xem.li Open in urlscan Pro
116.118.49.216 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://xem.li/3cnFC
Submission: On September 19 via automatic, source openphish (September 19th 2023, 1:34:22 am UTC) — Scanned from DE

Summary HTTP 90 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 16 IPs in 4 countries across 11 domains to perform 90 HTTP transactions. The main IP is 116.118.49.216, located in Ho Chi Minh City, Viet Nam and belongs to AZDIGI-AS-VN AZDIGI Corporation, VN. The main domain is xem.li.

This is the only time xem.li was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
13	116.118.49.216 116.118.49.216	63760 (AZDIGI-AS...) (AZDIGI-AS-VN AZDIGI Corporation)
1	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
11	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	2a00:1450:400... 2a00:1450:4001:800::2002	15169 (GOOGLE) (GOOGLE)
1	52.92.165.130 52.92.165.130	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
14	2a00:1450:400... 2a00:1450:4001:82a::200e	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:81c::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:802::2004	15169 (GOOGLE) (GOOGLE)
2	2a02:2638:d::4 2a02:2638:d::4	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
17	2a02:2638:3::3 2a02:2638:3::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	178.250.7.9 178.250.7.9	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	2a02:2638:3::1a 2a02:2638:3::1a	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
90	16

13 116.118.49.216 (Ho Chi Minh City, Viet Nam)

ASN63760 (AZDIGI-AS-VN AZDIGI Corporation, VN)

xem.li	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:800::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.92.165.130 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-us-west-2-r-w.amazonaws.com

integrately-images.s3-us-west-2.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a00:1450:4001:82a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:81c::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638:d::4 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

ads.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2a02:2638:3::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.7.9 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

cat.fr3.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638:3::1a (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

csm.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
19	criteo.net static.criteo.net — Cisco Umbrella Rank: 897 csm.eu.criteo.net — Cisco Umbrella Rank: 7577	39 KB
17	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 122 tpc.googlesyndication.com — Cisco Umbrella Rank: 169	299 KB
15	google.com fundingchoicesmessages.google.com — Cisco Umbrella Rank: 1673 www.google.com — Cisco Umbrella Rank: 11	63 KB
13	xem.li xem.li	86 KB
11	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 410	48 KB
4	criteo.com ads.eu.criteo.com — Cisco Umbrella Rank: 7499 cat.fr3.eu.criteo.com — Cisco Umbrella Rank: 8966	97 KB
4	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 66	35 KB
2	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 254	114 KB
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 1368	598 B
1	amazonaws.com integrately-images.s3-us-west-2.amazonaws.com	10 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 720	83 KB
90	11

	Domain	Requested by
17	static.criteo.net	ads.eu.criteo.com cdnjs.cloudflare.com static.criteo.net
14	fundingchoicesmessages.google.com	pagead2.googlesyndication.com
13	xem.li	xem.li
11	cdnjs.cloudflare.com	xem.li ads.eu.criteo.com
10	pagead2.googlesyndication.com	xem.li pagead2.googlesyndication.com tpc.googlesyndication.com
7	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com googleads.g.doubleclick.net
4	googleads.g.doubleclick.net	pagead2.googlesyndication.com
2	csm.eu.criteo.net	ads.eu.criteo.com
2	cat.fr3.eu.criteo.com	ads.eu.criteo.com
2	www.googletagservices.com	googleads.g.doubleclick.net
2	ads.eu.criteo.com	googleads.g.doubleclick.net
1	www.google.com	tpc.googlesyndication.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	integrately-images.s3-us-west-2.amazonaws.com	xem.li
1	ajax.googleapis.com	xem.li
90	15

This site contains links to these domains. Also see Links.

Domain
integrately.com
facebook.com

Subject Issuer	Validity	Valid
xem.li R3	`2023-08-31` - `2023-11-29`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
*.s3-us-west-2.amazonaws.com Amazon RSA 2048 M01	`2023-04-11` - `2023-12-28`	9 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
*.eu.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-19` - `2023-10-21`	3 months	crt.sh
*.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-08-05` - `2023-10-31`	3 months	crt.sh
*.fr3.eu.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-08-05` - `2023-10-29`	3 months	crt.sh
*.eu.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-08-08` - `2023-11-08`	3 months	crt.sh

This page contains 9 frames:

