagservices.com/dcm/ Frame 4E32 59 KB
23 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v99.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3df5746a25ab4dc32517df57deca8ecc5c425a2abd15c6d6f5fc817472e4d632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 23:25:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 486026
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23872
x-xss-protection: 0
last-modified: Thu, 02 Nov 2023 14:22:33 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 10 Dec 2024 23:25:19 GMT

GET
H2 200 B24268113.274990485;dc_ver=99.292;sz=728x90;u_sd=1;gdpr=0;aucid=8202293120251464771;crid=240772436;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24... Show response
ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/ Frame 4E32 80 KB
33 KB 80ms
54ms Script
text/javascript 172.217.16.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B24268113.274990485;dc_ver=99.292;sz=728x90;u_sd=1;gdpr=0;aucid=8202293120251464771;crid=240772436;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=153375241;ord=5fzjrv;click=https%3A%2F%2Ffra1-ib.adnxs.com%2Fclick2%3Fe%3DwqT_3QKYAfCBmAAAAAMAxBkFAQjoifyrBhDDmOCBqsSZ6nEYyp7f-amC1_tnIOOC9AgoykEw6j84AkDUyudySJjVUlAAWgNVU0RiA1VTRGjYBXBaeJH3a4ABg9gFiAEBkAECmAEFoAECqQHsaYe_JmuEP7EBOeFvxQ_fez-5AQAAAEDhesQ_wQE54QkUPMkB7GmHvyZrhD_YAQDgAQA.%2Fs%3Ddd1a6d54a993551ac66d62e991e6586ca9f92821%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521sxCKpgiA6dQVENTK53IYmNVSIAAoADEAAAAAAAAAADoJRlJBMTo1MzExQJ1FSQAAAAAAAPA_UQAAAAAAAAAAWQAAAAAAAAAAYQAAAAAAAAAAaQAAAAAAAAAAcQAAAAAAAAAAeACJAQAAAAAAAPA_%2Fcca%3DODE3MCNGUkExOjUzMTE%3D%2Fbn%3D93187%2Fclickenc%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Fpcs%252Fclick%25253Fxai%25253DAKAOjsuf3MGQJgYHBkAuwnNsLfOPIbZpJcWU1IQFWULOKYBWcMkQrDfx0EAEKFbq3XGQs_20zmNT01NmeN_i9fEICLQqt7PICB9V0IJjSyXkCn6uQvr3S68phLImkiL0zY9C9pai6ijXx8AjPkF12ZFRk1lofjcesuyeWz4TxmPJEtycJxtxDLeinKNQQFsL29NcwrjTsdUTQ_iphrOqRIuKWHlnPvPBPqzexA9grVj9n9MNK93zRvMrKahhCT_ZijbOgtKL5hNeAeE7ZP3hH4LL9Fme-uT5GogE4gP5m_y5YrxFwFroMXirHU1tbqF-0YOBiyd1riykV40jWxZBKjBzcGcVSzG2kFo6-15Rsg6WrA%252526sai%25253DAMfl-YRRKCjMa89TsOZeVdDD3uLeKoKn7QqSMR0jwnuSDrNN0LCaAoPhSfglfw_xIuWf3X_Es9tOzd3EJXMR0vFl6_UZj1RUnMXUmkAtTzHcz7Zm_d2PJmUnfuYbMmw9xPkDSww3UxLWlDhIF_hfV5IA7oc%252526sig%25253DCg0ArKJSzAf7glaRLQ_dEAE%252526fbs_aeid%25253D%2525255Bgw_fbsaeid%2525255D%252526urlfix%25253D1%252526adurl%25253D;uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.;dc_rfl=1,https%3A%2F%2Fwheregoes.com%2F$0;xdt=1;crlt=8CjMovXjAW;gcsr=m;stc=1;chaa=1;sttr=19;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v99.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s65-in-f6.1e100.net

Software

cafe /

Resource Hash

ac0ece1144531c289e28cfc55e8c2d5b17400ec30170d5c5690d8114bf011646

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33296
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 4E32 111 KB
39 KB 54ms
7ms Script
text/javascript 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235981082/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
Origin: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sat, 16 Dec 2023 20:46:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 63547
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 17 Dec 2023 20:46:38 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/ Frame 4E32 11 KB
4 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B24268113.274990485;dc_ver=99.292;sz=728x90;u_sd=1;gdpr=0;aucid=8202293120251464771;crid=240772436;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=153375241;ord=5fzjrv;click=https%3A%2F%2Ffra1-ib.adnxs.com%2Fclick2%3Fe%3DwqT_3QKYAfCBmAAAAAMAxBkFAQjoifyrBhDDmOCBqsSZ6nEYyp7f-amC1_tnIOOC9AgoykEw6j84AkDUyudySJjVUlAAWgNVU0RiA1VTRGjYBXBaeJH3a4ABg9gFiAEBkAECmAEFoAECqQHsaYe_JmuEP7EBOeFvxQ_fez-5AQAAAEDhesQ_wQE54QkUPMkB7GmHvyZrhD_YAQDgAQA.%2Fs%3Ddd1a6d54a993551ac66d62e991e6586ca9f92821%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521sxCKpgiA6dQVENTK53IYmNVSIAAoADEAAAAAAAAAADoJRlJBMTo1MzExQJ1FSQAAAAAAAPA_UQAAAAAAAAAAWQAAAAAAAAAAYQAAAAAAAAAAaQAAAAAAAAAAcQAAAAAAAAAAeACJAQAAAAAAAPA_%2Fcca%3DODE3MCNGUkExOjUzMTE%3D%2Fbn%3D93187%2Fclickenc%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Fpcs%252Fclick%25253Fxai%25253DAKAOjsuf3MGQJgYHBkAuwnNsLfOPIbZpJcWU1IQFWULOKYBWcMkQrDfx0EAEKFbq3XGQs_20zmNT01NmeN_i9fEICLQqt7PICB9V0IJjSyXkCn6uQvr3S68phLImkiL0zY9C9pai6ijXx8AjPkF12ZFRk1lofjcesuyeWz4TxmPJEtycJxtxDLeinKNQQFsL29NcwrjTsdUTQ_iphrOqRIuKWHlnPvPBPqzexA9grVj9n9MNK93zRvMrKahhCT_ZijbOgtKL5hNeAeE7ZP3hH4LL9Fme-uT5GogE4gP5m_y5YrxFwFroMXirHU1tbqF-0YOBiyd1riykV40jWxZBKjBzcGcVSzG2kFo6-15Rsg6WrA%252526sai%25253DAMfl-YRRKCjMa89TsOZeVdDD3uLeKoKn7QqSMR0jwnuSDrNN0LCaAoPhSfglfw_xIuWf3X_Es9tOzd3EJXMR0vFl6_UZj1RUnMXUmkAtTzHcz7Zm_d2PJmUnfuYbMmw9xPkDSww3UxLWlDhIF_hfV5IA7oc%252526sig%25253DCg0ArKJSzAf7glaRLQ_dEAE%252526fbs_aeid%25253D%2525255Bgw_fbsaeid%2525255D%252526urlfix%25253D1%252526adurl%25253D;uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.;dc_rfl=1,https%3A%2F%2Fwheregoes.com%2F$0;xdt=1;crlt=8CjMovXjAW;gcsr=m;stc=1;chaa=1;sttr=19;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

712bf11a3755c81fa1ce57249e7a61f6845b843b84aea09889a11478515234ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sat, 16 Dec 2023 23:43:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52909
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 14415875674906819925
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 30 Dec 2023 23:43:56 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 4E32 41 KB
14 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235981082/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 159637
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Dec 2024 18:05:08 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 0FC6 38 KB
13 KB 6ms
6ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 450738
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 12 Dec 2023 09:13:27 GMT
expires: Wed, 11 Dec 2024 09:13:27 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 0FC6 39 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sat, 16 Dec 2023 12:52:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 92010
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 15 Dec 2024 12:52:15 GMT

GET
H2 200 ca Show response
choices.trustarc.com/ Frame 4E32 20 KB
8 KB 173ms
120ms Script
text/javascript 18.239.50.7
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://choices.trustarc.com/ca?sz=728x90&c=768721279&cid=0&aid=sojern02_d&pid=sojern01&js=pmw0

Requested by

Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=sojern01&aid=sojern02_d&cid=0&c=768721279&sz=728x90&js=st_dapp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.239.50.7 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-154-63-95.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

9ebc99c46d4ca8b3e8ca729b0e15edf20b36896f5cdc40710cc44341e8052073

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 8428d3ca0a47cd247ba9c371c08ccb6a.cloudfront.net (CloudFront)
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop: AMS58-P3
cross-origin-embedder-policy: unsafe-none
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 7188
x-xss-protection: 1; mode=block
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=31536000
x-frame-options: SAMEORIGIN
vary: Accept-Encoding, Origin
content-type: text/javascript;charset=UTF-8
cache-control: max-age=3600
permissions-policy: geolocation=(), microphone=(), payment=()
x-amz-cf-id: 5glDcd4w0tTU-0ngfN6pD6N1M4BIglu0cQZN3nDHe5cGAxTUVEK21w==
expires: Sun, 17 Dec 2023 15:25:45 GMT

GET
H2 200 ca Show response
choices.truste.com/ Frame 4E32 28 KB
9 KB 106ms
106ms Script
text/javascript 18.154.63.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://choices.truste.com/ca?pid=sojern01&aid=sojern02&cid=24268113&js=st0

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.154.63.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e247deeaa1da02aab196a7373176a9097321bb8fd275d10d8bd1e8f16ee6b327

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 3e1c75dd4bc1e056caa1604e0e55ea30.cloudfront.net (CloudFront)
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop: DUS51-P4
cross-origin-embedder-policy: unsafe-none
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 8108
x-xss-protection: 1; mode=block
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=31536000
x-frame-options: SAMEORIGIN
vary: Accept-Encoding, Origin
content-type: text/javascript;charset=UTF-8
cache-control: max-age=3600
permissions-policy: geolocation=(), microphone=(), payment=()
x-amz-cf-id: 0zgtOPd9EZQP2SyzJnuvMXzxh5QG41lV5vom7rUKQgXqjmvQSDragg==
expires: Sun, 17 Dec 2023 15:25:45 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/8588827424145090394/ Frame 7610 25 KB
5 KB 21ms
7ms Document
text/html 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0e2d6c739ccd7c49ee6cdc208ec7c7b09c7eeddba0b8a4b2f77620db4371bc3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 448621
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5348
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 12 Dec 2023 09:48:44 GMT
expires: Wed, 11 Dec 2024 09:48:44 GMT
last-modified: Fri, 04 Sep 2020 11:31:19 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4E32 0
0 84ms
49ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst_O6ZAxsqfuEHniqL85EaICGUoJZviDbid_Rn6YgvdDfnVIAPBqjBdpvLVeZDuZmxzy05TakeJ3Q6UCd8HMWGsiLRZeS-5yD6zRl_sWuzh3lP8BLeOoey_vT0UePHL3lR285eNC8nUq8Yf66TuBHp1rkg8LijeKKsZJnI&sai=AMfl-YRnoiTsdHRjex-s41K_Ud4WR0pZTuRHZmqxyEcArFPw9b5qS9HxqhhsEF1VrBQ1bP-g_LZiJJnarzy1uhvSF3tWeLdYynyNVTX0hg&sig=Cg0ArKJSzHPyvj4oqLB3EAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=70&cbvp=1&cstd=68&cisv=r20231207.38986&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235981082/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:45 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 dcm
beacon.sojern.com/imp/ Frame 4E32 42 B
93 B 16ms
16ms Image
image/gif 107.178.244.119
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.sojern.com/imp/dcm?auc=8202293120251464771&io=${INSERTION_ORDER_ID}&li=${CAMPAIGN_ID}&cr=240772436&io=${INSERTION_ORDER_ID}&seg=${PIXEL_ID_COMMA}&src=${SOURCE_URL}&ord=%c
Requested by: Host: a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com
URL: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.178.244.119 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:45 GMT
via: 1.1 google
vary: Accept-Encoding
content-type: image/gif
access-control-allow-origin: *
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H2

200

px
secure.adnxs.com/ Frame 4E32
Redirect Chain

https://pixel.sojern.com/pixel/img/291730?p_v=1&f_v=v3_image&vid=hot
https://cm.g.doubleclick.net/pixel?google_cm=true&google_hm=wyoZ4YTgpXX85iujMsz1Cw&google_nid=sojern__adx_open_bidder_seat&sjrn_id=vWaKdnkdC2nQ4bhenEUJnn5hXo8ZSB2y7qVU_AFgtu0Qw5JfhVBWKLMziwZza_KE&s...
https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=vWaKdnkdC2nQ4bhenEUJnn5hXo8ZSB2y7qVU_AFgtu0Qw5JfhVBWKLMziwZza_KE&sjrn_r=aHR0cHM6Ly9zZWN1cmUuYWRueHMuY29tL3B4P2lkPTE1Mjg5NjEmdD0x&sjrn_...
https://secure.adnxs.com/px?id=1528961&t=1

0
756 B

10ms
7ms

Image
application/javascript

37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/px?id=1528961&t=1

Requested by

Host: a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com
URL: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

a88-221-124-22.deploy.static.akamaitechnologies.com

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:45 GMT
an-x-request-uuid: 0be04dc8-8629-4998-bfa8-e0e8690d07eb
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/javascript; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 45.141.152.72; 45.141.152.72; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

date: Sun, 17 Dec 2023 14:25:45 GMT
via: 1.1 google
vary: Accept-Encoding
content-type: image/gif
access-control-allow-origin: *
location: https://secure.adnxs.com/px?id=1528961&t=1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 4E32 0
0 44ms
43ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstNXZynpUueTU_XGE8yDbSgh4XCd9nKg_abeCOruWYCx-GHGojOTquqiIY8_SdyXHi2s7lsuoOlZVhYbuKY_wOy0qwDHA0zjvZQffiZ6oqqNo9CIEdHJkNlJNWdKDYw-jtSDhIvAp_f4UXwlOhenw9TX0cO2D7B3Ll31vPu93tASA8i-WZyu-pUK0703oPkqbpOD9Zwcc2QzaaLfO8JKiJPe4uuWplG2_RzY0t827RAZxrXiXZKSiQJgPPl5E6xmQmY1ImSW2nGfckTp7OrhqKISkLz6OJpYMppo-GTTapnjVC2q5sS74vgycO5TU93biR_MpmmtHnieRcRmPNrHyxytwt_zvwl4B68T7cRVO7-QPrr&sai=AMfl-YT6oAg7wpZLH9fveqUrVswHLQyHme9AV1wz8gXoPiAILZCdqymhgIjOwVEGjaSgT8x7-Ko3NCrEaxJZ5JY8TgVRgaHab71WP5tdQUlIxTJuUxQ56rbk0BQImtu6HDWwQb57JrT8L6jNFD8UgZWv6C0&sig=Cg0ArKJSzNayrTXxb0Y3EAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:45 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 17 Dec 2023 14:25:45 GMT

GET
H3 200 f3ffd6961064cc9d8a236f2629e980d6.js Show response
s0.2mdn.net/sadbundle/8588827424145090394/ Frame 7610 68 KB
17 KB 7ms
7ms Script
application/x-javascript 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/8588827424145090394/f3ffd6961064cc9d8a236f2629e980d6.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc1f63b96afe803f1eb405b63a97e8e53ee810d6e914e15e99eb932e8904f84b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Sun, 15 Dec 2024 06:05:48 GMT
date: Sat, 16 Dec 2023 06:05:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 116397
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17884
x-xss-protection: 0
last-modified: Fri, 04 Sep 2020 11:31:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 user_uploaded_helveticaneue_400_normal.ttf
s0.2mdn.net/sadbundle/8588827424145090394/fonts/ Frame 7610 39 KB
39 KB 7ms
7ms Font
application/octet-stream 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/8588827424145090394/fonts/user_uploaded_helveticaneue_400_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8588827424145090394/f3ffd6961064cc9d8a236f2629e980d6.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

898bc09bab4f20f00658ed9f8e961ef50395a945c19e9966f0ce7e53bd7a4ecf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 23:21:57 GMT
x-content-type-options: nosniff
age: 486228
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39656
x-xss-protection: 0
last-modified: Fri, 04 Sep 2020 11:31:19 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 10 Dec 2024 23:21:57 GMT

GET
H3 200 user_uploaded_tiempos_headline_600_normal.ttf
s0.2mdn.net/sadbundle/8588827424145090394/fonts/ Frame 7610 59 KB
59 KB 11ms
11ms Font
application/octet-stream 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/8588827424145090394/fonts/user_uploaded_tiempos_headline_600_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8588827424145090394/f3ffd6961064cc9d8a236f2629e980d6.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

91261588f1fbd83aea9c5d3f7f455c8600e730d463fc81e550095e33df1037ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 06:34:43 GMT
x-content-type-options: nosniff
age: 460262
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 59936
x-xss-protection: 0
last-modified: Fri, 04 Sep 2020 11:31:19 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 11 Dec 2024 06:34:43 GMT

GET
H3 200 user_uploaded_tiempos_headline_400_normal.ttf
s0.2mdn.net/sadbundle/8588827424145090394/fonts/ Frame 7610 58 KB
58 KB 19ms
17ms Font
application/octet-stream 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/8588827424145090394/fonts/user_uploaded_tiempos_headline_400_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8588827424145090394/f3ffd6961064cc9d8a236f2629e980d6.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

72ef1ed89fa935960325460606a16733dd5835de34c7bb2163ce31250dea46b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 19:03:50 GMT
x-content-type-options: nosniff
age: 501715
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 59312
x-xss-protection: 0
last-modified: Fri, 04 Sep 2020 11:31:19 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 10 Dec 2024 19:03:50 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 7610 6 KB
2 KB 42ms
16ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:800

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8588827424145090394/f3ffd6961064cc9d8a236f2629e980d6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

519bb2e3c63fcd0f9dcb9bd017f22e7f99643939432da4a0268ca5b799e7f051

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 17 Dec 2023 14:25:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 17 Dec 2023 13:14:38 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 17 Dec 2023 14:25:45 GMT

GET
H3 200 f6ece79fb74bfd89dc0215702e8dc531.svg
s0.2mdn.net/sadbundle/8588827424145090394/media/ Frame 7610 142 KB
107 KB 26ms
24ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/8588827424145090394/media/f6ece79fb74bfd89dc0215702e8dc531.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0a4d478b086f0e56e7c4cc14dba076c6d5986d9b6231af0360fb337b9eed8ffd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 09:48:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 448620
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 110034
x-xss-protection: 0
last-modified: Fri, 04 Sep 2020 11:31:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 11 Dec 2024 09:48:45 GMT

GET
H3 200 ce0927b4056ce6be8027f51306b98d8e.svg
s0.2mdn.net/sadbundle/8588827424145090394/media/ Frame 7610 142 KB
107 KB 30ms
28ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/8588827424145090394/media/ce0927b4056ce6be8027f51306b98d8e.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9ef60d2c3809d2d9a137e77813e48401ec160d79c631363a105e1659d198d47e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 09:48:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 448620
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 110034
x-xss-protection: 0
last-modified: Fri, 04 Sep 2020 11:31:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 11 Dec 2024 09:48:45 GMT

GET
H3 200 6be509e571ab040de7a204fbae60cc2e.png
s0.2mdn.net/sadbundle/8588827424145090394/media/ Frame 7610 10 KB
10 KB 33ms
30ms Image
image/png 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/8588827424145090394/media/6be509e571ab040de7a204fbae60cc2e.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3a3a14f10f4ad5f40000c5b7d46e52f707fda76cac5888a5f9a5ca9e0399bb37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Sun, 15 Dec 2024 06:05:49 GMT
date: Sat, 16 Dec 2023 06:05:49 GMT
x-content-type-options: nosniff
age: 116396
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9850
x-xss-protection: 0
last-modified: Fri, 04 Sep 2020 11:31:19 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 30d2c6af12a2006fbd5feb4042ccc113.svg
s0.2mdn.net/sadbundle/8588827424145090394/media/ Frame 7610 8 KB
4 KB 34ms
32ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/8588827424145090394/media/30d2c6af12a2006fbd5feb4042ccc113.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

98b26f57b6bf1af380371c9eab9bcc28aeb80067ab75b7d377112a3541601cb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 19:03:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 501715
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3866
x-xss-protection: 0
last-modified: Fri, 04 Sep 2020 11:31:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 10 Dec 2024 19:03:50 GMT

GET
H3 200 671e59ac036095bf0007a0c6c05b5fb0.svg
s0.2mdn.net/sadbundle/8588827424145090394/media/ Frame 7610 375 B
302 B 33ms
31ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/8588827424145090394/media/671e59ac036095bf0007a0c6c05b5fb0.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7fe445ceb0bb3e18ff8b7529e7fb2162841ad4779a20c7a1c3fb40c009ee3f5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 14 Dec 2023 02:10:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 303338
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 273
x-xss-protection: 0
last-modified: Fri, 04 Sep 2020 11:31:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 13 Dec 2024 02:10:07 GMT

GET
H3 200 6cfe5c4b5d206a4a132ff349bee72773.svg
s0.2mdn.net/sadbundle/8588827424145090394/media/ Frame 7610 142 KB
108 KB 24ms
22ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/8588827424145090394/media/6cfe5c4b5d206a4a132ff349bee72773.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb918778a1875f0799b8ef38b9ffacd0ccbbd7bd22f209b969626d20bc5cb7c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 09:48:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 448620
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 110049
x-xss-protection: 0
last-modified: Fri, 04 Sep 2020 11:31:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 11 Dec 2024 09:48:45 GMT

GET
H3 200 6846862347d31849d874cdf5751c2f4e.svg
s0.2mdn.net/sadbundle/8588827424145090394/media/ Frame 7610 143 KB
108 KB 49ms
48ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/8588827424145090394/media/6846862347d31849d874cdf5751c2f4e.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e1a1bb879310733f5ca41aad5ee3b3deeff20a424247c748e5b63758fe7bb26

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Sat, 14 Dec 2024 18:08:17 GMT
date: Fri, 15 Dec 2023 18:08:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 159448
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 110757
x-xss-protection: 0
last-modified: Fri, 04 Sep 2020 11:31:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 af765b3bf4781e76eb5d577b4a66e1f4.svg
s0.2mdn.net/sadbundle/8588827424145090394/media/ Frame 7610 141 KB
107 KB 46ms
45ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/8588827424145090394/media/af765b3bf4781e76eb5d577b4a66e1f4.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e0a3544d67e1afd5ea175fb383e72575212c3f0704484bfa1daa7e8548b463d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 06:34:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 460261
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 109674
x-xss-protection: 0
last-modified: Fri, 04 Sep 2020 11:31:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 11 Dec 2024 06:34:44 GMT

GET
H3 200 c708b98d792926ed7ea3c0bf55d78450.svg
s0.2mdn.net/sadbundle/8588827424145090394/media/ Frame 7610 141 KB
107 KB 45ms
43ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/8588827424145090394/media/c708b98d792926ed7ea3c0bf55d78450.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8eb1fe5a3ce0dc3eaf82b859a0d9832e6fe8396b43e763fb9c3389392e574cb6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 07:19:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 457550
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 109695
x-xss-protection: 0
last-modified: Fri, 04 Sep 2020 11:31:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 11 Dec 2024 07:19:55 GMT

GET
H3 200 fa9a111f9ce3feb2335b6a8f16dde572.svg
s0.2mdn.net/sadbundle/8588827424145090394/media/ Frame 7610 141 KB
107 KB 47ms
46ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/8588827424145090394/media/fa9a111f9ce3feb2335b6a8f16dde572.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e1c20b9a9a20d75c0a71bfff7c2efa9ecd86157f27a7d2cafe5e72154566d934

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Thu, 12 Dec 2024 18:04:32 GMT
date: Wed, 13 Dec 2023 18:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 332473
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 109695
x-xss-protection: 0
last-modified: Fri, 04 Sep 2020 11:31:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 2365c3969f6c19372e360a6ffffd3bac.svg
s0.2mdn.net/sadbundle/8588827424145090394/media/ Frame 7610 141 KB
107 KB 41ms
40ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/8588827424145090394/media/2365c3969f6c19372e360a6ffffd3bac.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c2e5175b9ac03ef9ed2dffccfe2679726ad772472919cc784025bd78da6ae89b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 06:46:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 459560
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 109674
x-xss-protection: 0
last-modified: Fri, 04 Sep 2020 11:31:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 11 Dec 2024 06:46:25 GMT

GET
H3 200 6818a3e83af973b075bdb2e221c988b5.svg
s0.2mdn.net/sadbundle/8588827424145090394/media/ Frame 7610 141 KB
107 KB 43ms
41ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/8588827424145090394/media/6818a3e83af973b075bdb2e221c988b5.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2d704809fde7175dc7b707b26f38047ce38cdb706122a7e01444003f059aa926

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 09:48:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 448620
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 109695
x-xss-protection: 0
last-modified: Fri, 04 Sep 2020 11:31:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 11 Dec 2024 09:48:45 GMT

GET
H3 200 c7db25a2642b18080a68fbec0c1bf974.svg
s0.2mdn.net/sadbundle/8588827424145090394/media/ Frame 7610 141 KB
107 KB 34ms
33ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/8588827424145090394/media/c7db25a2642b18080a68fbec0c1bf974.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

675c01706ffffbba4e4fcc055f0734337617b3cff1334fa65d15b4929d330dc0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 17:12:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 508414
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 109695
x-xss-protection: 0
last-modified: Fri, 04 Sep 2020 11:31:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 10 Dec 2024 17:12:11 GMT

GET
H3 200 5a4be28456ed3bb0782e4370e8ca5330.svg
s0.2mdn.net/sadbundle/8588827424145090394/media/ Frame 7610 141 KB
107 KB 38ms
36ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/8588827424145090394/media/5a4be28456ed3bb0782e4370e8ca5330.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

029464555a67d8f2319a9e44ab31060735388cbd297f4e22dcd2fd0d482eb1f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 03:31:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 471255
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 109695
x-xss-protection: 0
last-modified: Fri, 04 Sep 2020 11:31:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 11 Dec 2024 03:31:30 GMT

GET
H3 200 b3fdcfc79a7a9225aa8c8c5f8ff7afc1.svg
s0.2mdn.net/sadbundle/8588827424145090394/media/ Frame 7610 141 KB
107 KB 50ms
49ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/8588827424145090394/media/b3fdcfc79a7a9225aa8c8c5f8ff7afc1.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2d8bf7588c46e8418d0c86a972a7c52823993766c3901adfc816bcef0cb9fdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 06:34:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 460261
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 109673
x-xss-protection: 0
last-modified: Fri, 04 Sep 2020 11:31:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 11 Dec 2024 06:34:44 GMT

GET
H3 200 f69d99aeba9fed4976a79239e903a4ca.svg
s0.2mdn.net/sadbundle/8588827424145090394/media/ Frame 7610 142 KB
108 KB 36ms
35ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/8588827424145090394/media/f69d99aeba9fed4976a79239e903a4ca.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

07599dbdf5958e8e46847ab2216f835b1f939cb23493f83376c504f426fda6ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8588827424145090394/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 23:21:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 486227
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 110042
x-xss-protection: 0
last-modified: Fri, 04 Sep 2020 11:31:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 10 Dec 2024 23:21:58 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0FC6 0
20 B 48ms
46ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=Bc9B_6QR_ZcH-BemcjuwPieGosAwAAAAAOAHgBAI&bg=!7-yl7KPNAAY3kmNgF5I7ADQBe5WfOJpwxNmpivhBHnDduSdlkUihCL_KV1ya090gNnINZ99iAPRQNx7ZX1SxCP6qsYAyAgAAAFZSAAAAAWgBBwoAUISpirc1G0voWT3e9o7D8QUoCHWL3_xK--V3oc6epDAu7DEiCZZaTkkrNCG76SFUwGg2po4El_Ts17NLptTLlGGio3TrK2q8-thAbGn6-As6mQM_027e-bU_uMiWZN9E5LgzjgLPGrLHUT7YCuOQtn-cI-7AfEBr64x3s4VnFlq2Ksg5eYoHaA3TFByjbWmmc9xQy88E5oUA7Km8xWct6p9uDbhYCkafsEv7JGJivsNAWowgTeFr8gjDfOtVPY3Zk7YyQrYkWhgPdLvEnHVpDMe47sdx4c27VKgxYiWGL74dpFcKB9Gp78QwikPGFzGotb7clVJW86RP645UWwgt0vclO18DcHGSnbiUTEocsHnBSI5YSbON3R6EdCy7Ye3nyDFaMuSIHOOZVMoK33DTkT4QJmZRHoomLiLbP95hnxos1EIZhrR_secSpyqQ90sXPJy056abV8iIiG3f9A2KnX4ohJqqEBSfHDQuo2zT6vDsY1lFHDNi29YdBT2P-cCNSuo_AGgSIh0xrlluzab9_tVUbmfiG_i_JSyeKL8UqPIAFiLp0DSql7Yrh6Jzp8mXgGoGDyzF8MnflueofZuB1bpjYKWb6sIaux07ezpujlnnATCOV5u5Pdw4t2gPcIhusG0NEG3JcyyiaCG0YoE7GTQs-B_61-6ia0dueO14QAPzRMHbXK-LwwbpBowd1CdxepZCAudehhmHN4jjh6AoS50dLCjYlTETYHZ82zPddcRujGdoVXIqZXwOW29i-Lm5nIAbgDEOgMWjZnFXH37TdH-SwVIqSvQpuDLYTWswqYz9ki7ImqOkoTbkXV7c5oPsV2vh6D12c8qbXgn595aq-dcHX0kdS6tLQQpuEHCQ6FSuEa71otB6ket472C9JjBaszIPdO4SVw9WkUOC6uXBY3oojU7BSquwXUmsl9kJb75qivAQQsMBbyax07rSPlO2JHd4SCPzKH8ljcb9Ipjs64pURd1DEhrexw0WoguT0e9NXHywLQJX4kRh9kDpVm2edkvSUEA4XwSRqIDkVSZScbjJFnhx_v-336TvP_PcTlOSNUOJfhIIzC4MLDE20-lxdNbUC_G84-v-M6AYy0QMiEcyxSLkfELn9G_3Ntv9fgxZCwXV50X8fQ6etD7VmRL9S83E5o5QUaV3vwlv6AHCreQ6lVcPXWf-cByCgYWdX0paoNnY-Yr67unRCeZZYqc4R8Da

Requested by

Host: a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com
URL: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame D336 107 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dfa1028a74436c56e0ee1367812c0ee599d6814ec4a3079ca9b9afffba949e26

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame D336 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame D336 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 Roboto-Bold.woff
contextual.media.net/__media__/fonts/Roboto-Bold/ Frame D336 24 KB
24 KB 36ms
32ms Font
font/woff 88.221.124.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/__media__/fonts/Roboto-Bold/Roboto-Bold.woff