Primary Page: http://xem.li/3cnFC
Frame ID: CD0C23D589DD806261680AE3C90FEC99
Requests: 51 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230914/r20190131/zrt_lookup.html
Frame ID: 023E35BAF92CA53B6B69EBBCBB26BECE
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6688819605898177&output=html&adk=293675617&adf=814277786&lmt=1695080056&plat=1%3A16777216%2C2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=212x675_l%7C212x675_r&format=0x0&url=http%3A%2F%2Fxem.li%2F3cnFC&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1&dt=1695087256606&bpp=4&bdt=1468&idt=285&shv=r20230914&mjsv=m202309120101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1281676713987&frm=20&pv=2&ga_vid=1202818184.1695087257&ga_sid=1695087257&ga_hid=2106947905&ga_fc=0&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31077970%2C42531706%2C44801485%2C31076997&oid=2&pvsid=3622015565562956&tmod=1436483263&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=23&ifi=1&uci=a!1&fsb=1&dtd=315
Frame ID: 8117EE4961A57E8FB41B59E31C7EFB3E
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 0A0BCEF06F0C31F5DA716F55E23E2254
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 288BF5D1A34B0490D4DE14B3D3DBAFE3
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230914/r20110914/zrt_lookup.html?fsb=1
Frame ID: 6F51399A7203AC58D1E140EECA3991E0
Requests: 4 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230914/r20110914/zrt_lookup.html?fsb=1
Frame ID: 98ECCBF337EDFE9883F2F86FD1C274C1
Requests: 4 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=ZQj6mAAO0tkKmpWPAARxaCep4TN7-mVbKZHwaw&u=%7C3HPphDqSPZKrW6dvEIuFhr5kPMA2W9aM6ilWfY%2FRQCQ%3D%7C&c1=TEbw32HdmhlTb08vzaRE0-J3aJQULXRb6S19EAZ80X2gBTzv4Dq5xMxb2AiDpyinZYbjjDWoUakywjYenlSNcek6oZZCdZfougulzPZzzSupVQdmTJnWQvBG_Aq5lRr60D6Ypobnpz7ubBwzOgkfrb13hjFL1rzvO9FalKnmtW5g26V4qcmjJyMZTuSWBZDZRIJesZY0hpNkABRerp3rRxVS31VgnIUxfOFELXfY9tb6XfyOna9WBRRCW441AiMgjdbmSog8v-IupXDcOR9h4Q4KLl0j6O1FSqWQLouAKqPj86pPLxtExA7BmXA1zf3lmY28Cl4mrkivUmorgVeS-YATpgH3OFBI-ZU4TGzYvYp9cc1otx824PSvmiFcU5hgMC_PhnHpxYtHhMY5S3uIT3REF6cz7ujxyrSgoZiWoe6ruQmDSp4VW2ZnbRxLRxzic12avS5ToXhcDFA-ljBx21yKGlaDj0KU1vrEDR-vivNdBhpQL9ZGYro1dAxuHL5VzMPJNFz-FlieS39ocwbsxZEOt5G5t2ajiayEFKFW57q-ihfmd8BQVi5YcY8JXSFpWsgd_0O5n6vgVKvE3A1lO045VvJDNXX3KZ2RGSbCbR7Gz5oEFptrsA_B7xxRtLJyiVpM-dzfyHfj3R8gvNgXZIM0TC57GEG8&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC0KfjmPoIZdmlO4-r6gTo4pHQA8me0rFc9ZHevrEBwI23ARABIABglcKmgrAHggEXY2EtcHViLTY2ODg4MTk2MDU4OTgxNzfIAQmpAtJLWfee7bE-qAMByAMCqgTUAU_QL-2uPtIqYnnPKpdMnPG0PPEwmhYrNBZQTh9KTd4mnrcvUHDJv6ZkpPlzTNmdBB9UNx23vnSNcOVWqIJPz4Lm0pTNDS3H5Y73EZvWBnMCtBDx701BJgFBXa7OVVIn9txDy8Unl8RJVlUT0C1iQWmrLuTtymZ48Vl7u87zi1cab03TNdV7gmTvXSt-jck6vy5tuRlc1e-ilni2yLk4g-1LFA47SpvNeUtW42BUiZl5iMaI1-ZNc2cU2yqIFlEbIh06x8bGAxuqwaT1fKuiE8bmxDmRgAarn6nN2qLi9SegBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggUCIDhgBAQATICqgI6AoBASL39wTr6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0EvcAyq2NB80eD1y087MX49jnJ-A%26client%3Dca-pub-6688819605898177%26adurl%3D
Frame ID: 05BC09C96687B27835EA42656BDC12DC
Requests: 14 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=ZQj6mAAO0toKmpWPAARxaAEgwLRb0k6AjVvt1g&u=%7C3HPphDqSPZKAvR6HsuwfysiurpZ7c2jn9ngRwGr6Vgc%3D%7C&c1=d4_i42wbpE2NRhSHxThdXdeadzG9gosNTJmLEv97WHnUtKOrKYxIg_Yv4RnZRq4P_PySyhhQairi-eDLwKj_TxsjMnoTLheSwC537KIEz7-jy69cDhuUOrsEiCpSnwSSWZs72R2DyKr_pGnTuaamLCdesaeh2Q1n_JjTwUlkOfc5bHPfyRVIVoIfu5QAtWrsogwFHn39JY0BVpcJ3m4ki1gAbgGYuQszAGpoIS_7YmPgPkdpS-mqPW5WwbqTzM-yI1W1Dg_euV3uMwv0NEyDhy6bsTQgY5Cwrwo4udskhPe6SFGULvVJMqsZWebo__t4w4GISxlma45LPPk4J5DmaIgi3JNUWYoaBQdKt5AUS8KX3-PQJKJPapEKL-Ate5RNxMXS0QKgG8mVeGRia_h3_eRUNBGIaa_RzFjbQpaCpasZHSqi7K1EZku-bJnSvkO0BVYqZRYEQlb2g9joq_EbuGtMrkG3yYWikBJTxpbCrAnvQRZCc0o3Cg52oBwxUdaJ7ApWCdfQ_Elmstd4XAuRMLeYQ3l5z6Ts1h_UJJe6C8ndJe8hR_gtHZri1QFK8TjhAxTBIXhRgEW7G_8cZIVLePZcos5rhFJ9vh-Re39-BjoZVWaXun1FOhjExNLJvBvnKmU5T1HjkxEKQJzvzNGQcrnHk2CMqWi4nROpjeaK_xg&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCLk5UmPoIZdqlO4-r6gTo4pHQA8me0rFc9ZHevrEBwI23ARABIABglcKmgrAHggEXY2EtcHViLTY2ODg4MTk2MDU4OTgxNzfIAQmpAtJLWfee7bE-qAMByAMCqgTUAU_QfZDriKDIUXG4jGjZqAB3uD9lA7L2Pp1uPeK2mZyWgqz6uPSkMz47RO6R_XkXuFPWd0Y1pIQaCBdswrrfss-8j79BO6k5hVPuJCPXdtYXO5M2fYL5WESEq4G0spYXzJTD444IEvwZI86wpGSQFPWZkcTh-Pc6PD_5XBU8vZbYVSI_aWKBXTA1o0uC3F6Wc1S5XyOA1M4A7NNuPa8F0oXA4VfZdeFBaqQPRFVMDUvGcvbp1ReQDMDvdBJsK-W4dsNqc8oTtlsH7aSwbwwa5zZgiIuTgAakj5-zoIrx7cwBoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFAiA4YAQEAEyAqoCOgKAQEi9_cE6-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_0cXMNUDl1qAaiI2kV8HRVXkWY9rQ%26client%3Dca-pub-6688819605898177%26adurl%3D
Frame ID: 7E5DA0B043A3D0E9BC302E7FD1118408
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Không tìm thấy trang - RÚT GỌN LINK (FREE)

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Clipboard.js (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

clipboard(?:-([\d.]+))?(?:\.min)?\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

OWL Carousel (Widgets) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*href="[^"]+owl\.carousel(?:\.min)?\.css
owl\.carousel.*\.js

Osano (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cookieconsent\.min\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery DevBridge Autocomplete (JavaScript libraries) Expand

Overall confidence: 100%
Detected patterns

/jquery\.devbridge-autocomplete/([0-9.]+)/jquery\.autocomplete(?:.min)?\.js

Page Statistics

90
Requests

89 %
HTTPS

80 %
IPv6

11
Domains

15
Subdomains

16
IPs

4
Countries

875 kB
Transfer

2509 kB
Size

5
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://integrately.com/?ref=yugove&utm_campaign=Website%20Referral

Search URL Search Domain Scan URL

URL: https://facebook.com/QuanChatbot

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 9

http://cdnjs.cloudflare.com/ajax/libs/chosen/1.1.0/chosen.jquery.min.js?v=1.1.0 HTTP 307
https://cdnjs.cloudflare.com/ajax/libs/chosen/1.1.0/chosen.jquery.min.js?v=1.1.0

Request Chain 10

http://cdnjs.cloudflare.com/ajax/libs/iCheck/1.0.1/icheck.min.js?v=1.0.1 HTTP 307
https://cdnjs.cloudflare.com/ajax/libs/iCheck/1.0.1/icheck.min.js?v=1.0.1

Request Chain 12

http://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.js?v=3.0.3 HTTP 307
https://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.js?v=3.0.3

Request Chain 13

http://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.css?v=3.0.3 HTTP 307
https://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.css?v=3.0.3

Request Chain 15

http://cdnjs.cloudflare.com/ajax/libs/pace/0.4.17/pace.js?v=0.4.17 HTTP 307
https://cdnjs.cloudflare.com/ajax/libs/pace/0.4.17/pace.js?v=0.4.17

Request Chain 21

http://cdnjs.cloudflare.com/ajax/libs/typed.js/2.0.6/typed.min.js HTTP 307
https://cdnjs.cloudflare.com/ajax/libs/typed.js/2.0.6/typed.min.js

90 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 404
Not Found Primary Request 3cnFC Show response
xem.li/ 10 KB
4 KB 556ms
320ms Document
text/html 116.118.49.216
AZDIGI-AS-VN AZDI...

General

Check archive.org

Show headers Download Go to

Full URL: http://xem.li/3cnFC
Protocol: HTTP/1.1
Server: 116.118.49.216 Ho Chi Minh City, Viet Nam, ASN63760 (AZDIGI-AS-VN AZDIGI Corporation, VN),
Reverse DNS
Software: Apache /
Resource Hash: 154409993d79f4db1f5e469a67e72d61bcd2f037770b03fd2d3d9a8edb5491b4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Upgrade, close
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Tue, 19 Sep 2023 01:34:14 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: Apache
Transfer-Encoding: chunked
Upgrade: h2
Vary: Accept-Encoding

GET
H2 200 bootstrap.min.css
xem.li/static/css/ 89 KB
15 KB 801ms
398ms Stylesheet
text/css 116.118.49.216
AZDIGI-AS-VN AZDI...

General

Check archive.org

Show headers Download Go to

Full URL: https://xem.li/static/css/bootstrap.min.css
Requested by: Host: xem.li
URL: http://xem.li/3cnFC
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 116.118.49.216 Ho Chi Minh City, Viet Nam, ASN63760 (AZDIGI-AS-VN AZDIGI Corporation, VN),
Reverse DNS
Software: Apache /
Resource Hash: fa9a3880a0d54a4bd990e2f63278be581b068336f34a39863e47ba65774d82d7

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:15 GMT
content-encoding: gzip
last-modified: Tue, 20 Oct 2020 10:07:32 GMT
server: Apache
etag: "16322-5b21766308100-gzip"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 15395

GET
H2 200 style-blue.css
xem.li/themes/saas/assets/css/ 114 KB
16 KB 996ms
592ms Stylesheet
text/css 116.118.49.216
AZDIGI-AS-VN AZDI...