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=2428&&kkdd=*h%7CW%7C9uA3Hh*n&Ke=hVkTCTUhGGSUGU2USkh&mzWE=h&xuWR=k&yzK=hhUk&juyX=-Uck&yez=Ci5bLY~Up&yWyz=L)6dS)bg*TU(g2zVH1z)Um%3D%3D&yEez=hchVhGUUh&uenX=Ukk*Skk&yy=q~&uy=p~&ya_x=pPIL3Or&Wez=C03i-2hS-&jWez=F0S7T5S&ajjWu=h&EEE=jnIDa-y!D-2pW0WJC.Y(r!xyVEy3.HTFGs6VTG~5~K3mzf2bgMuUcbRV)-pw-QFy&fvEQ=ajjWu%3A%2F%2FvaXEXmHXu8yHx&XfvEQ=vVV~Y%3AJJ(v.-.sx.Y8Oxr&_uX=c&!v=h&omz=G&Rzjh=Ci5hCCUh)&RzjT=VGTS2Shhk&BzRjR=uzT%3D_o!!ZeoE!M!%3DTkZHmXEWx%3Dk8TZKeuMuz%3DGhSZEQMy_j%3DhZzyT%3DhZeujx%3DTZBRj%3Dk%2Ck%2CkZuyz%3DaXZKMRu_%3D2kk2ZK!TEMuz%3DTkTUhThVkVZeoE!MB%3DCTTC8GTZoE!Mjfy%3DkZujz%3DBuRDnH_XMhSGhUhCcT22kkDSMhTUGcSZ!Ruj%3DZyKHm%3Dk8c2ZKeuMoE!MB%3Dk8STZK!TEMeMuz%3DTkTUhThVkVZeW%3D0).6LZQBB%3DkZKeuMoE!M!%3DTkZEeeWoR%3Dk%2CkZXj%3Dh2ZEy%3DhZxjez%3D03kkkkhTZK!TEMeMB%3Dk8khZEWuMuz%3DTkTUhThchSZKeuMB%3DcGGZoE!MB%3Dk8hTZK!TEMoE!MB%3DkZK!TEMoE!MKe%3Dh~DhSZoE!MjKe%3DkZoE!M!%3DTkZu!K%3DkZmyRj%3DDhZBB%3Dh2SZKK%3DkZyK!TEMuz%3DGhVZEQK%3DkZ!TEMB%3DhkkkZXEWx%3Dk8kcZK!TEMoE!Mfy%3Dk~kZBx%3Dk8TcZRUWMB%3DU8UG%2ChkV8cSZuez%3DhchVhGUUhZuz%3DDhZoez%3DTTzc7aF.bvfh_.gmarZyK!TEMB%3Dk8c2ZBjz%3DUkV222hkGcGTkVkCcSVG2CcTkSU2kUChT22hUTTGkUkGCC2kVhV2hGGU22UcVUSSTTVVcTSCkVTScCkcGkUUCc2GGT2cCGTk2VGUCVTZKvo%3DDhZzTWM!%3DhkZyK!T%3Dk8c2ZUWyQ%3DhkkkZoex%3DkZKvMxXz%3Dk8UUZzxxMujEm%3DaRExH_sZzTWMB%3Dk82CZHmzTWMB%3Dk82SZKoE!MB%3Dk8TGZuu%3DhSkk*hTkkZyy%3Dq~Zoev%3DDhZyX%3DkZEWuMB%3DhkV8cSZEyK%3DUV8T2ZKoE!M!%3DTkZEWuMoE!MB%3DST8CUZi)%3DUkSTZfBMoy%3DDTZ_ju%3DhZfBMyyfu%3DDTZyj%3DQER_fQoEj%20Rx%20xRe_ZBuuMAFb%3DOP%2COPZBRueuT%3Dh2SZBRueuh%3Dh2SZeuIXQ%3DkZeKoE!MB%3DG8hSZeueQ%3DkZBez%3Dk8kcZEWuMoE!M!%3DTkZzy%3DVZK!TEMB%3DU8UGZeKoE!M!%3DTkZyBzW%3Dk8kTSZuz%3DDhZejsWXMez%3DUZuX!!XEMjRmMez%3DBuRDnH_XMhSGhUhCcT22kkDSMhTUGcSZuoWW!sMjRmMez%3DBuRDnH_XMhSGhUhCcT22kkDSMhTUGcSZWHu%3DUZEXQMy_j%3DhZyREEeXE)z%3DkZHmBez%3Dk8kckZBQ!E%3Dk8kkkZzjy%3DXoMBXZzxxMXEWx%3DQR!uXZzxx%3DaRExH_sZBzWyRWz%3DkZzR!m%3Do_euH_TSZuHBW%3DZajx!%3DhZzyoj%3DCcZzHmB%3DkDhZeBy%3DhZ_un%3DhZjmu%3DUkk*SkkZBuB%3DkZBuW%3DkZjx*%3DTC2&_jK=k&xxx=olHuOQ)q6~f%3D&ev=Ukk&e_)QE=h&BzE)z=Gc2&Bez=UGChGh&fjj!X=FERyX%20IXuo!ju%20%7C%20baXEX7HXu&xyQ=VSc2T&szuWE=h&BRX=(*Xm6m%2F*OO&fRjWEX=h&fRjBez=DhkU&yRzHxRe_=jnIDa-y!D-CAj3-G.1HeiAaCjyUPWnoUWwCeWkXG0n~%3D&sW!W=h&euez=c&Wmez=WhG2TChGSVCjTkTUhThVhGTc&uu!z=%7B%22uueW%22%3A%22Gc8hGh8hcT8k%22%2C%22uuyy%22%3A%22q~%22%2C%22uuuy%22%3A%22p~%22%2C%22uuyjs%22%3A%22QER_fQoEj%20Rx%20xRe_%22%7D&ajx!uEy=h&sflct=8062825&ure=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

88.221.124.22 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

c8a7ea184c79a6f61c400968314d03aae7c327f03efc03603f6a3cbada7bfb9a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=2428&&kkdd=*h%7CW%7C9uA3Hh*n&Ke=hVkTCTUhGGSUGU2USkh&mzWE=h&xuWR=k&yzK=hhUk&juyX=-Uck&yez=Ci5bLY~Up&yWyz=L)6dS)bg*TU(g2zVH1z)Um%3D%3D&yEez=hchVhGUUh&uenX=Ukk*Skk&yy=q~&uy=p~&ya_x=pPIL3Or&Wez=C03i-2hS-&jWez=F0S7T5S&ajjWu=h&EEE=jnIDa-y!D-2pW0WJC.Y(r!xyVEy3.HTFGs6VTG~5~K3mzf2bgMuUcbRV)-pw-QFy&fvEQ=ajjWu%3A%2F%2FvaXEXmHXu8yHx&XfvEQ=vVV~Y%3AJJ(v.-.sx.Y8Oxr&_uX=c&!v=h&omz=G&Rzjh=Ci5hCCUh)&RzjT=VGTS2Shhk&BzRjR=uzT%3D_o!!ZeoE!M!%3DTkZHmXEWx%3Dk8TZKeuMuz%3DGhSZEQMy_j%3DhZzyT%3DhZeujx%3DTZBRj%3Dk%2Ck%2CkZuyz%3DaXZKMRu_%3D2kk2ZK!TEMuz%3DTkTUhThVkVZeoE!MB%3DCTTC8GTZoE!Mjfy%3DkZujz%3DBuRDnH_XMhSGhUhCcT22kkDSMhTUGcSZ!Ruj%3DZyKHm%3Dk8c2ZKeuMoE!MB%3Dk8STZK!TEMeMuz%3DTkTUhThVkVZeW%3D0).6LZQBB%3DkZKeuMoE!M!%3DTkZEeeWoR%3Dk%2CkZXj%3Dh2ZEy%3DhZxjez%3D03kkkkhTZK!TEMeMB%3Dk8khZEWuMuz%3DTkTUhThchSZKeuMB%3DcGGZoE!MB%3Dk8hTZK!TEMoE!MB%3DkZK!TEMoE!MKe%3Dh~DhSZoE!MjKe%3DkZoE!M!%3DTkZu!K%3DkZmyRj%3DDhZBB%3Dh2SZKK%3DkZyK!TEMuz%3DGhVZEQK%3DkZ!TEMB%3DhkkkZXEWx%3Dk8kcZK!TEMoE!Mfy%3Dk~kZBx%3Dk8TcZRUWMB%3DU8UG%2ChkV8cSZuez%3DhchVhGUUhZuz%3DDhZoez%3DTTzc7aF.bvfh_.gmarZyK!TEMB%3Dk8c2ZBjz%3DUkV222hkGcGTkVkCcSVG2CcTkSU2kUChT22hUTTGkUkGCC2kVhV2hGGU22UcVUSSTTVVcTSCkVTScCkcGkUUCc2GGT2cCGTk2VGUCVTZKvo%3DDhZzTWM!%3DhkZyK!T%3Dk8c2ZUWyQ%3DhkkkZoex%3DkZKvMxXz%3Dk8UUZzxxMujEm%3DaRExH_sZzTWMB%3Dk82CZHmzTWMB%3Dk82SZKoE!MB%3Dk8TGZuu%3DhSkk*hTkkZyy%3Dq~Zoev%3DDhZyX%3DkZEWuMB%3DhkV8cSZEyK%3DUV8T2ZKoE!M!%3DTkZEWuMoE!MB%3DST8CUZi)%3DUkSTZfBMoy%3DDTZ_ju%3DhZfBMyyfu%3DDTZyj%3DQER_fQoEj%20Rx%20xRe_ZBuuMAFb%3DOP%2COPZBRueuT%3Dh2SZBRueuh%3Dh2SZeuIXQ%3DkZeKoE!MB%3DG8hSZeueQ%3DkZBez%3Dk8kcZEWuMoE!M!%3DTkZzy%3DVZK!TEMB%3DU8UGZeKoE!M!%3DTkZyBzW%3Dk8kTSZuz%3DDhZejsWXMez%3DUZuX!!XEMjRmMez%3DBuRDnH_XMhSGhUhCcT22kkDSMhTUGcSZuoWW!sMjRmMez%3DBuRDnH_XMhSGhUhCcT22kkDSMhTUGcSZWHu%3DUZEXQMy_j%3DhZyREEeXE)z%3DkZHmBez%3Dk8kckZBQ!E%3Dk8kkkZzjy%3DXoMBXZzxxMXEWx%3DQR!uXZzxx%3DaRExH_sZBzWyRWz%3DkZzR!m%3Do_euH_TSZuHBW%3DZajx!%3DhZzyoj%3DCcZzHmB%3DkDhZeBy%3DhZ_un%3DhZjmu%3DUkk*SkkZBuB%3DkZBuW%3DkZjx*%3DTC2&_jK=k&xxx=olHuOQ)q6~f%3D&ev=Ukk&e_)QE=h&BzE)z=Gc2&Bez=UGChGh&fjj!X=FERyX%20IXuo!ju%20%7C%20baXEX7HXu&xyQ=VSc2T&szuWE=h&BRX=(*Xm6m%2F*OO&fRjWEX=h&fRjBez=DhkU&yRzHxRe_=jnIDa-y!D-CAj3-G.1HeiAaCjyUPWnoUWwCeWkXG0n~%3D&sW!W=h&euez=c&Wmez=WhG2TChGSVCjTkTUhThVhGTc&uu!z=%7B%22uueW%22%3A%22Gc8hGh8hcT8k%22%2C%22uuyy%22%3A%22q~%22%2C%22uuuy%22%3A%22p~%22%2C%22uuyjs%22%3A%22QER_fQoEj%20Rx%20xRe_%22%7D&ajx!uEy=h&sflct=8062825&ure=1
Origin: https://contextual.media.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:45 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 16 May 2016 10:39:41 GMT
server: Apache
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 24816
expires: Mon, 18 Dec 2023 14:25:45 GMT