General

Check archive.org

Show headers Download Go to

Full URL: https://xem.li/themes/saas/assets/css/style-blue.css
Requested by: Host: xem.li
URL: http://xem.li/3cnFC
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 116.118.49.216 Ho Chi Minh City, Viet Nam, ASN63760 (AZDIGI-AS-VN AZDIGI Corporation, VN),
Reverse DNS
Software: Apache /
Resource Hash: e628b651c2431daea8d1fe939cace6a7fc1bead807b93c8fc83e9ade79ed0f97

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:15 GMT
content-encoding: gzip
last-modified: Thu, 12 Nov 2020 08:53:08 GMT
server: Apache
etag: "1c773-5b3e50a76e500-gzip"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 15733

GET
H2 200 components.min.css
xem.li/static/css/ 19 KB
3 KB 801ms
398ms Stylesheet
text/css 116.118.49.216
AZDIGI-AS-VN AZDI...

General

Check archive.org

Show headers Download Go to

Full URL: https://xem.li/static/css/components.min.css
Requested by: Host: xem.li
URL: http://xem.li/3cnFC
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 116.118.49.216 Ho Chi Minh City, Viet Nam, ASN63760 (AZDIGI-AS-VN AZDIGI Corporation, VN),
Reverse DNS
Software: Apache /
Resource Hash: 3c19df610d2b937c34facbe5517c48054fd3695a18e69fa1ac94084aa61d5079

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:15 GMT
content-encoding: gzip
last-modified: Tue, 20 Oct 2020 10:07:32 GMT
server: Apache
etag: "4b63-5b21766308100-gzip"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 2715

GET
H2 200 fa-all.min.css
xem.li/static/css/ 56 KB
12 KB 800ms
397ms Stylesheet
text/css 116.118.49.216
AZDIGI-AS-VN AZDI...

General

Check archive.org

Show headers Download Go to

Full URL: https://xem.li/static/css/fa-all.min.css
Requested by: Host: xem.li
URL: http://xem.li/3cnFC
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 116.118.49.216 Ho Chi Minh City, Viet Nam, ASN63760 (AZDIGI-AS-VN AZDIGI Corporation, VN),
Reverse DNS
Software: Apache /
Resource Hash: 74d66add22660b12e57cf4a9e1c2fe4fcc8708e052ec75b62b1e9428968fc90d

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:15 GMT
content-encoding: gzip
last-modified: Tue, 20 Oct 2020 10:07:32 GMT
server: Apache
etag: "df60-5b21766308100-gzip"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 12412

GET
H/1.1 200
OK jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.0.3/ 82 KB
83 KB 118ms
39ms Script
text/javascript 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://ajax.googleapis.com/ajax/libs/jquery/2.0.3/jquery.min.js

Requested by

Host: xem.li
URL: http://xem.li/3cnFC

Protocol

HTTP/1.1

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a57b5242b9a9adc4c1ef846c365147b89c472b9cd770face331efcb965346b25

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

Date: Mon, 18 Sep 2023 18:19:27 GMT
X-Content-Type-Options: nosniff
Age: 26088
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
Cross-Origin-Resource-Policy: cross-origin
Content-Length: 83606
X-XSS-Protection: 0
Last-Modified: Tue, 03 Mar 2020 19:15:00 GMT
Server: sffe
Cross-Origin-Opener-Policy: same-origin; report-to="hosted-libraries-pushers"
Vary: Accept-Encoding
Report-To: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
Content-Type: text/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000, stale-while-revalidate=2592000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Expires: Tue, 17 Sep 2024 18:19:27 GMT

GET
H2 200 bootstrap.min.js Show response
xem.li/static/ 3 KB
1 KB 603ms
201ms Script
application/javascript 116.118.49.216
AZDIGI-AS-VN AZDI...

General

Check archive.org

Show headers Download Go to

Full URL: https://xem.li/static/bootstrap.min.js
Requested by: Host: xem.li
URL: http://xem.li/3cnFC
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 116.118.49.216 Ho Chi Minh City, Viet Nam, ASN63760 (AZDIGI-AS-VN AZDIGI Corporation, VN),
Reverse DNS
Software: Apache /
Resource Hash: 1f7244cb694f7f667a5f3668a79844fc6159e3922363f0423d9b09872680f372

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:15 GMT
content-encoding: gzip
last-modified: Tue, 20 Oct 2020 10:07:32 GMT
server: Apache
etag: "d61-5b21766308100-gzip"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 1263

GET
H2 200 application.fn.js Show response
xem.li/static/ 4 KB
1 KB 795ms
393ms Script
application/javascript 116.118.49.216
AZDIGI-AS-VN AZDI...

General

Check archive.org

Show headers Download Go to

Full URL: https://xem.li/static/application.fn.js
Requested by: Host: xem.li
URL: http://xem.li/3cnFC
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 116.118.49.216 Ho Chi Minh City, Viet Nam, ASN63760 (AZDIGI-AS-VN AZDIGI Corporation, VN),
Reverse DNS
Software: Apache /
Resource Hash: fc6c45fb43f51dfc76b7770b2e751e3400575327793dcd1eb257373af7857627

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:15 GMT
content-encoding: gzip
last-modified: Tue, 20 Oct 2020 10:07:32 GMT
server: Apache
etag: "118f-5b21766308100-gzip"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 1387

GET
H2 200 owl.carousel.min.css
cdnjs.cloudflare.com/ajax/libs/OwlCarousel2/2.3.4/assets/ 3 KB
1 KB 140ms
50ms Stylesheet
text/css 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/OwlCarousel2/2.3.4/assets/owl.carousel.min.css

Requested by

Host: xem.li
URL: http://xem.li/3cnFC

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

521410e1fc44780061e09adc980275fb5ea277fd5d9e538454214ec4379ff4bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:15 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 13758847
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 845
last-modified: Mon, 04 May 2020 16:04:00 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03cf0-d17"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YZ9PoNLTZ%2FJSYlEnnInoAKCR%2FGLZYtZIJu67d%2FP3vZkElijNE6g9SnTvhDLxDkq1xmGPYlemBX66g4CyLrmp9r8kwJsjRcgT%2BRhgntADP%2BEXxHH92UMONL%2FYdICkTOfy2l%2FZs8QTiAvDQW1KwS9fm3Sn"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 808e15d14b135c80-FRA
expires: Sun, 08 Sep 2024 01:34:15 GMT

GET
H2 200 owl.carousel.min.js Show response
cdnjs.cloudflare.com/ajax/libs/OwlCarousel2/2.3.4/ 43 KB
10 KB 143ms
53ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/OwlCarousel2/2.3.4/owl.carousel.min.js

Requested by

Host: xem.li
URL: http://xem.li/3cnFC

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a53c43f834b32309b084ea9314df8307e9c78cee2202c6e07f216ae4ae5b704d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:15 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 5908715
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 10158
last-modified: Mon, 04 May 2020 16:04:00 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03cf0-ad36"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K95SgpohCb2A%2BwShIkRbIEDLTPR%2F5TTOLHpK07n1O%2FjWp8QKmhHisTu%2BxuJe671saEFydEgaHWiEocsPIYS841qma6MXepSRKaA8BZGdVjQjI%2BjMIDJNuX1Vn5LFr%2FJ%2BVKrsySKBelNcr%2FF%2FIXKOVpgC"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 808e15d14b155c80-FRA
expires: Sun, 08 Sep 2024 01:34:15 GMT

GET
H2

200

chosen.jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/chosen/1.1.0/
Redirect Chain

http://cdnjs.cloudflare.com/ajax/libs/chosen/1.1.0/chosen.jquery.min.js?v=1.1.0
https://cdnjs.cloudflare.com/ajax/libs/chosen/1.1.0/chosen.jquery.min.js?v=1.1.0

26 KB
6 KB

141ms
55ms

Script
application/javascript

2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/chosen/1.1.0/chosen.jquery.min.js?v=1.1.0

Requested by

Host: xem.li
URL: http://xem.li/3cnFC

Protocol

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5c7e07dfb2d7437793e8b1ed577739a8bd55558df14aa7234714675ba53f71ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:15 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 3186957
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 5485
last-modified: Thu, 22 Jun 2023 10:55:27 GMT
server: cloudflare
cf-cdnjs-via: cfworker/r2
etag: "6494289f-156d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8086nzTLqficp0aL4nesYyiFNsDbjfeiXPfGjLV2PP9oYkKYx%2FNyLy6p%2Bpg3V%2B93wOQsPr26Ji8C8MRBjhefCfcjRH3PkfM2UWp3TXrQb5emd%2FOEu7F4BcPCoG%2FhPJC6wkxt7QRq9vqoa2f9AmwGfs6T"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 808e15d14b175c80-FRA
expires: Sun, 08 Sep 2024 01:34:15 GMT

Redirect headers

Location: https://cdnjs.cloudflare.com/ajax/libs/chosen/1.1.0/chosen.jquery.min.js?v=1.1.0
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H2

200

icheck.min.js Show response
cdnjs.cloudflare.com/ajax/libs/iCheck/1.0.1/
Redirect Chain

http://cdnjs.cloudflare.com/ajax/libs/iCheck/1.0.1/icheck.min.js?v=1.0.1
https://cdnjs.cloudflare.com/ajax/libs/iCheck/1.0.1/icheck.min.js?v=1.0.1

4 KB
3 KB

139ms
54ms

Script
application/javascript

2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/iCheck/1.0.1/icheck.min.js?v=1.0.1

Requested by

Host: xem.li
URL: http://xem.li/3cnFC

Protocol

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6102d725c22f9bf27ef542ceae070843153f3e0926b89820a75f29b107e33cb2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:15 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 3959441
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1908
last-modified: Tue, 01 Aug 2023 15:38:18 GMT
server: cloudflare
cf-cdnjs-via: cfworker/r2
etag: "64c926ea-774"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Icugg0ltYtqEQDXAAObYlo1Ey4O8Ul%2F%2Bl4z2n3uUwHaB1mNHTTh0ba8jjDnCJaKpOdAaV9toOU2SkP2Kzf%2FRvyl87%2F31p3CzsXxHimfYwhTN0H%2BBTjQJ6FzmHIqKCQw443Uj0dL26KxOXqI%2FYSkJxCgu"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 808e15d14b185c80-FRA
expires: Sun, 08 Sep 2024 01:34:15 GMT

Redirect headers

Location: https://cdnjs.cloudflare.com/ajax/libs/iCheck/1.0.1/icheck.min.js?v=1.0.1
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H2 200 clipboard.min.js Show response
cdnjs.cloudflare.com/ajax/libs/clipboard.js/1.5.15/ 10 KB
3 KB 173ms
83ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/clipboard.js/1.5.15/clipboard.min.js?v=1.5.15

Requested by

Host: xem.li
URL: http://xem.li/3cnFC

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

08e5970dcee7ecf02ab04df2d6be02568a71594f4923491e9f3e8ae3306a853f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:15 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 7588166
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 2906
last-modified: Mon, 04 May 2020 16:09:13 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e29-2824"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ili1SLP7fsM3bCA4kgHBqHiVRx1pBpYnMPvObtC2Q46gKRitNkesic1QYf2o7yn6NWm1HMlt%2BKiKudN0VA38reuJzStxki%2FGE1ujJux2X6qF6ow429KKsAbyguMkXhKLwqiwjCXYEFk6mIPKLenkPnA5"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 808e15d18b515c80-FRA
expires: Sun, 08 Sep 2024 01:34:15 GMT