GET
H/1.1 200
OK bql.php Show response
lg3.media.net/ Frame D336 15 B
348 B 48ms
47ms Script
text/javascript 2.18.160.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?vgd_len=6507&&vgd_canary=0&vgd_l2type=scs_newfl&fp=W0cfseha3aKdfMTCv5h_5RiDYZFYrWuEb5pxDp4Ed4m5t_Bhu1OtplzADGZvp1ZWD5QLbEBVjm5ZOsVS2fk7-FjYdDo8q7x2BhN0g5pAWiZpWs9DbLs4PqGHCtWQP5PPHiak1pf9hO1oqoc_837sPg%3D%3D&cme=xKE810Wamzqc9ifoDTd1phnR1tYGSKvKiBLi5GcQpqYGUT9iwQ8aaFSPxv5WYsWcIdVKOPrlVIitgSk0SmrOFvo1h_X3NQkL0maP5W6ly18CPbcK2ug7m4C6HOzeFkR9MP2_y0BVjnG-vveHLBXl0nDWul4rxqM30AFxj9BQLYb-ZxLlqEB1tGXhFmd-ls2kSrCgApdcQsuzaMLLZkeaWpKIvNjJsLEG0x6kF28S30i5oObJmUrLQw%3D%3D%7C%7Cu8A6SM53vAd1h_O4ROJtLwq5PaKyqUuh%7CAas3KeVaKZSzW26uwmJe1jxeavT7bWHv%7CdsA6EMpZ47R6ljdz__nQtthZoUpm2bb5%7Ca0AmFUYXmD4xoVDcMCSohdoT-YwCWNAerAHD6uEMv1LF8UyA07qxfryBbT6jJIVbr8hbea85a4o%3D%7Cxrl5Md8q4-8glDlbUPMSt3FeMVWn2h2mj7Xw_c-0vKM%3D%7CcPcb3VhU0BVjXgWFWEAzinttU1oq1ouO%7CbTLO0p8x3zSE5MMoOWfDb6IAVYz-2JoqdYZC011hje5lDcwlZvyClfEfG4jL9ZAn-kyasrZJrLtSHP5OUrKtK8KBwM1-nQsQwKv0gti8DVt7P4HV2gjnRBTO8mQWlV29Gi4iksoyoiKvV82oUlQOIKt7NFRgXC4I_NEkZ7bsqXUoD0w0XxvM5eb58ovfquv9BJCU_y7Xub7TYvubvFjB0DokHM6nuo6bTnhiWj7S2fJG876VH7kAF9GASoBwY3tHrR9PhhTsBR0_CYzCkCRmsXk-9SwTSZzM2xa4X-Dfyi8%3D%7C&subBdr=196&bdrid=459&ksu=243&fdkt=391&vgde_kbbh=ffoyxQJuO&kwd[]=Kurze+Kleider+f%C3%BCr+Damen&kwt[]=391&kbc[]=1300920941&kwp[]=1&kid[]=326742187&kbc2[]=pmb%3D1%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0001%7C8%3D121705%7C13%3D0.0671%7C14%3D121710%7Cokt%3D391%7Cbdkt%3D391%7Cps%3D0.382%7C1%3D0.38%7C2%3D1.07&ktd[]=4503874522251520&kwd[]=Zahnimplantate+f%C3%BCr+Senioren&kwt[]=391&kbc[]=1300920941&kwp[]=2&kid[]=329545200&kbc2[]=pmb%3D1%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0001%7C8%3D121705%7C13%3D0.0547%7C14%3D121710%7Cokt%3D391%7Cbdkt%3D391%7Cps%3D0.382%7C1%3D0.67%7C2%3D1.64&ktd[]=4503874522251520&kwd[]=Lebensmittel+die+Fett+verbrennen&kwt[]=391&kbc[]=1300920941&kwp[]=3&kid[]=329459844&kbc2[]=pmb%3D1%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0000%7C8%3D121705%7C13%3D0.0984%7C14%3D121710%7Cokt%3D391%7Cbdkt%3D391%7Cps%3D0.382%7C1%3D1.39%7C2%3D4.25&ktd[]=274894881024&kwd[]=Top+10+Kreditkarten&kwt[]=391&kbc[]=1300920941&kwp[]=4&kid[]=326438072&kbc2[]=pmb%3D1%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0001%7C8%3D121705%7C13%3D0.0601%7C14%3D121710%7Cokt%3D391%7Cbdkt%3D391%7Cps%3D0.382%7C1%3D2.00%7C2%3D4.66&ktd[]=274894881024&kwd[]=Die+7+besten+Dividendenaktien&kwt[]=391&kbc[]=1300920941&kwp[]=5&kid[]=329545178&kbc2[]=pmb%3D1%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0000%7C8%3D121705%7C13%3D0.1055%7C14%3D121710%7Cokt%3D391%7Cbdkt%3D391%7Cps%3D0.382%7C1%3D2.12%7C2%3D6.87&ktd[]=274894881024&kwd[]=Die+besten+Nebenjobs+von+Zuhause&kwt[]=391&kbc[]=1300920941&kwp[]=6&kid[]=350764522&kbc2[]=pmb%3D1%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0000%7C8%3D121705%7C13%3D0.1051%7C14%3D121710%7Cokt%3D391%7Cbdkt%3D391%7Cps%3D0.382%7C1%3D1.15%7C2%3D2.66&ktd[]=4503874522251520&kwd[]=Ausgefallene+M%C3%A4nnergeschenke&kwt[]=391&kbc[]=1300920941&kwp[]=7&kid[]=350738829&kbc2[]=pmb%3D1%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0001%7C8%3D121705%7C13%3D0.0547%7C14%3D121710%7Cokt%3D391%7Cbdkt%3D391%7Cps%3D0.382%7C1%3D0.84%7C2%3D2.07&ktd[]=274894881024&kwd[]=Schnelle+Low+Carb-Rezepte&kwt[]=391&kbc[]=1300920941&kwp[]=8&kid[]=326736717&kbc2[]=pmb%3D1%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0001%7C8%3D121705%7C13%3D0.0498%7C14%3D121710%7Cokt%3D391%7Cbdkt%3D391%7Cps%3D0.382%7C1%3D0.29%7C2%3D1.54&ktd[]=4503874522251520&v=1&gdpr=1&geo=48.24%7C12.51&dlper=20&lper=100&lpid=&tsid=18&hint=&cc=DE&wsip=170774562&bca=0&ugd=4&vgde_setid=Nff&ssld=%7B%22QQNN%22%3A%22r4%22%2C%22QQN75%22%3A%22kL1zUkxL7n1YnY18z%22%2C%22QQ8E%22%3A%22HX.uHu.uXf.9%22%2C%22QQQN%22%3A%22q4%22%7D&cid=8CUWMQE3H&vi=1702823144634393601&vsid=DefVid&tdAdd[]=asnum%3D9009&vgde_test_data_struct=%7B%22EO7E8O%22%3Au%7D&vgd_adprefflag=11&vgd_adpref_diff=1100&vgd_fm_lang=DE&vgd_implt=3&vgd_cage=4&vgd_tsce=L350-S350&vgd_l3_sc=HE&vgd_chost=contextual.media.net&vgd_sslb=1111&vgd_hb_audit_1=8CU18831I&vgd_hb_audit_2=742696110&vgd_refdomain=wheregoes.com&vgd_katbid=-103&vgd_pdtid=1&vgd_nrrv=37575&vgd_nrrmf=3000c80a&vgd_nrrsf=scrr&vgd_cty=muhldorf+am+inn&vgd_ifrmode=13&sttm=1702823144958&upk=1702823145.16845&hvsid=00001702823144958007642542086904&verid=3111299&sbdrId=196&tsrc=entity&vgd_l1rakh=1702823144123107831&vgd_ecrid=S0300080711068000300060099999900&vgd_isiolc=1&kbbq=%26asn%3D9009&vgde_ydsp=%7B%22QEx%22%3A%22%2FKTP4nXuWX%22%7D&vgd_mcf=76592&vgd_vstrid=DefVid&vgde_bdata=QOfvzxjj~8xLjMjvf9~myJLEYv9.f~e8QMQOvHuF~LkMNz7vu~ONfvu~8Q7Yvf~G17v9%2C9%2C9~QNOvwJ~eM1Qzvi99i~ejfLMQOvf9fAufuh9h~8xLjMGvWffW.Hf~xLjM7UNv9~Q7OvGQ1olmzJMuFHuAuWXfii99oFMufAHXF~j1Q7v~Nemyv9.Xi~e8QMxLjMGv9.Ff~ejfLM8MQOvf9fAufuh9h~8Ev0V6%20c~kGGv9~e8QMxLjMjvf9~L88Ex1v9%2C9~J7vui~LNvu~Y78Ov0a9999uf~ejfLM8MGv9.9u~LEQMQOvf9fAufuXuF~e8QMGvXHH~xLjMGv9.uf~ejfLMxLjMGv9~ejfLMxLjMe8vu4ouF~xLjM7e8v9~xLjMjvf9~Qjev9~yN17vou~GGvuiF~eev9~NejfLMQOvHuh~Lkev9~jfLMGvu999~JLEYv9.9X~ejfLMxLjMUNv949~GYv9.fX~1AEMGvA.AH%2Cu9h.XF~Q8OvuXuhuHAAu~QOvou~x8OvffOXZw_6pBUuz6syw3~NejfLMGv9.Xi~G7OvA9hiiiu9HXHf9h9WXFhHiWXf9FAi9AWufiiuAffH9A9HWWi9huhiuHHAiiAXhAFFffhhXfFW9hfFXW9XH9AAWXiHHfiXWHf9ihHAWhf~eBxvou~OfEMjvu9~Nejfv9.Xi~AENkvu999~x8Yv9~eBMYJOv9.AA~OYYMQ7Lyvw1LYmz5~OfEMGv9.iW~myOfEMGv9.iF~exLjMGv9.fH~QQvuF99-uf99~NNvr4~x8Bvou~NJv9~LEQMGvu9h.XF~LNevAh.fi~exLjMjvf9~LEQMxLjMGvFf.WA~%3DVvA9Ff~UGMxNvof~z7Qvu~UGMNNUQvof~N7vkL1zUkxL7n1YnY18z~GQQMC_pvIK%2CIK~G1Q8QfvuiF~G1Q8QuvuiF~8QDJkv9~8exLjMGvH.uF~8Q8kv9~G8Ov9.9X~LEQMxLjMjvf9~ONvh~ejfLMGvA.AH~8exLjMjvf9~NGOEv9.9fF~QOvou~875EJM8OvA~QJjjJLM71yM8OvGQ1olmzJMuFHuAuWXfii99oFMufAHXF~QxEEj5M71yM8OvGQ1olmzJMuFHuAuWXfii99oFMufAHXF~EmQvA~LJkMNz7vu~N1LL8JLVOv9~myG8Ov9.9X9~GkjLv9.999~O7NvJxMGJ~OYYMJLEYvk1jQJ~OYYvw1LYmz5~GOEN1EOv9~O1jyvxz8QmzfF~QmGEv~w7Yjvu~ONx7vWX~OmyGv9ou~8GNvu~zQlvu~7yQvA99-F99~GQGv9~GQEv9~7Y-vfWi&vgd_cfud=230119&vgd_scsver=296&vgd_optout=0&vgd_ydspr=1&vgd_l2shld=1&vgd_rensize=300_600&vgd_scr_h=1200&vgd_scr_w=1600&vgd_ect=4g&vgde_ydata=duh%25Aru&vgd_l1cdv=1130&vgd_l1rpth=%2Fnmedianet.js&vgd_lbt=1000&vgd_mbr=1&vgd_pgids=1&tdAdd[]=uiparams%3D%3Brend_w%3A300%3Brend_h%3A600&vgd_uspa=0&vgd_sc=HE&vgd_l1rhst=contextual.media.net&hvsid=00001702823144958007642542086904&rc=0&rand=1702823145324&acid=45def8cbd463c0333bbb00381a6d9c65&matm=1702823145324&vgd_ltimesrc=1&vgd_ltime=538&vgd_rtime=483&vgd_etm=6&vgd_l1hcsd=Og4dd%7C8270&vgd_l1ch=1&vgd_lhl=1303&vgd_pgid=p1492814678t202312171425&vgd_csip=rtb-common-5c85f5bcc7-4r59v.BE&vgd_sbSup=1&vgd_nrrs=37575&vgd_cntrdt=SL%7CDIV-rc_e8740592f3269a8c9a0c9970bbaceb04%7CDIV&vgd_crefurl=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235981082%2F&vgd_eadm=1&vgd_matchstr=hr%3D0%7C&vgd_end=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2.18.160.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=21600
Date: Sun, 17 Dec 2023 14:25:45 GMT
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
timing-allow-origin: *
Content-Length: 15
Expires: Sun, 17 Dec 2023 14:25:45 GMT

GET
H2 200 memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgshZ1x4gaVI.woff2
fonts.gstatic.com/s/opensans/v40/ Frame 7610 18 KB
19 KB 27ms
7ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgshZ1x4gaVI.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:800

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3403fa778109bceb18b607b327d3a721f225555e078ccbdacb4238b733856ff7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 19:27:47 GMT
x-content-type-options: nosniff
age: 154678
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18644
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 01:59:24 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Dec 2024 19:27:47 GMT

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame A309 52 KB
17 KB 22ms
6ms Document
text/html 151.101.1.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141
Requested by: Host: a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com
URL: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 32055
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Sun, 17 Dec 2023 14:25:45 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 16 Nov 2023 08:37:34 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 494, 201486
X-Served-By: cache-lga13626-LGA, cache-fra-eddf8230048-FRA
X-Timer: S1702823145.426635,VS0,VE0

GET
DATA 200
OK truncated
/ Frame 4E32 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 638b6bc61976a04a5e6ae8cb84fd9620fd971e7068fc503a5e28be7f69cf24f7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 200 vevent
fra1-ib.adnxs.com/ Frame 4E32 0
696 B 35ms
35ms Ping
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://fra1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QLeD_BM3gcAAAMA1gAFAQjoifyrBhDDmOCBqsSZ6nEYyp7f-amC1_tnKjYJ7GmHvyZrhD8ROeFvxQ_fez8ZAAAAQOF6xD8hOeFvxQ_fez8p7GkJJAAxCRuwhD8w44L0CDjKQUDqP0gCUNTK53JYmNVSYABokfdreIPYBYABAYoBA1VTRJIBAQbwQJgB2AWgAVqoAQGwAQC4AQLAAQXIAQLQAQDYAQDgAQDqAcYFaHR0cHMlM0ElMkYlMkZhZGNsaWNrLmcuZG91YmxlCQ4sbmV0JTJGcGNzJTJGBRIcJTI1M0Z4YWkBCPR1AURBS0FPanN1ZjNNR1FKZ1lIQmtBdXduTnNMZk9QSWJacEpjV1UxSVFGV1VMT0tZQldjTWtRckRmeDBFQUVLRmJxM1hHUXNfMjB6bU5UMDFObWVOX2k5ZkVJQ0xRcXQ3UElDQjlWMElKalN5WGtDbjZ1UXZyM1M2OHBoTElta2lMMHpZOUM5cGFpNmlqWHg4QWpQa0YxMlpGUmsxbG9mamNlc3V5ZVd6NFR4bVBKRXR5Y0p4dHhETGVpbktOUVFGc0wyOU5jd3JqVHNkVVRRX2lwaHJPcVJJdUtXSGxuUHZQQlBxemV4QTlnclZqOW45TU5LOTN6UnZNckthaGhDVF9aaWpiT2d0S0w1aE5lQWVFN1pQM2hINExMOUZtZS11VDVHb2dFNGdQNW1feTVZcnhGd0Zyb01YaXJIVTF0YnFGLTBZT0JpeWQxcml5a1Y0MGpXeFpCS2pCemNHY1ZTekcya0ZvNi0xNVJzZzZXckElMjUyNnNhLXv0NAFNZmwtWVJSS0NqTWE4OVRzT1plVmRERDN1TGVLb0tuN1FxU01SMGp3bnVTRHJOTjBMQ2FBb1BoU2ZnbGZ3X3hJdVdmM1hfRXM5dE96ZDNFSlhNUjB2Rmw2X1VaajFSVW5NWFVta0F0VHpIY3o3Wm1fZDJQSm1VbmZ1WWJNbXc5eFBrRFN3dzNVeExXbERoSUZfaGZWNUlBN29jJTI1MjZzaWclMjUzRENnMEFyS0pTekFmN2dsYVJMUV9kRUFFJTI1MjZmYnNfYWVpZCUyNTNEJTI1MjU1Qmd3X2Zic2FlaWQlMjUyNTVEJTI1MjZ1cmxmaXglMjUzRDElMjUyNmFkdXJsJTI1M0TwAQCKAlN1ZignYScsIDQ4MTk5MDUsIDApO3VmKCdpJywgNDgyNDk2OSwgMCkFFDxnJywgMTI3MzU3ODQsIDApBRUwcicsIDI0MDc3MjQzNgUW8IaSAokEITZWMjZoUWlBNmRRVkVOVEs1M0lZQUNDWTFWSXdBRGdBUUFCSTZqOVE0NEwwQ0ZnQVlESm9BSEFBZUFDQUFRQ0lBUUNRQVFHWUFRR2dBUUdvQVFHd0FRQzVBWTBoR2JJcmE0UV93UUdOSVJteUsydUVQOGtCQUFBQUFBQUE4RF9aQVENDXRQQV80QUdKdjZZQzlRRllXU004bUFJQW9BSUJ0UUkFJQB2DQjwVXdBSUF5QUlBMEFJQTJBSUE0QUlBNkFJQS1BSUFnQU1CbUFNQnVnTUpSbEpCTVRvMU16RXg0QU9kUllBRTZPX0ZCSWdFbVBqTEJKQUVBWmdFQWNFRUFBBWMUQUFBREpCAQcNARgyQVFBOFFRDQ4oQUFBSWdGdnltcEIRExRQQV9zUVUBGgkBOE1FRnVCNkY2MUc0ampfSgUoHElEM1JPVV8wLigACE5rRgkxwEFBOERfZ0JlVUg4QVdvcW9rRy1BWEJsNllDZ2dZRFZWTkVpQVlFa0FZQm1BWUFvUVkRNyxBQUtnR0JMSUdKQWsZFABCHcsEQmsZGABDHRgYTGdHQ29FSRmoMDgumgKVASFzeENLcGc2DQIkbU5WU0lBQW9BRB1BBERvMl0BEFFKMUZTPREAVREMDEFBQVcdDABZHQwAYR0MAGMdDBBlQUNKQREQNFBBX9gCAOACn_A_6gIWpdDw1zovL3doZXJlZ29lcy5jb20vgAMAiAMBkAMAmAMZoAMBqgMAwAPYBMgDANgDxdTyAeADAOgDAPgDAYAEAJIEBC90dGqYBACiBA00NS4xNDEuMTUyLjcyqAQAsgQMCAAQABgAIAAwADgAuAQAwAQAyAQA0gQOODE3MCNGUkExOjUzMTHaBAIIAeAEAPAE1MrncogFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBdn-O_oFBAgAEACQBgCYBgC4BgDBBgEhATEg0AboKdoGFgoQCREZAXQQABgA4AYB8gYCCACABwGIBwCgBwHIB4PYBdIHDQkRKAEmCNoHBgnKuOAHAOoHAggA8AeI3QOKCAIQAJUIAACAP5gIAcAIANIIDgiBgoSIkKDAgAEQABgA&s=d3e1104c426eba9782daa4649ec43d4cfc2c83e8&type=nv&nvt=5&jm=1140|1141|1003&px=0&py=0&bw=728&bh=90&sid=7472543991515764660&vd=ct~0|rr~0&sv=240&tv=view7-1js&ua=chrome52&pl=win&x=v&tag_id=18678115&sw=1600&sh=1200&pw=728&ph=94&ww=728&wh=90&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/240/trk.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:45 GMT
an-x-request-uuid: df6c0688-aa6a-47e5-a8c8-d66d9973bb50
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 45.141.152.72; 45.141.152.72; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4E32 0
0 46ms
45ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst_O6ZAxsqfuEHniqL85EaICGUoJZviDbid_Rn6YgvdDfnVIAPBqjBdpvLVeZDuZmxzy05TakeJ3Q6UCd8HMWGsiLRZeS-5yD6zRl_sWuzh3lP8BLeOoey_vT0UePHL3lR285eNC8nUq8Yf66TuBHp1rkg8LijeKKsZJnI&sai=AMfl-YRnoiTsdHRjex-s41K_Ud4WR0pZTuRHZmqxyEcArFPw9b5qS9HxqhhsEF1VrBQ1bP-g_LZiJJnarzy1uhvSF3tWeLdYynyNVTX0hg&sig=Cg0ArKJSzHPyvj4oqLB3EAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=279&vt=11&dtpt=209&dett=3&cstd=68&cisv=r20231207.38986&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235981082/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:45 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame A309 0
595 B 6ms
6ms Script
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:45 GMT
an-x-request-uuid: 8eb72c02-a5d6-49c3-8c63-755bb0a68e5e
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 45.141.152.72; 45.141.152.72; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 6AF6 0
0 44ms
44ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss0gSgJ4y7ZlOu3LdNOvJ7gf1bAhJPAiIwqr5YsUzctYrvNvPPxLw6x-9T7kgAyfNrCjRvPJRBouiJgcQtA3_eXgx-yrZ6jv35EYDWVfVeYkIlLhcOPJQVH-4Jj0df7o3eUAnvXC3_0Ki7kS445LTOHPgRQtB5swwPydnEGZ1GOxkgG-w-h1SN8M4YPPMMGiom_U4K_lPqzkFz4UNzeeOF7eDTU3YymlVp6N3_8195ir5LawRizYVAZ4T_e5SJlbYoWLVEg93ppCjl5qIQgi-OLpf3FxFWygrRymxOCekMTgB2--nmIwAY444Z9jyBqXhtadLa2w7IfpOJd41a2r73YkHeJ42g8WoWde-TkRpNb7ge7vzepPkI2&sai=AMfl-YT-LH79puBTTXO8jirpvBpV0QUQV0mi7RTZ9CwH9zf6PTpy-anx2hRqcjiVcH8mPvCSMRUMmMDR4JxP2sIsea_zN7_HLlFdmFZ9RBCR4FX7YcKPSFBHUwsct8shMJ9vyrvbNzv7IclCnOeRGOQQZ4s&sig=Cg0ArKJSzIPuUMVN-5TPEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:45 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 17 Dec 2023 14:25:45 GMT