GET
H2

200

cookieconsent.min.js Show response
cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/
Redirect Chain

http://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.js?v=3.0.3
https://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.js?v=3.0.3

19 KB
6 KB

134ms
49ms

Script
application/javascript

2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.js?v=3.0.3

Requested by

Host: xem.li
URL: http://xem.li/3cnFC

Protocol

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

af4c6683814aa527caf53bde3d021e6aafe00833b45f2dead043c87ed7864674

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:15 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 4693356
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 5676
last-modified: Thu, 22 Jun 2023 10:57:54 GMT
server: cloudflare
cf-cdnjs-via: cfworker/r2
etag: "64942932-162c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Aql8pGTE5o%2FhMkdNGLtnZYjPHApS68RHQ0X0RDMptIExarkiDaq3Tnr5ZTrM5ZlLINLC6PRygFu2CpAYlT%2Bo9chqbGDx16y3IDwnBr5KlElQ2BVWeyo284IlFeE8EHK%2FdfSSchwmc%2BwHPqe59dx37%2FNa"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 808e15d14b165c80-FRA
expires: Sun, 08 Sep 2024 01:34:15 GMT

Redirect headers

Location: https://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.js?v=3.0.3
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H2

200

cookieconsent.min.css
cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/
Redirect Chain

http://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.css?v=3.0.3
https://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.css?v=3.0.3

4 KB
1 KB

138ms
52ms

Stylesheet
text/css

2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.css?v=3.0.3

Requested by

Host: xem.li
URL: http://xem.li/3cnFC

Protocol

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

456ab1a71507ed91abae14c9d08faffb373a7bc711a66e44341b7b8b7bb72ab4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:15 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1883389
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 948
last-modified: Thu, 22 Jun 2023 10:57:54 GMT
server: cloudflare
cf-cdnjs-via: cfworker/r2
etag: "64942932-3b4"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4E3lURoWAfNFAfPVPXVJtYAKBYJ4%2Fa82ZRijKIwqbKcMlaszyRSpE4ngAsST%2BkH5Ldm8zsa91osWqt2u21BnSXcs1NaAt1VH8qrsN0xQenb3JcRtqzvig8974eyYNjRkmOkKkAD0%2BoatZjgc7x8tgj%2F4"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 808e15d14b145c80-FRA
expires: Sun, 08 Sep 2024 01:34:15 GMT

Redirect headers

Location: https://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.css?v=3.0.3
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H2 200 jquery.autocomplete.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery.devbridge-autocomplete/1.4.10/ 13 KB
4 KB 140ms
51ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery.devbridge-autocomplete/1.4.10/jquery.autocomplete.min.js?v=1.1.5

Requested by

Host: xem.li
URL: http://xem.li/3cnFC

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c6ff6d4624a5c8140cbc19107aa372a233907f8e6e4d55d002d20cae682a575f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:15 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 3486419
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 3857
last-modified: Thu, 22 Jun 2023 11:06:02 GMT
server: cloudflare
cf-cdnjs-via: cfworker/r2
etag: "64942b1a-f11"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X8F%2FkPZrKmgKs0oaywC8gg%2FOyrpKt2%2BMmS5kBaRCYnXqDVrLuu3WcXzi3f2zPLEHZBJfJTpCnQfTbmSsgsNu2QZjtefUpjHF1Mjqox1zwOAQjwKTQK3L9Qst1aS5YOQofSzFNLvLehbGfn4ixDhN6Uer"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 808e15d14b1a5c80-FRA
expires: Sun, 08 Sep 2024 01:34:15 GMT

GET
H2

200

pace.js Show response
cdnjs.cloudflare.com/ajax/libs/pace/0.4.17/
Redirect Chain

http://cdnjs.cloudflare.com/ajax/libs/pace/0.4.17/pace.js?v=0.4.17
https://cdnjs.cloudflare.com/ajax/libs/pace/0.4.17/pace.js?v=0.4.17

25 KB
5 KB

137ms
52ms

Script
application/javascript

2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/pace/0.4.17/pace.js?v=0.4.17

Requested by

Host: xem.li
URL: http://xem.li/3cnFC

Protocol

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a898f00aabf0e5632b47a59e092c4662c8cbda0c33ea6d0d424cbced57e3ee72

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:15 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 11245836
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 5158
last-modified: Mon, 04 May 2020 16:13:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03f40-621b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wcsoXxpy%2FJg%2BbC55vYaCPjiIcB3FDnRtD2KBZkA1gpa%2BS51Pl7L0OnICZAIuNaPSNpmzqD7T2TypKp2511Jl2W%2BPelt8sHhqGeLwu7sgaR%2Fgj0SeSOS9%2FvyIKcD%2BzodTrwuw82SaAF2J4vyKIYCSZK7t"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 808e15d14b195c80-FRA
expires: Sun, 08 Sep 2024 01:34:15 GMT

Redirect headers

Location: https://cdnjs.cloudflare.com/ajax/libs/pace/0.4.17/pace.js?v=0.4.17
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H2 200 application.js Show response
xem.li/static/ 20 KB
5 KB 793ms
393ms Script
application/javascript 116.118.49.216
AZDIGI-AS-VN AZDI...

General

Check archive.org

Show headers Download Go to

Full URL: https://xem.li/static/application.js
Requested by: Host: xem.li
URL: http://xem.li/3cnFC
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 116.118.49.216 Ho Chi Minh City, Viet Nam, ASN63760 (AZDIGI-AS-VN AZDIGI Corporation, VN),
Reverse DNS
Software: Apache /
Resource Hash: 2433d15cf3fc19f8f5cafb0ac8bfa2a3eea71cea8c41b3e4a7ee84252a33bb1c

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:15 GMT
content-encoding: gzip
last-modified: Tue, 20 Oct 2020 10:07:32 GMT
server: Apache
etag: "4e63-5b21766308100-gzip"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 5197

GET
H2 200 server.js Show response
xem.li/static/ 12 KB
3 KB 603ms
203ms Script
application/javascript 116.118.49.216
AZDIGI-AS-VN AZDI...

General

Check archive.org

Show headers Download Go to

Full URL: https://xem.li/static/server.js
Requested by: Host: xem.li
URL: http://xem.li/3cnFC
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 116.118.49.216 Ho Chi Minh City, Viet Nam, ASN63760 (AZDIGI-AS-VN AZDIGI Corporation, VN),
Reverse DNS
Software: Apache /
Resource Hash: 7d11e7e384579b55d578f3aec8bf96ba7ab144a1f34e36451556019113bb2b5f

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:15 GMT
content-encoding: gzip
last-modified: Tue, 20 Oct 2020 10:07:32 GMT
server: Apache
etag: "3097-5b21766308100-gzip"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 2823

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 147 KB
50 KB 192ms
90ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6688819605898177

Requested by

Host: xem.li
URL: http://xem.li/3cnFC

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef6ecdddf1d9d855c98a99c63bb428b65d2c0398992c66699e1180ffb7ea675c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://xem.li/
Origin: http://xem.li
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:16 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50958
x-xss-protection: 0
server: cafe
etag: 9590581381872990039
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 19 Sep 2023 01:34:16 GMT

GET
H2 200 auto_site_logo.png
xem.li/content/ 21 KB
21 KB 199ms
197ms Image
image/png 116.118.49.216
AZDIGI-AS-VN AZDI...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xem.li/content/auto_site_logo.png
Requested by: Host: xem.li
URL: http://xem.li/3cnFC
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 116.118.49.216 Ho Chi Minh City, Viet Nam, ASN63760 (AZDIGI-AS-VN AZDIGI Corporation, VN),
Reverse DNS
Software: Apache /
Resource Hash: d2a5b93d1bc3164be402d701741e435ff33b7f5ac4afa4950b54b2ff571544c0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:16 GMT
last-modified: Fri, 25 Feb 2022 03:59:05 GMT
server: Apache
accept-ranges: bytes
etag: "54ed-5d8cfb8465440"
content-length: 21741
content-type: image/png

GET
H/1.1 200
OK we-automate-with-integrately-light.svg
integrately-images.s3-us-west-2.amazonaws.com/ 10 KB
10 KB 677ms
228ms Image
image/svg+xml 52.92.165.130
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://integrately-images.s3-us-west-2.amazonaws.com/we-automate-with-integrately-light.svg
Requested by: Host: xem.li
URL: http://xem.li/3cnFC
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.92.165.130 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-us-west-2-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: db80a874ac33abe17f2f34b9bc6b462b81f15a49e9214b1074a69639c57e7431

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

Date: Tue, 19 Sep 2023 01:34:17 GMT
Last-Modified: Fri, 07 May 2021 06:43:49 GMT
Server: AmazonS3
x-amz-request-id: 2AW8DBMZR733ZYMF
ETag: "d591c70641b8a62f85ccd1cc7ed08985"
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 10134
x-amz-id-2: bP8hXPDThK/11OaVf6ZSzNZA3pBhOmU+8c7DwEj7+tbZ/1SyPsIIL7JzZjdlO3vjPAY5dxUhEqg=

GET
H2

200

typed.min.js Show response
cdnjs.cloudflare.com/ajax/libs/typed.js/2.0.6/
Redirect Chain

http://cdnjs.cloudflare.com/ajax/libs/typed.js/2.0.6/typed.min.js
https://cdnjs.cloudflare.com/ajax/libs/typed.js/2.0.6/typed.min.js

11 KB
3 KB

48ms
47ms

Script
application/javascript

2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/typed.js/2.0.6/typed.min.js

Requested by

Host: xem.li
URL: http://xem.li/3cnFC

Protocol

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

960d3c7144bd7d1695869610cb719fa0d30c5ca692eb76e1497a96f0c7ee001c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:16 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 375207
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 3045
last-modified: Mon, 04 May 2020 16:17:20 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04010-2cc5"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1Riq5nGstrq6H%2FhEKn%2Fp9JIYfF0hoGIohdasTiQNRc8Z0GILe6TIE65T%2BTcU7g1Myskv8yvqitKpaOQK04vk02rqEJ1SHwn35O2rbFr5du%2Bk%2Fz0wz8zhLSP9pSRKRaSrfGNGUA0rVvYL5NVfWU%2F40Ist"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 808e15d6fd5d5c80-FRA
expires: Sun, 08 Sep 2024 01:34:16 GMT

Redirect headers

Location: https://cdnjs.cloudflare.com/ajax/libs/typed.js/2.0.6/typed.min.js
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H2 200 main.js Show response
xem.li/themes/saas/assets/js/ 4 KB
1 KB 200ms
199ms Script
application/javascript 116.118.49.216
AZDIGI-AS-VN AZDI...