GET
DATA 200
OK truncated
/ Frame 6AF6 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f27c04ee48e9f7a8c3631756ad0b53aefd45ed468457693340fcdf27d162a290

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 44ms
44ms Image
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202312060101&jk=4293649511312332&bg=!ycqlyoXNAAY3kmNgF5I7ADQBe5WfOFxNFvmO7seB-oOkcKi4hQsQwkifLU5yuXpUEy00WAIyAaal2o7SrAOnIg6yabcRAgAAADpSAAAAAmgBBwoAXAaC8lYhr4Y7VgeOubjIT9nGiuOLb7wNiG1RNkVSp3d9GEbykiyc0SwXZxI56obgrql3sxklYNsMacaa4P01r_3ZDKeqsH4vEnw_VvDZdkejDeAyfS5iMygSVgQAmQMAjCii12uEfYsut01ZJLzc9PqHunIucCVNGg5_gi9996x9g2PinX26WjUIn16gpG2sRA7EpKjk_yZY-4Jxw-IrQaMKanckrVBdekd9HhDXQyUa2oDWAr8fIf6yl3Gsv3nbhbm20-VOIyQbZNox5nYqEkv7ivcceT4Kn0CWU7Y0fAfhi_GQ3QWtO52B2dN_nLLCzKxYmsIOy-wfSCq1vYG0AhzpBx3EM2nQVVfptNZeYktKbbY4iZdsuma8uECz6oVMlQj20I6FSZd5lvjzPOnCZVY88qVXDQkUB1qSGBFxgT_4MnwTDgXCmLKFl_QZS5xPkno1IHL0YltAyv_zAVnEo7MfDZLlph5bQjd558Cs7tKYPQByPg31oB719h2OejIPxz5gY-EFbw8kCt0vNXsAhz_cL4ubetr8mA3KoPRPu1zDkanWzUzvKNEnHG0DACOd_TzflDN8__faucFEdsRBcIA-LlU3Wnk0TYzt1sr3JaQr2TQSIZMqod9CKGhUo-VPHut63XgNWktpKEGaDvkSpubnpC_A0H0CcDe3gVhb7XZaaGrwycPrrc1dFngl9meOsDMPO38Hc0iqspwWs_1pYgMthuuVQ7agNMgn7VBVSQFhIHVWDfE-LJMP3qJTKuyOZznd3W-S46CGMlaCEipu2boLJGPkBVLmwp8G_Bl4Vzp0wsw5hgt6L7LZFe5RoytFrFkj67oFszuerQAKdjJiia8s0iFyac5wAvTpqswKjhnS37R8ywsOf9u7OTY2jENaW6PvTuMA32wDBIEB1HyASIs_Qx02Z0B_IlAF2wdpgX3JWaIdN7-ZgXOdW6pGmKo8fwoc0VTP-l7wPerolckqC0uE5-wuzq6bc666Fw21Yb96YORG2h-xvUCNJl0XlMv2jjGFfEUvb3n4w4HJfVwnC8LUG0tthzh134y3sSinTnwIkcjFTw8_utVUBfkepHhVVp25AJKdBI5auL24qpBxSgWVCNFBJsUsajRNxNT2eFOer-cW9RWDBktQ25M1k-NA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 6720 42 B
174 B 44ms
44ms Fetch
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsswXCERZrHXHJmyXiGWf_p35UqsrYUCu0zDi8Iskhspzq1aBtv1YR9W5nBrmBaPvEpTc3ANbflnW4tIadlh2jCVAuee_8NWkvpzS9zU8e-rS4am_7fJEJFWJQcc2Y3XoLA83_-CVYgT7xEePwRZ3IUwHw&sig=Cg0ArKJSzLE1NJZU_ItgEAE&id=lidar2&mcvt=1000&p=666,1091,916,1391&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231213&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=19&adk=2861055222&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1702823144804&rpt=129&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 st_1 Show response
choices.trustarc.com/jsi/ Frame 4E32 6 KB
3 KB 101ms
100ms Script
text/javascript 18.239.50.7
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://choices.trustarc.com/jsi/st_1?aid=sojern02&pid=sojern01&cid=24268113&sz=728x90&c=te-c146&rand=e022

Requested by

Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=sojern01&aid=sojern02&cid=24268113&js=st0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.239.50.7 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

08fbb1ec5626f049e9c93fdfdb2b2abf3e226547c21e6da1056360adb3588f9a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 8428d3ca0a47cd247ba9c371c08ccb6a.cloudfront.net (CloudFront)
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop: AMS58-P3
cross-origin-embedder-policy: unsafe-none
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 2298
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=31536000
vary: Accept-Encoding, Origin
x-frame-options: SAMEORIGIN
content-type: text/javascript;charset=UTF-8
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy: geolocation=(), microphone=(), payment=()
x-amz-cf-id: fDFfSNAlGXJ9OmVj6Iw2Rq1rojkEHewnmzFifX0r9wHqYx_J1JVx1Q==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 ca Show response
choices.trustarc.com/ Frame 4E32 39 KB
12 KB 118ms
118ms Script
text/javascript 18.239.50.7
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://choices.trustarc.com/ca?aid=sojern02&pid=sojern01&cid=24268113&js=st_2

Requested by

Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=sojern01&aid=sojern02&cid=24268113&js=st0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.239.50.7 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

48340981c593332428262b3b5d491924485bffa8120e912ec84f93605c78448d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 8428d3ca0a47cd247ba9c371c08ccb6a.cloudfront.net (CloudFront)
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop: AMS58-P3
cross-origin-embedder-policy: unsafe-none
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
x-xss-protection: 1; mode=block
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=31536000
x-frame-options: SAMEORIGIN
vary: Accept-Encoding, Origin
content-type: text/javascript;charset=UTF-8
cache-control: max-age=3600
permissions-policy: geolocation=(), microphone=(), payment=()
x-amz-cf-id: nnBVtehVSRGf9m6agUeNZna9SXcfETQpx5kenZVL-qaMobVbDOGGGw==
expires: Sun, 17 Dec 2023 15:25:46 GMT

GET
H2 200 get Show response
choices.trustarc.com/ Frame 4E32 19 KB
6 KB 14ms
14ms Script
text/javascript 18.239.50.7
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://choices.trustarc.com/get?name=pmw2.js
Requested by: Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?sz=728x90&c=768721279&cid=0&aid=sojern02_d&pid=sojern01&js=pmw0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.239.50.7 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-239-50-7.ams58.r.cloudfront.net
Software: nginx /
Resource Hash: 2e7b45ace7324f4eaf0c5e859c3ebbe3ac7fb2a8c2f922fee1e1f4096d5d0a12

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 22:11:47 GMT
content-encoding: gzip
via: 1.1 8428d3ca0a47cd247ba9c371c08ccb6a.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS58-P3
age: 404039
x-cache: Hit from cloudfront
pragma: public
last-modified: Tue, 21 Nov 2023 07:44:27 GMT
server: nginx
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: 1Ic67F9OYS1EjAQFY51V5EfJ2ZbgOaoNrV8V0ZtSWL_8EQebVK2jwA==
expires: Thu, 11 Jan 2024 22:11:47 GMT

GET
H2 200 cap
choices.trustarc.com/ Frame 4E32 43 B
433 B 115ms
115ms Image
image/gif 18.239.50.7
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://choices.trustarc.com/cap?aid=sojern02_d&pid=sojern01&cid=0&w=728&h=90&c=6254

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.239.50.7 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:46 GMT
via: 1.1 8428d3ca0a47cd247ba9c371c08ccb6a.cloudfront.net (CloudFront)
x-content-type-options: nosniff
server: nginx
x-amz-cf-pop: AMS58-P3
x-frame-options: SAMEORIGIN
x-cache: Miss from cloudfront
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
x-amz-cf-id: 4Y62gb1NAHmnJ5SW-N86AhCHjN-casUcXYmHEXjBYChIiPMXVhokXQ==
content-length: 43
x-xss-protection: 1; mode=block
expires: Sun, 17 Dec 2023 14:25:45 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4E32 42 B
64 B 45ms
45ms Fetch
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssfkC8k_cPKplxFRIVWOzwiZxXJIEgzeloYxHG67Y1GLjIqdKpFZWADAI8zlfHMA3ER-u3Fddki8rxM9gaSm9XMUnZtcL1pj4mhH2_dByJasUIsFH-VPb1ghv8a&sig=Cg0ArKJSzLTVtwFkE_dSEAE&id=lidar2&mcvt=1000&p=0,0,90,728&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231213&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=34&adk=153375241&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1702823144798&rpt=450&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4E32 42 B
64 B 45ms
45ms Fetch
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstvtkIGzM_GtFI2XWXSLTHEw0VdSACXlkOsoYgNJy_vcZzolETWvp6PggsswIp5nwejBc2h0uZlx3dQSnijL50iFR6Lc78c-2B6CoF0_61tWwtBxZuUKfHoNtFe1mgl2GKnBhnVWLtF0JIFGX_F-xd7CQ&sig=Cg0ArKJSzGYdSHarUV63EAE&id=lidar2&mcvt=1001&p=440,436,530,1164&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20231213&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=19&adk=1696759606&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1702823144798&rpt=448&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 get
choices.trustarc.com/ Frame 3A19 287 B
660 B 13ms
13ms Image
image/png 18.239.50.7
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.239.50.7 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-239-50-7.ams58.r.cloudfront.net
Software: nginx /
Resource Hash: 821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: public
date: Sun, 19 Nov 2023 13:19:27 GMT
via: 1.1 8428d3ca0a47cd247ba9c371c08ccb6a.cloudfront.net (CloudFront)
last-modified: Thu, 26 Oct 2023 03:20:37 GMT
server: nginx
x-amz-cf-pop: AMS58-P3
age: 2423179
x-cache: Hit from cloudfront
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
content-length: 287
x-amz-cf-id: dN2g73jS88tL79CYEHCB3_dI7LiZDuC0Gb0Xb5aiCtc0smMplfJxqA==
expires: Tue, 19 Dec 2023 13:19:27 GMT

POST
H2 200 vevent
fra1-ib.adnxs.com/ Frame 4E32 0
696 B 15ms
15ms Ping
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://fra1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QLeD_BM3gcAAAMA1gAFAQjoifyrBhDDmOCBqsSZ6nEYyp7f-amC1_tnKjYJ7GmHvyZrhD8ROeFvxQ_fez8ZAAAAQOF6xD8hOeFvxQ_fez8p7GkJJAAxCRuwhD8w44L0CDjKQUDqP0gCUNTK53JYmNVSYABokfdreIPYBYABAYoBA1VTRJIBAQbwQJgB2AWgAVqoAQGwAQC4AQLAAQXIAQLQAQDYAQDgAQDqAcYFaHR0cHMlM0ElMkYlMkZhZGNsaWNrLmcuZG91YmxlCQ4sbmV0JTJGcGNzJTJGBRIcJTI1M0Z4YWkBCPR1AURBS0FPanN1ZjNNR1FKZ1lIQmtBdXduTnNMZk9QSWJacEpjV1UxSVFGV1VMT0tZQldjTWtRckRmeDBFQUVLRmJxM1hHUXNfMjB6bU5UMDFObWVOX2k5ZkVJQ0xRcXQ3UElDQjlWMElKalN5WGtDbjZ1UXZyM1M2OHBoTElta2lMMHpZOUM5cGFpNmlqWHg4QWpQa0YxMlpGUmsxbG9mamNlc3V5ZVd6NFR4bVBKRXR5Y0p4dHhETGVpbktOUVFGc0wyOU5jd3JqVHNkVVRRX2lwaHJPcVJJdUtXSGxuUHZQQlBxemV4QTlnclZqOW45TU5LOTN6UnZNckthaGhDVF9aaWpiT2d0S0w1aE5lQWVFN1pQM2hINExMOUZtZS11VDVHb2dFNGdQNW1feTVZcnhGd0Zyb01YaXJIVTF0YnFGLTBZT0JpeWQxcml5a1Y0MGpXeFpCS2pCemNHY1ZTekcya0ZvNi0xNVJzZzZXckElMjUyNnNhLXv0NAFNZmwtWVJSS0NqTWE4OVRzT1plVmRERDN1TGVLb0tuN1FxU01SMGp3bnVTRHJOTjBMQ2FBb1BoU2ZnbGZ3X3hJdVdmM1hfRXM5dE96ZDNFSlhNUjB2Rmw2X1VaajFSVW5NWFVta0F0VHpIY3o3Wm1fZDJQSm1VbmZ1WWJNbXc5eFBrRFN3dzNVeExXbERoSUZfaGZWNUlBN29jJTI1MjZzaWclMjUzRENnMEFyS0pTekFmN2dsYVJMUV9kRUFFJTI1MjZmYnNfYWVpZCUyNTNEJTI1MjU1Qmd3X2Zic2FlaWQlMjUyNTVEJTI1MjZ1cmxmaXglMjUzRDElMjUyNmFkdXJsJTI1M0TwAQCKAlN1ZignYScsIDQ4MTk5MDUsIDApO3VmKCdpJywgNDgyNDk2OSwgMCkFFDxnJywgMTI3MzU3ODQsIDApBRUwcicsIDI0MDc3MjQzNgUW8IaSAokEITZWMjZoUWlBNmRRVkVOVEs1M0lZQUNDWTFWSXdBRGdBUUFCSTZqOVE0NEwwQ0ZnQVlESm9BSEFBZUFDQUFRQ0lBUUNRQVFHWUFRR2dBUUdvQVFHd0FRQzVBWTBoR2JJcmE0UV93UUdOSVJteUsydUVQOGtCQUFBQUFBQUE4RF9aQVENDXRQQV80QUdKdjZZQzlRRllXU004bUFJQW9BSUJ0UUkFJQB2DQjwVXdBSUF5QUlBMEFJQTJBSUE0QUlBNkFJQS1BSUFnQU1CbUFNQnVnTUpSbEpCTVRvMU16RXg0QU9kUllBRTZPX0ZCSWdFbVBqTEJKQUVBWmdFQWNFRUFBBWMUQUFBREpCAQcNARgyQVFBOFFRDQ4oQUFBSWdGdnltcEIRExRQQV9zUVUBGgkBOE1FRnVCNkY2MUc0ampfSgUoHElEM1JPVV8wLigACE5rRgkxwEFBOERfZ0JlVUg4QVdvcW9rRy1BWEJsNllDZ2dZRFZWTkVpQVlFa0FZQm1BWUFvUVkRNyxBQUtnR0JMSUdKQWsZFABCHcsEQmsZGABDHRgYTGdHQ29FSRmoMDgumgKVASFzeENLcGc2DQIkbU5WU0lBQW9BRB1BBERvMl0BEFFKMUZTPREAVREMDEFBQVcdDABZHQwAYR0MAGMdDBBlQUNKQREQNFBBX9gCAOACn_A_6gIWpdDw1zovL3doZXJlZ29lcy5jb20vgAMAiAMBkAMAmAMZoAMBqgMAwAPYBMgDANgDxdTyAeADAOgDAPgDAYAEAJIEBC90dGqYBACiBA00NS4xNDEuMTUyLjcyqAQAsgQMCAAQABgAIAAwADgAuAQAwAQAyAQA0gQOODE3MCNGUkExOjUzMTHaBAIIAeAEAPAE1MrncogFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBdn-O_oFBAgAEACQBgCYBgC4BgDBBgEhATEg0AboKdoGFgoQCREZAXQQABgA4AYB8gYCCACABwGIBwCgBwHIB4PYBdIHDQkRKAEmCNoHBgnKuOAHAOoHAggA8AeI3QOKCAIQAJUIAACAP5gIAcAIANIIDgiBgoSIkKDAgAEQABgA&s=d3e1104c426eba9782daa4649ec43d4cfc2c83e8&type=pv&jm=1140|1141|1003&px=0&py=0&bw=728&bh=90&sf=1&sid=7472543991515764660&vd=ct~0|rr~5&sv=240&tv=view7-1js&ua=chrome52&pl=win&x=v&tag_id=18678115&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/240/trk.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:46 GMT
an-x-request-uuid: d0b54fcc-0002-4b28-8f50-3a654f72902a
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: https://a42d8c88b6b9388055bd3a5d3ad29fc5.safeframe.googlesyndication.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 45.141.152.72; 45.141.152.72; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame A309 0
595 B 15ms
15ms Script
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

a88-221-124-22.deploy.static.akamaitechnologies.com

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:46 GMT
an-x-request-uuid: 58ece51d-21a4-4f6f-8da5-73ced82f7be6
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 45.141.152.72; 45.141.152.72; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 get
choices.trustarc.com/ Frame 19EF 287 B
661 B 13ms
13ms Image
image/png 18.239.50.7
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.239.50.7 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-239-50-7.ams58.r.cloudfront.net
Software: nginx /
Resource Hash: 821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: public
date: Sun, 19 Nov 2023 13:19:27 GMT
via: 1.1 8428d3ca0a47cd247ba9c371c08ccb6a.cloudfront.net (CloudFront)
last-modified: Thu, 26 Oct 2023 03:20:37 GMT
server: nginx
x-amz-cf-pop: AMS58-P3
age: 2423179
x-cache: Hit from cloudfront
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
content-length: 287
x-amz-cf-id: e6HaSMsss0_r2VwMLCTiYflfMMDigCgYYvXbxHfJqknqhjYMRJgWRQ==
expires: Tue, 19 Dec 2023 13:19:27 GMT

GET
H2 200 publishertag.prebid.136.js Show response
static.criteo.net/js/ld/ 94 KB
30 KB 26ms
26ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.136.js

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1702822800000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

ed3dc50aa8e28ea856d113dfbd2bd12dbb09ceb4381f2bdf8dba7b14b2a00108

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:46 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 07 Nov 2023 09:08:30 GMT
server: nginx
etag: W/"6549fe8e-17704"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 18 Dec 2023 14:25:46 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 565F 15 KB
6 KB 16ms
16ms Document
text/html 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=wheregoes.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.136.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

fd8c1cf4274cae5e1e5a37133cc23b80392ef88c43b798d3748f43948dbb53f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 17 Dec 2023 14:25:45 GMT
server: Kestrel
server-processing-duration-in-ticks: 1086939
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 publishertag.prebid.136.js Show response
static.criteo.net/js/ld/ 94 KB
30 KB 50ms
25ms XHR
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.136.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.136.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

ed3dc50aa8e28ea856d113dfbd2bd12dbb09ceb4381f2bdf8dba7b14b2a00108

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:46 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 07 Nov 2023 09:08:30 GMT
server: nginx
etag: W/"6549fe8e-17704"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 18 Dec 2023 14:25:46 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame 565F
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=wheregoes.com&sn=ChromeSyncframe&so=3&topUrl=wheregoes.com&bundle=oTJST19ZTXQ5UW9xWFdNNE9BWG56SiUyQnYlMkZ5TUsxVWFWcDFoJTJCWURkcVQxaGdxWUJF...
https://mug.criteo.com/sid?cpp=9HQDbnxtMjJBZWVzWEc0SjhmcHZxNWJhODgrc1h3RjdTeitwR1ptSXErUGJCNzloaUdueGk4V0gyUmdwcG1jbTV6T2JieW0xRDNCQ2I1MjZDNWdNbDBSVE1pRG5ORFMwb2NPQnRBVWtGWkN6cGFJSTdsazAwaUdUZWJpVW...

441 B
656 B

14ms
14ms

Fetch
application/json

2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=9HQDbnxtMjJBZWVzWEc0SjhmcHZxNWJhODgrc1h3RjdTeitwR1ptSXErUGJCNzloaUdueGk4V0gyUmdwcG1jbTV6T2JieW0xRDNCQ2I1MjZDNWdNbDBSVE1pRG5ORFMwb2NPQnRBVWtGWkN6cGFJSTdsazAwaUdUZWJpVWdDNE1SYnM4WVNxdXUybTFlbHo3T3RjSG5Ma1lnUWM1WVVQZHA2ckpNYTlXSjFja3Q4aHVaYUZ2ekMvSDlnZC9ia3VMaDJxdUdrQVpVUWoveUc4MWM5VHJxRGdxczNXWkZPcDJtRmluRWVSZEszQzJLaHFDM2pnSUtPZG44djdCa0JkY2Rwc256bW1MUDE5S3UyMFpoNGI2S3ZjcWNWOXJpeURvYk83TTBLQS9NL1dqN3NBdz18&cppv=2

Protocol

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

7178fe4d432f2117a9307274ff3a7145fbf94c4d1ee3d3bdc96ad96705f203e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:45 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 940917
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:46 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=9HQDbnxtMjJBZWVzWEc0SjhmcHZxNWJhODgrc1h3RjdTeitwR1ptSXErUGJCNzloaUdueGk4V0gyUmdwcG1jbTV6T2JieW0xRDNCQ2I1MjZDNWdNbDBSVE1pRG5ORFMwb2NPQnRBVWtGWkN6cGFJSTdsazAwaUdUZWJpVWdDNE1SYnM4WVNxdXUybTFlbHo3T3RjSG5Ma1lnUWM1WVVQZHA2ckpNYTlXSjFja3Q4aHVaYUZ2ekMvSDlnZC9ia3VMaDJxdUdrQVpVUWoveUc4MWM5VHJxRGdxczNXWkZPcDJtRmluRWVSZEszQzJLaHFDM2pnSUtPZG44djdCa0JkY2Rwc256bW1MUDE5S3UyMFpoNGI2S3ZjcWNWOXJpeURvYk83TTBLQS9NL1dqN3NBdz18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 360076
content-length: 0
expires: 0

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame A0DF 23 KB
8 KB 31ms
30ms Document
text/html 88.221.124.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU18831I&prvid=2034%2C2033%2C2055%2C2030%2C3020%2C251%2C233%2C2027%2C236%2C237%2C359%2C459%2C70%2C97%2C55%2C77%2C3012%2C3011%2C182%2C262%2C461%2C244%2C201%2C246%2C4%2C203%2C10000%2C108%2C9%2C407%2C508&itype=PREBID&purpose1=1&gdprconsent=0&gdpr=1&coppa=0&usp_status=0&usp_consent=1

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1702822800000

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

88.221.124.22 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

c68d92e0f9f69977112f67f36f53f616b27ddbf5eaf9aa5ba6b607061de7aebe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 8366
content-type: text/html; charset=UTF-8
date: Sun, 17 Dec 2023 14:25:47 GMT
expires: Tue, 19 Dec 2023 14:25:47 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame BA13 52 KB
17 KB 7ms
6ms Document
text/html 151.101.1.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1702822800000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 32058
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Sun, 17 Dec 2023 14:25:47 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 16 Nov 2023 08:37:34 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 494, 201496
X-Served-By: cache-lga13626-LGA, cache-fra-eddf8230048-FRA
X-Timer: S1702823148.815640,VS0,VE0

GET
H2 200 sync.html Show response
public.servenobid.com/ Frame 90C7 9 KB
4 KB 76ms
13ms Document
text/html 18.65.39.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1702822800000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.65.39.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-65-39-91.ams1.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1c20d54555b098aef8269b6fa89b316fa731aac67e6926c1203c27edf8cf9dbd

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 25478
cache-control: max-age=86400
content-encoding: br
content-type: text/html
date: Sun, 17 Dec 2023 07:21:10 GMT
etag: W/"ea81456e0a6e1fca0e7a864b1d3121aa"
last-modified: Mon, 02 Oct 2023 23:54:30 GMT
server: AmazonS3
vary: Accept-Encoding Origin
via: 1.1 de7a608ee8aa91b02488536faf8169a0.cloudfront.net (CloudFront)
x-amz-cf-id: sPCDcRpE3g4F1iNcNSaJKbzHPR26sNEXot1DLOn8oNBCX3QXUQFCJw==
x-amz-cf-pop: AMS1-P1
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:us-east-1:559734745816:build/adserver-public-prod:58584356-ee8f-4de0-abcc-b50f847fba2c
x-amz-meta-codebuild-content-md5: d3f9c0952d74faa30fada14e06b377b0
x-amz-meta-codebuild-content-sha256: 8aa4841af9e8588faa6f0e126d94acab1f39eb0115dfa16eac2daccf149690d0
x-amz-server-side-encryption: AES256
x-amz-version-id: null
x-cache: Hit from cloudfront

GET
H2 204 /
onetag-sys.com/usync/ Frame EB96 0
0 7ms
7ms Document
text/plain 51.38.120.206
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1702823144318

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1702822800000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.38.120.206 Hessen, Germany, ASN16276 (OVH, FR),

Reverse DNS

ip206.ip-51-38-120.eu

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-store
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame CCBA 281 B
555 B 29ms
7ms Document
text/html 95.101.149.233
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1702822800000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.149.233 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-101-149-233.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Sun, 17 Dec 2023 14:25:47 GMT
ETag: "280525-119-60930cbd3cec0"
Last-Modified: Thu, 02 Nov 2023 19:57:23 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame BA13 0
595 B 37ms
37ms Script
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-3-71-149-231.eu-central-1.compute.amazonaws.com

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:47 GMT
an-x-request-uuid: 7cf7a6d3-ce3d-47be-996d-98c9d5ee9d0d
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 45.141.152.72; 45.141.152.72; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame CCBA 45 KB
13 KB 7ms
7ms Script
text/html 95.101.149.233
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.149.233 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-101-149-233.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: ef99872383d06605558112058dcaf932036b3685ed092edace07b1266e4d39fc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Sun, 17 Dec 2023 14:25:47 GMT
Content-Encoding: gzip
Last-Modified: Sun, 17 Dec 2023 04:52:08 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=51964
Connection: keep-alive
Content-Length: 13201
Expires: Mon, 18 Dec 2023 04:51:51 GMT

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame CCBA 7 B
380 B 57ms
9ms XHR
application/json 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 81c2cbe50044dac07e1ac9ea9841ac415bdc38dd2f6b915ab044bf69ee71c628

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 4b510f0cc5fcbc9800016ef543086418
Expires: 0

GET
H2 200 13926 Show response
g2.gumgum.com/usync/ Frame 060E 3 KB
1 KB 131ms
33ms Document
text/html 54.194.188.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.188.15 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-188-15.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: c663b8ddde804d16bfc5dbc55fa9b64c172ea05111c2263079b51be6f0533ea6

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Sun, 17 Dec 2023 14:25:48 GMT
etag: W/"0c7eed67d4c0dae2f3d27ae77cf8792a4"
server: nginx
timing-allow-origin: *

GET
H2 204 /
onetag-sys.com/usync/ Frame 566B 0
0 7ms
7ms Document
text/plain 51.38.120.206
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.38.120.206 Hessen, Germany, ASN16276 (OVH, FR),

Reverse DNS

ip206.ip-51-38-120.eu

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-store
strict-transport-security: max-age=15552000

GET
H2 200 sync Show response
ssbsync.smartadserver.com/api/ Frame 7CE5 775 B
978 B 171ms
15ms Document
text/html 91.134.110.133
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 91.134.110.133 , France, ASN16276 (OVH, FR),
Reverse DNS: ip133.ip-91-134-110.eu
Software: /
Resource Hash: d244e0faa2213a0c6afebd93ca04fdceb48a5c3806c2b92582348a7fbb23d528

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 775
content-type: text/html
date: Sun, 17 Dec 2023 14:25:47 GMT

GET
H2

200

usermatch Show response
ssum-sec.casalemedia.com/ Frame 100B
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

2 KB
859 B

22ms
21ms

Document
text/html

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 200026d1d65c8ccad9e81e1029138ac7d9ccf066ee2618b87aec46f062f4d7fb

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 836fd662a8094d93-FRA
content-encoding: br
content-type: text/html
date: Sun, 17 Dec 2023 14:25:47 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qHySCqDtRejAXUmAYwmCmkca6hY1V52pWsXtR2usKBt1nm7Zjrfiqr7HjMsErFNdsg%2FJN5Fdq1UiKMmLkv61OJupIEh%2BgFvfeARWUX%2Fww5xMYKyCwCWDmjOPKS0eD1TGaGPc%2F9wtdeYzFw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 836fd6628fe14d93-FRA
content-length: 0
date: Sun, 17 Dec 2023 14:25:47 GMT
expires: 0
location: /usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kvkzQhNclc6esIlzmWa26dhUc56ecDkGmKtG5nwnmQqaiN6ZsFHRT%2FUg5TOmG7r2tgsZJUmhvCzLkZXkVpgR%2FPMqazZf3NiNruk2ZE9aWBiBFcY9zn35PVvb719kF6WUyta%2BsnMIuZHYbg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame FC05
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=duration_media&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east

281 B
555 B

9ms
9ms

Document
text/html

95.101.149.233
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.149.233 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-101-149-233.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Sun, 17 Dec 2023 14:25:47 GMT
ETag: "280525-119-60930cbd3cec0"
Last-Modified: Thu, 02 Nov 2023 19:57:23 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Sun, 17 Dec 2023 14:25:47 GMT
location: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
server: AkamaiGHost

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame B36A 16 KB
6 KB 50ms
14ms Document
text/html 23.35.236.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-201.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 8e53e50181b7a9e2caa94173c37fcd9de8fa75750764a2ad8ad02fac3306d652