General

Check archive.org

Show headers Download Go to

Full URL: https://xem.li/themes/saas/assets/js/main.js
Requested by: Host: xem.li
URL: http://xem.li/3cnFC
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 116.118.49.216 Ho Chi Minh City, Viet Nam, ASN63760 (AZDIGI-AS-VN AZDIGI Corporation, VN),
Reverse DNS
Software: Apache /
Resource Hash: 1b7fdf293f73edaa66c8540e356b9bd9d275586ded4dd7f9b5872d7d03319169

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:16 GMT
content-encoding: gzip
last-modified: Wed, 30 Jan 2019 12:31:42 GMT
server: Apache
etag: "e19-580ac17962780-gzip"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 1227

GET
H2 200 icons.css
xem.li/themes/saas/assets/css/ 16 KB
3 KB 201ms
199ms Stylesheet
text/css 116.118.49.216
AZDIGI-AS-VN AZDI...

General

Check archive.org

Show headers Download Go to

Full URL: https://xem.li/themes/saas/assets/css/icons.css
Requested by: Host: xem.li
URL: https://xem.li/themes/saas/assets/css/style-blue.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 116.118.49.216 Ho Chi Minh City, Viet Nam, ASN63760 (AZDIGI-AS-VN AZDIGI Corporation, VN),
Reverse DNS
Software: Apache /
Resource Hash: e8a90594cc8c2796c488059c7ee25ce6cc9de27c7ac359ee680b50a2bf438da6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://xem.li/themes/saas/assets/css/style-blue.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:16 GMT
content-encoding: gzip
last-modified: Tue, 20 Oct 2020 10:07:32 GMT
server: Apache
etag: "4033-5b21766308100-gzip"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 2974

GET
H2 200 responsive.css
xem.li/themes/saas/assets/css/ 581 B
459 B 199ms
198ms Stylesheet
text/css 116.118.49.216
AZDIGI-AS-VN AZDI...

General

Check archive.org

Show headers Download Go to

Full URL: https://xem.li/themes/saas/assets/css/responsive.css
Requested by: Host: xem.li
URL: https://xem.li/themes/saas/assets/css/style-blue.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 116.118.49.216 Ho Chi Minh City, Viet Nam, ASN63760 (AZDIGI-AS-VN AZDIGI Corporation, VN),
Reverse DNS
Software: Apache /
Resource Hash: d0e06d461fdcd36bcedbdf977452b522d0c89a06e11cd48be67a7cbdf772dd3f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://xem.li/themes/saas/assets/css/style-blue.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:16 GMT
content-encoding: gzip
last-modified: Tue, 20 Oct 2020 10:07:32 GMT
server: Apache
etag: "245-5b21766308100-gzip"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 382

GET themify.woff
xem.li/themes/saas/assets/css/fonts/ 0
0

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309120101/ 380 KB
129 KB 178ms
96ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309120101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6688819605898177&plah=xem.li

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6688819605898177

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2158c4c9892b2a94859c90120a00bbce1afb24a9d7f2915f36b46819330b7a4d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:16 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 131919
x-xss-protection: 0
server: cafe
etag: 12413169330174202323
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 19 Sep 2023 01:34:16 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230914/r20190131/ Frame 023E 10 KB
5 KB 127ms
39ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230914/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6688819605898177

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a011595b8a7a4aecacbb9bdd095cf4e446e368e8c897b2daf1807e6016137c1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://xem.li/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 23201
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4438
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 18 Sep 2023 19:07:35 GMT
etag: 8554266389219770021
expires: Mon, 02 Oct 2023 19:07:35 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 379 B
598 B 153ms
49ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=xem.li&callback=_gfp_s_&client=ca-pub-6688819605898177

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309120101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6688819605898177&plah=xem.li

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4136413b26b2bb4162d77c03ac4eefdf52ad9f4a080e46a14d345c5f2331ae72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 246
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 8117 127 KB
22 KB 620ms
619ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6688819605898177&output=html&adk=293675617&adf=814277786&lmt=1695080056&plat=1%3A16777216%2C2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=212x675_l%7C212x675_r&format=0x0&url=http%3A%2F%2Fxem.li%2F3cnFC&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1&dt=1695087256606&bpp=4&bdt=1468&idt=285&shv=r20230914&mjsv=m202309120101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1281676713987&frm=20&pv=2&ga_vid=1202818184.1695087257&ga_sid=1695087257&ga_hid=2106947905&ga_fc=0&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31077970%2C42531706%2C44801485%2C31076997&oid=2&pvsid=3622015565562956&tmod=1436483263&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=23&ifi=1&uci=a!1&fsb=1&dtd=315

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c25fe595b3c9a573a7e1a1a2ae85b60092292474b599824fb4bb8670c670e857

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://xem.li/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 22284
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 19 Sep 2023 01:34:17 GMT
expires: Tue, 19 Sep 2023 01:34:17 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 74ms
73ms Image
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&tn=DIV&cls=cc-window%20cc-floating%20cc-type-info%20cc-theme-classic%20cc-bottom%20cc-right%20cc-color-override-1971232268%20&ign=false&pw=1600&ph=1200&x=1575&y=1175

Requested by

Host: xem.li
URL: http://xem.li/3cnFC

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Sep 2023 01:34:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 74ms
74ms Image
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&tn=DIV&cls=pace-progress&ign=false&pw=1600&ph=1200&x=0&y=0

Requested by

Host: xem.li
URL: http://xem.li/3cnFC