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=29905
content-encoding: gzip
content-length: 5622
content-type: text/html
date: Sun, 17 Dec 2023 14:25:47 GMT
expires: Sun, 17 Dec 2023 22:44:12 GMT
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 sync-iframe Show response
cs-rtb.minutemedia-prebid.com/ Frame 57E5 0
526 B 147ms
107ms Document
text/html 2600:9000:224a:6600:1f:4c18:bd40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:224a:6600:1f:4c18:bd40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://public.servenobid.com/
content-length: 0
content-type: text/html
date: Sun, 17 Dec 2023 14:25:47 GMT
server: istio-envoy
via: 1.1 bf943aab70e585412f7a215fb0a10790.cloudfront.net (CloudFront)
x-amz-cf-id: FlLwIoQHvcL1ve1Hf3relw5EFEA6bKXvJ3_mdP6Wxa9O3SSzYO6_ow==
x-amz-cf-pop: DUS51-P1
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 3
x-reason: could not perform CS due to GDPR policy: gdpr is not applied

GET
H/1.1 200
OK user-sync Show response
sync.adkernel.com/ Frame 338C 0
134 B 182ms
54ms Document
text/plain 77.245.57.72
WEBAIR-INTERNET-MTL

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=181225&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D152%26uid%3D%7BUID%7D&gdpr=0&gdpr_consent=&us_privacy=1YN-&
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 77.245.57.72 , United States, ASN36057 (WEBAIR-INTERNET-MTL, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store
Connection: close
Content-Length: 0
Date: Sun, 17 Dec 2023 14:25:48 GMT
Server: nginx

GET
H2 200 sync-iframe Show response
cs-server-s2s.yellowblue.io/ Frame E4BF 0
370 B 299ms
94ms Document
text/html 3.214.250.236
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 3.214.250.236 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-250-236.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://public.servenobid.com/
content-length: 0
content-type: text/html
date: Sun, 17 Dec 2023 14:25:48 GMT
server: istio-envoy
x-envoy-upstream-service-time: 1
x-reason: could not perform CS due to GDPR policy: gdpr is not applied

GET
H2

200

sync
ads.servenobid.com/ Frame 90C7
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=312&uid=7491557740204511050

0
344 B

33ms
33ms

Image
image/avif

54.246.183.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=312&uid=7491557740204511050
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.246.183.131 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-246-183-131.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:47 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:47 GMT
an-x-request-uuid: c54d14e8-1f7f-4032-be2f-7dcf12bbc240
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://ads.servenobid.com/sync?pid=312&uid=7491557740204511050
x-proxy-origin: 45.141.152.72; 45.141.152.72; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 90C7
Redirect Chain

https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D
https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D&dnr=1
https://ads.servenobid.com/sync?pid=310&uid=H1ihqRZHeFJwJWd5QW-hf3Wn

0
350 B

31ms
31ms

Image
image/avif

54.246.183.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=310&uid=H1ihqRZHeFJwJWd5QW-hf3Wn
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.246.183.131 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-246-183-131.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:47 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Sun, 17 Dec 2023 14:25:47 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Location: https://ads.servenobid.com/sync?pid=310&uid=H1ihqRZHeFJwJWd5QW-hf3Wn
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ams1
Content-Length: 0
Expires: Fri, 20 Mar 2009 00:00:00 GMT

GET
H/1.1 204
No Content pixel
ap.lijit.com/ Frame 90C7 0
277 B 20ms
18ms Image
text/plain 216.52.2.30
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.30 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Sun, 17 Dec 2023 14:25:47 GMT
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap6ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Access-Control-Allow-Methods: GET, POST, DELETE, PUT

GET
H2

200

sync
ads.servenobid.com/ Frame 90C7
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync2/rmpssp?sub=duration&zcc=1&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D&cb=1702823148008
https://ad.turn.com/r/cs?pid=45&rndcb=3992835428
https://sync.1rx.io/usersync/turn/4243821144843242728?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-86d3f5a8-f583-4cbb-a689-16898d9a81ac-003?redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3DRX-86d3f5a8-f583-4cbb-a689-16898d9a81ac-003
https://ads.servenobid.com/sync?pid=321&uid=RX-86d3f5a8-f583-4cbb-a689-16898d9a81ac-003

0
362 B

30ms
29ms

Image
image/avif

54.246.183.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=321&uid=RX-86d3f5a8-f583-4cbb-a689-16898d9a81ac-003
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.246.183.131 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-246-183-131.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:48 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=321&uid=RX-86d3f5a8-f583-4cbb-a689-16898d9a81ac-003
date: Sun, 17 Dec 2023 14:25:48 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RX86d3f5a8f5834cbba68916898d9a81ac003
content-type: text/html

GET
H2

200

sync
ads.servenobid.com/ Frame 90C7
Redirect Chain

https://p.rfihub.com/cm?pub=44007&in=1
https://ads.servenobid.com/sync?pid=324&uid=5124322330189652469

0
344 B

29ms
29ms

Image
image/avif

54.246.183.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=324&uid=5124322330189652469
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.246.183.131 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-246-183-131.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:48 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Location: https://ads.servenobid.com/sync?pid=324&uid=5124322330189652469
Date: Sun, 17 Dec 2023 14:25:47 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 usa
sync.go.sonobi.com/ Frame 90C7 0
401 B 307ms
101ms Image
text/plain 2607:f350:3:2569:0:10:0:d
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/usa?loc=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D332%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f350:3:2569:0:10:0:d , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:48 GMT
server: sonobi-go
vary: negotiate,Accept-Encoding
x-go-server: go-iad-2-6-184
content-type: text/plain; charset=utf8
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store, private
tcn: Choice
content-length: 0
x-xss-protection: 0
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 90C7
Redirect Chain

https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1YN-&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D
https://ads.servenobid.com/sync?pid=327&uid=&us_privacy=1YN-&gdpr=0

0
252 B

31ms
31ms

Image
image/avif

54.246.183.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=327&uid=&us_privacy=1YN-&gdpr=0
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.246.183.131 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-246-183-131.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:47 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=327&uid=&us_privacy=1YN-&gdpr=0
date: Sun, 17 Dec 2023 14:25:47 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
content-length: 0

GET
H2 204 occ
ups.analytics.yahoo.com/ups/58559/ Frame 90C7 0
125 B 53ms
9ms Image
text/plain 3.71.149.231
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58559/occ

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.71.149.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/9.1.10.94 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:47 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

sync
ads.servenobid.com/ Frame 90C7
Redirect Chain

https://ssp.disqus.com/redirectuser?r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D346%26uid%3DBUYERUID
https://ads.servenobid.com/sync?pid=346&uid=ua-a96db16b-1143-3a47-a1c8-b26fb481d72f

0
359 B

32ms
32ms

Image
image/avif

54.246.183.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=346&uid=ua-a96db16b-1143-3a47-a1c8-b26fb481d72f
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.246.183.131 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-246-183-131.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:48 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=346&uid=ua-a96db16b-1143-3a47-a1c8-b26fb481d72f
pragma: no-cache
date: Sun, 17 Dec 2023 14:25:48 GMT
cache-control: no-store
content-length: 0
expires: 0

GET
H2 204 occ
ups.analytics.yahoo.com/ups/58632/ Frame 90C7 0
15 B 53ms
10ms Image
text/plain 3.71.149.231
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58632/occ

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.71.149.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-71-149-231.eu-central-1.compute.amazonaws.com

Software

ATS/9.1.10.94 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:47 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 204 v1
match.sharethrough.com/universal/ Frame 90C7 0
35 B 52ms
8ms Image
text/plain 18.198.194.114
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/universal/v1?supply_id=KW3eSFMR&gdpr=0&gdpr_consent=&us_privacy=1YN-&
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.198.194.114 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-198-194-114.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:47 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 90C7
Redirect Chain

https://hbx.media.net/cksync.php?cs=1&type=pbs&ovsid=setstatuscode&bidder=medianet&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D353%26uid%3D%3Cvsid%3E
https://ads.servenobid.com/sync?pid=353&uid=0000EEA

0
336 B

40ms
40ms

Image
image/avif

54.246.183.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=353&uid=0000EEA
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.246.183.131 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-246-183-131.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:48 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

pragma: no-cache
strict-transport-security: max-age=86400 ; includeSubDomains, max-age=604800
date: Sun, 17 Dec 2023 14:25:48 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
location: https://ads.servenobid.com/sync?pid=353&uid=0000EEA
content-type: text/html
cache-control: max-age=0, no-cache, no-store
content-length: 154
x-mnet-hl2: E
expires: Sun, 17 Dec 2023 14:25:48 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame FC05 45 KB
13 KB 8ms
7ms Script
text/html 95.101.149.233
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.149.233 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-101-149-233.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: ef99872383d06605558112058dcaf932036b3685ed092edace07b1266e4d39fc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Sun, 17 Dec 2023 14:25:47 GMT
Content-Encoding: gzip
Last-Modified: Sun, 17 Dec 2023 04:52:08 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=51964
Connection: keep-alive
Content-Length: 13201
Expires: Mon, 18 Dec 2023 04:51:51 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame B36A 0
42 B 49ms
13ms Script
text/plain 198.47.127.19
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=10737377&p=162412&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1YN-
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.47.127.19 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:47 GMT
content-length: 0

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame FC05 7 B
380 B 9ms
9ms XHR
application/json 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 81c2cbe50044dac07e1ac9ea9841ac415bdc38dd2f6b915ab044bf69ee71c628

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 4b510f0cc5fcbc9800016ef543086418
Expires: 0

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame 100B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZX8E610oMwor7LZ28VWlvQAABIkAAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEEoYmKrJUDC46TfnpydnCMM&google_cver=1

43 B
774 B

32ms
32ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEEoYmKrJUDC46TfnpydnCMM&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jjyqO%2F0MCetMmIubKw%2FcIP0cRTlAw1L%2B7No%2F%2FPB02zeUnMvCkSFnoOIqdJ38SgFOmAYLLsHlUawWV70MiZv2E3C4XT%2FbbT2cQEOu9z5jIi3p5dS228tHJEvZLuMU4U%2FVq5MUFqCBua9YMA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 836fd662fc38367e-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:47 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEEoYmKrJUDC46TfnpydnCMM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 364
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

451

501709.gif
idsync.rlcdn.com/ Frame 100B
Redirect Chain

https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=ZX8E610oMwor7LZ28VWlvQAA%261161&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
https://i.liadm.com/s/31327?gdpr_consent=&bidder_id=14481&gpp=&bidder_uuid=ZX8E610oMwor7LZ28VWlvQAA%261161&_li_chk=true&gpp_sid=&us_privacy=&gpdr=&previous_uuid=516b93d967384df4a138895e2b8401ef
https://live.rezync.com/sync?c=0aa2530f29e4f4a05b5d5d9bb35d60c2&p=93c1662463a616a7155169889dd99651&pid=516b93d9-6738-4df4-a138-895e2b8401ef
https://p.rfihub.com/cm?pub=39342&in=1&userid=6ef4fa8a-c3f9-4359-8c2d-2a4f62a54c46%3A1702823148.5916772&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3D6ef4fa8a-c3f9-4359-8c2d-2a4f62a...
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=5133329529377752620&referrer={encSite}&forward=https%3A%2F%2Fidsync.rlcdn.com%2F501709.gif%3Fpartner_uid%3D6ef4fa8a-c3f9-4359-8c...
https://idsync.rlcdn.com/501709.gif?partner_uid=6ef4fa8a-c3f9-4359-8c2d-2a4f62a54c46%3A1702823148.5916772&_=1702823148.5928707

0
98 B

79ms
16ms

Image
text/plain

35.244.174.68

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/501709.gif?partner_uid=6ef4fa8a-c3f9-4359-8c2d-2a4f62a54c46%3A1702823148.5916772&_=1702823148.5928707
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H2
Server: 35.244.174.68 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:48 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

Redirect headers

date: Sun, 17 Dec 2023 14:25:48 GMT
via: 1.1 0d5d2d408eb42296c7636196e25ef8a2.cloudfront.net (CloudFront)
server: lighttpd/1.4.69
x-amz-cf-pop: FRA56-C2
vary: Cookie
x-cache: Miss from cloudfront
content-type: text/html; charset=utf-8
location: https://idsync.rlcdn.com/501709.gif?partner_uid=6ef4fa8a-c3f9-4359-8c2d-2a4f62a54c46%3A1702823148.5916772&_=1702823148.5928707
content-length: 447
x-amz-cf-id: Csq82vEWCV3fYJG9aw81375Ypbjjew89DYCntfdtf-lrtgY2pyrr8g==

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame 100B
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZX8E610oMwor7LZ28VWlvQAABIkAAAAB&gpp=&gpp_sid=
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZX8E610oMwor7LZ28VWlvQAABIkAAAAB&gpp=&gpp_sid=&dcc=t

43 B
855 B

125ms
125ms

Image
image/gif

52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZX8E610oMwor7LZ28VWlvQAABIkAAAAB&gpp=&gpp_sid=&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

Protocol

HTTP/1.1

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 17 Dec 2023 14:25:48 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: YHB6P9XWK1T6PR4S9052
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 17 Dec 2023 14:25:48 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: WTBVDMP5EP66DXBX9QA8
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZX8E610oMwor7LZ28VWlvQAABIkAAAAB&gpp=&gpp_sid=&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 100B
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZX8E610oMwor7LZ28VWlvQAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEBNDBRBe1e5hVnbYV1xEiEA&google_cver=1

43 B
736 B

35ms
34ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEBNDBRBe1e5hVnbYV1xEiEA&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zimbGLlIfLncLD2eneZsQ%2B%2BHCZtxl5bvJSpXj7KGxEi9lb5oF346%2FWebUAr%2BMiGCssVQIpseAt12XNxHhn4zNVs7I59bk%2FoFXgtez4KzTDxNbYDR8qViR1Nad9ZhVW0Jq3Hl9B6VS%2B%2FImg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 836fd6632c8a367e-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEBNDBRBe1e5hVnbYV1xEiEA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 100B
Redirect Chain

https://trace.mediago.io/ju/cs/indexexchange
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=215&external_user_id=f5ef61ca4969583f2ideji00lq9kxq7t

43 B
730 B

23ms
23ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=215&external_user_id=f5ef61ca4969583f2ideji00lq9kxq7t
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RUo2b6WIN8hTiR5Ta41oNj3pQYY71Yb1QMZvIsKHOuSi3sW9gWbwuYTYYF0k0p3jedbQQOH9fSsd1ZaFiEbMx7qmuEY%2FIiRPM7Jakq%2B5ooix2GsIhi%2BSZEiMjALWv2Vz5etbZ3cK8M2gHw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 836fd6652ee7367e-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

date: Sun, 17 Dec 2023 14:25:48 GMT
via: 1.1 google
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain; charset=utf-8
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=215&external_user_id=f5ef61ca4969583f2ideji00lq9kxq7t
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 100B
Redirect Chain

https://dmp.brand-display.com/cm/api/index?cm_dsp_id=191&cm_user_id=%3cIndex_user_id%3e
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=b1c49b22-6443-8104-9f700880

43 B
733 B

49ms
49ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=b1c49b22-6443-8104-9f700880
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VH7kTPLbDbs%2FpDaY5y2jJ4sJfQi%2BkIr7Gge%2B5R8nhNSgZ%2Be79CZyr4GVsmjbjnqdW5TEc1fVutn1Kd4gllMrbLSisSxC32R58zTAewZdnhR7guf5cFWLlZ5SJri1Jm%2FIMyt9mF4C2KlG9g%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 836fd663bd32367e-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

date: Sun, 17 Dec 2023 14:25:48 GMT
via: 1.1 google
server: nginx/1.24.0
p3p: CP='This is not a P3P policy!'
access-control-allow-origin: *
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=b1c49b22-6443-8104-9f700880
content-type: text/html; charset=utf-8
cache-control: max-age=3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 146

GET
H2 200 tp_out
d.adroll.com/cm/index/ Frame 100B 42 B
181 B 95ms
31ms Image
image/gif 2a05:d018:cc3:fe05:360d:1e8d:2547:a624
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/index/tp_out?advertisable=3GMDZMBFQREVBC75SYYKWH
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d018:cc3:fe05:360d:1e8d:2547:a624 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.22.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:48 GMT
cache-control: no-transform,public,max-age=300,s-maxage=900
server: nginx/1.22.1
content-length: 42
vary: Cookie
content-type: image/gif

GET
H2

200

crum
dsum-sec.casalemedia.com/ Frame 100B
Redirect Chain

https://p.rfihub.com/cm?in=1&pub=2079
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=5133329529377752620

43 B
535 B

25ms
25ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=5133329529377752620
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H2
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lV9R3i%2B9xJG6PwNpmd7eLDCqFdcI5ia60hftV6Q27MJzSsVBq6iLYb0EmYdgA7D3G9M2NmmkqGvSERyKv00vqG3n9pczojUE9aVr1mB4kR1D3WRGXUg42Nd0ErYTP%2BofGCOetqv%2FvqfPMA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 836fd66308994d93-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=5133329529377752620
Date: Sun, 17 Dec 2023 14:25:47 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 sync
ads.servenobid.com/ Frame 100B 0
357 B 32ms
31ms Image
image/avif 54.246.183.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=333&uid=ZX8E610oMwor7LZ28VWlvQAABIkAAAAB
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.246.183.131 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-246-183-131.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:47 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 060E
Redirect Chain

https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
https://usersync.gumgum.com/usersync?b=apn&i=7491557740204511050

35 B
250 B

119ms
30ms

Image
image/gif

34.247.233.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=apn&i=7491557740204511050
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 34.247.233.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-247-233-198.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Sun, 17 Dec 2023 14:25:48 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:48 GMT
an-x-request-uuid: 32c14fa8-1145-462d-bb0e-862782498cd7
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://usersync.gumgum.com/usersync?b=apn&i=7491557740204511050
x-proxy-origin: 45.141.152.72; 45.141.152.72; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sync
x.bidswitch.net/ Frame 060E
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=e_65b8fba7-41c3-4e29-b93c-47542d300a02&gdpr=0&gdpr_consent=&us_privacy=1---
https://x.bidswitch.net/ul_cb/sync?ssp=gumgum2&user_id=e_65b8fba7-41c3-4e29-b93c-47542d300a02&gdpr=0&gdpr_consent=&us_privacy=1---
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=gumgum2&bsw_custom_parameter=cdad3522-902e-4c1c-ac2b-7a5fff9b9401
https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=gumgum2&bsw_custom_parameter=cdad3522-902e-4c1c-ac2b-7a5fff9b9401
https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=ba7180b5-a048-415d-b75b-51bfb87b83e2&user_group=1&ssp=gumgum2&bsw_param=cdad3522-902e-4c1c-ac2b-7a5fff9b9401

43 B
145 B

7ms
7ms

Image
image/gif

18.185.66.38
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=ba7180b5-a048-415d-b75b-51bfb87b83e2&user_group=1&ssp=gumgum2&bsw_param=cdad3522-902e-4c1c-ac2b-7a5fff9b9401
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 18.185.66.38 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-185-66-38.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:48 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

Redirect headers

location: //x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=ba7180b5-a048-415d-b75b-51bfb87b83e2&user_group=1&ssp=gumgum2&bsw_param=cdad3522-902e-4c1c-ac2b-7a5fff9b9401
date: Sun, 17 Dec 2023 14:25:48 GMT
cache-control: no-cache, no-store, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 060E
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://usersync.gumgum.com/usersync?b=opx&i=29535442-e39e-4b61-a420-bcd05e51f2ac

35 B
250 B

92ms
33ms

Image
image/gif

34.247.233.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=opx&i=29535442-e39e-4b61-a420-bcd05e51f2ac
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 34.247.233.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-247-233-198.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Sun, 17 Dec 2023 14:25:48 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Sun, 17 Dec 2023 14:25:48 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://usersync.gumgum.com/usersync?b=opx&i=29535442-e39e-4b61-a420-bcd05e51f2ac
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 060E
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sta&i=0-424ecd0e-23ed-533c-74e6-7c2cfef60731$ip$45.141.152.72

35 B
250 B

30ms
30ms

Image
image/gif

34.247.233.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sta&i=0-424ecd0e-23ed-533c-74e6-7c2cfef60731$ip$45.141.152.72
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 34.247.233.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-247-233-198.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Sun, 17 Dec 2023 14:25:48 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=sta&i=0-424ecd0e-23ed-533c-74e6-7c2cfef60731$ip$45.141.152.72
Date: Sun, 17 Dec 2023 14:25:48 GMT
Connection: keep-alive
Content-Length: 127
Content-Type: text/html; charset=utf-8

GET
H2 200 gumgum
pr-bh.ybp.yahoo.com/sync/ Frame 060E 43 B
426 B 105ms
33ms Image
image/gif 2a05:d018:d29:3602:b72b:cd0:cea1:c93f
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=

Requested by

Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d018:d29:3602:b72b:cd0:cea1:c93f Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:48 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 060E
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=1---&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fuser...
https://usersync.gumgum.com/usersync?b=vnt&i=8a4d8579-5dbb-48fc-9bda-4d05608eb3a7

35 B
250 B

34ms
33ms

Image
image/gif

34.247.233.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=vnt&i=8a4d8579-5dbb-48fc-9bda-4d05608eb3a7
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 34.247.233.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-247-233-198.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Sun, 17 Dec 2023 14:25:48 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=vnt&i=8a4d8579-5dbb-48fc-9bda-4d05608eb3a7
Date: Sun, 17 Dec 2023 14:25:48 GMT
Connection: keep-alive
X-CI-RTID: ea971617-5a2c-4e01-a1c3-ff7d026b4fd8
Content-Length: 108
Content-Type: text/html; charset=utf-8

GET
H2 200 142
match.deepintent.com/usersync/ Frame 060E 0
44 B 284ms
92ms Image
text/plain 38.91.45.7
DEEPINTENT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.deepintent.com/usersync/142?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Ddit%26i%3D%24%7BDI_USER_ID%7D
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 38.91.45.7 Ashburn, United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
Software: a /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:48 GMT
content-length: 0
server: a

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 060E
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=e_65b8fba7-41c3-4e29-b93c-47542d300a02&gdpr=0&gdpr_consent=&us_privacy=1---&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__
https://b1sync.zemanta.com/usersync/gumgum/?cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__&gdpr=0&gdpr_consent=&puid=e_65b8fba7-41c3-4e29-b93c-47542d300a02&s=2&us_privacy=...
https://usersync.gumgum.com/usersync?b=zem&i=KygyzdCjjUkOmIZpwJ_X&gdpr=0&us_privacy=1---

35 B
250 B

31ms
30ms

Image
image/gif

34.247.233.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=zem&i=KygyzdCjjUkOmIZpwJ_X&gdpr=0&us_privacy=1---
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 34.247.233.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-247-233-198.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Sun, 17 Dec 2023 14:25:48 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
Date: Sun, 17 Dec 2023 14:25:48 GMT
Content-Type: text/html; charset=utf-8
Location: https://usersync.gumgum.com/usersync?b=zem&i=KygyzdCjjUkOmIZpwJ_X&gdpr=0&us_privacy=1---
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 123
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

200

usersync
rtb.gumgum.com/ Frame 060E
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&us_privacy=${us_privacy}&gpp=$&gpp_sid=$&rurl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://rtb.gumgum.com/usersync?b=pln&i=Dfk1l5GJB5J7&ev=1&gpp_sid=$&gpp=$&us_privacy=${us_privacy}&pid=558355

35 B
208 B

54ms
37ms

Image
image/gif

54.194.188.15
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=pln&i=Dfk1l5GJB5J7&ev=1&gpp_sid=$&gpp=$&us_privacy=${us_privacy}&pid=558355
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 54.194.188.15 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-188-15.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 14:25:48 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: de-DE
location: https://rtb.gumgum.com/usersync?b=pln&i=Dfk1l5GJB5J7&ev=1&gpp_sid=$&gpp=$&us_privacy=${us_privacy}&pid=558355
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-db744d8c7-r24pv
expires: -1

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 060E
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sad&i=642373309530972651

35 B
250 B

102ms
29ms

Image
image/gif

34.247.233.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sad&i=642373309530972651
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 34.247.233.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-247-233-198.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Sun, 17 Dec 2023 14:25:48 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=sad&i=642373309530972651
date: Sun, 17 Dec 2023 14:25:47 GMT
content-length: 0

GET
H2 200 sync
ads.servenobid.com/ Frame 060E 0
358 B 33ms
31ms Image
image/avif 54.246.183.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=309&uid=e_65b8fba7-41c3-4e29-b93c-47542d300a02
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.246.183.131 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-246-183-131.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:48 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame C453
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=1301&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=1301&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=adf&i=7555437590891647914&gdpr=0&gdpr_consent=

35 B
208 B

37ms
37ms

Document
image/gif

54.194.188.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=adf&i=7555437590891647914&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.188.15 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-188-15.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
content-length: 35
content-type: image/gif;charset=UTF-8
date: Sun, 17 Dec 2023 14:25:48 GMT
expires: 0
pragma: no-cache
server: nginx
timing-allow-origin: *

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Sun, 17 Dec 2023 14:25:48 GMT
expires: -1
location: https://rtb.gumgum.com/usersync?b=adf&i=7555437590891647914&gdpr=0&gdpr_consent=
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H3 200 pixel Show response
cm.g.doubleclick.net/ Frame 6C5C 170 B
188 B 18ms
17ms Document
image/png 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV82NWI4ZmJhNy00MWMzLTRlMjktYjkzYy00NzU0MmQzMDBhMDI=&gdpr=0&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv

Requested by

Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 170
content-type: image/png
cross-origin-resource-policy: cross-origin
date: Sun, 17 Dec 2023 14:25:48 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame F23D 16 KB
6 KB 13ms
13ms Document
text/html 23.35.236.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-201.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 8e53e50181b7a9e2caa94173c37fcd9de8fa75750764a2ad8ad02fac3306d652

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=29904
content-encoding: gzip
content-length: 5622
content-type: text/html
date: Sun, 17 Dec 2023 14:25:48 GMT
expires: Sun, 17 Dec 2023 22:44:12 GMT
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 generic Show response
match.adsrvr.org/track/cmf/ Frame FA56 70 B
149 B 101ms
30ms Document
image/gif 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 70
content-type: image/gif
date: Sun, 17 Dec 2023 14:25:48 GMT
server: Kestrel

GET idsync
tg.socdm.com/aux/ Frame 9BB9 0
0

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame FD8C
Redirect Chain

https://creativecdn.com/cm-notify?pi=gumgum
https://creativecdn.com/cm-notify?pi=gumgum&tc=1
https://usersync.gumgum.com/usersync?b=rth&i=dCBjWyWaHyl6xxkcx4cqli38_aDKPsZv2PmPA39dZJ4&pi=gumgum&tc=1

35 B
250 B

31ms
31ms

Document
image/gif

34.247.233.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=rth&i=dCBjWyWaHyl6xxkcx4cqli38_aDKPsZv2PmPA39dZJ4&pi=gumgum&tc=1
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.247.233.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-247-233-198.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Sun, 17 Dec 2023 14:25:48 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Sun, 17 Dec 2023 14:25:48 GMT Sun, 17 Dec 2023 14:25:48 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://usersync.gumgum.com/usersync?b=rth&i=dCBjWyWaHyl6xxkcx4cqli38_aDKPsZv2PmPA39dZJ4&pi=gumgum&tc=1
pragma: no-cache

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 2CE7
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

281 B
555 B

7ms
7ms

Document
text/html

95.101.149.233
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.149.233 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-101-149-233.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Sun, 17 Dec 2023 14:25:48 GMT
ETag: "280525-119-60930cbd3cec0"
Last-Modified: Thu, 02 Nov 2023 19:57:23 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Sun, 17 Dec 2023 14:25:48 GMT
location: https://eus.rubiconproject.com/usync.html?p=gumgum
server: AkamaiGHost

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 2CE7 45 KB
13 KB 7ms
7ms Script
text/html 95.101.149.233
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.149.233 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-101-149-233.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: ef99872383d06605558112058dcaf932036b3685ed092edace07b1266e4d39fc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Sun, 17 Dec 2023 14:25:48 GMT
Content-Encoding: gzip
Last-Modified: Sun, 17 Dec 2023 04:52:08 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=51963
Connection: keep-alive
Content-Length: 13201
Expires: Mon, 18 Dec 2023 04:51:51 GMT

GET
H2 200 sync
ads.servenobid.com/ Frame 7CE5 0
344 B 31ms
31ms Image
image/avif 54.246.183.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=317&uid=7122620197664006623&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.246.183.131 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-246-183-131.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:48 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H/1.1

200
OK

redir
rtb-csync.smartadserver.com/ Frame 7CE5
Redirect Chain

https://match.prod.bidr.io/cookie-sync/sas?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/sas?gdpr=0&gdpr_consent=&_bee_ppp=1
https://rtb-csync.smartadserver.com/redir?partneruserid=AADKNE7K_goAABRL6VN3QQ&partnerid=127&gdpr=0

43 B
428 B

15ms
15ms

Image
image/gif

5.135.209.104
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir?partneruserid=AADKNE7K_goAABRL6VN3QQ&partnerid=127&gdpr=0
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 5.135.209.104 , France, ASN16276 (OVH, FR),
Reverse DNS: ip104.ip-5-135-209.eu
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Sun, 17 Dec 2023 14:25:47 GMT
cache-control: no-cache,no-store
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location: https://rtb-csync.smartadserver.com/redir?partneruserid=AADKNE7K_goAABRL6VN3QQ&partnerid=127&gdpr=0
Date: Sun, 17 Dec 2023 14:25:48 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 7CE5
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=560288&ev=1&rurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D92%26partneruserid%3D%25%25VGUID%25%25&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=92&partneruserid=CFx2oqhoIzsK&ev=1&pid=560288&gdpr_consent=&gdpr=0

43 B
401 B

77ms
15ms

Image
image/gif

5.135.209.104
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=92&partneruserid=CFx2oqhoIzsK&ev=1&pid=560288&gdpr_consent=&gdpr=0
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 5.135.209.104 , France, ASN16276 (OVH, FR),
Reverse DNS: ip104.ip-5-135-209.eu
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Sun, 17 Dec 2023 14:25:47 GMT
cache-control: no-cache,no-store
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: de-DE
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=92&partneruserid=CFx2oqhoIzsK&ev=1&pid=560288&gdpr_consent=&gdpr=0
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-db744d8c7-5hxhh
expires: -1

GET
H2

204

v1
match.sharethrough.com/sync/ Frame 7CE5
Redirect Chain

https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=139&partneruserid=0&redirurl=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3D98KUz37ype9D3X2sf9ovgeTt%26source_user_id%3DS...
https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=7122620197664006623&gdpr=0&gdpr_consent=

0
34 B

7ms
7ms

Image
text/plain

18.198.194.114
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=7122620197664006623&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H2
Server: 18.198.194.114 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-198-194-114.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:48 GMT

Redirect headers

location: https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=7122620197664006623&gdpr=0&gdpr_consent=
pragma: no-cache
date: Sun, 17 Dec 2023 14:25:47 GMT
cache-control: no-cache,no-store
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame 7CE5 70 B
148 B 61ms
31ms Image
image/gif 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=smart-adserver&ttd_tpi=1&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 14:25:48 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 2CE7 7 B
380 B 10ms
9ms XHR
application/json 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 81c2cbe50044dac07e1ac9ea9841ac415bdc38dd2f6b915ab044bf69ee71c628

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 4b510f0cc5fcbc9800016ef543086418
Expires: 0

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame BA13 0
595 B 7ms
7ms Script
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS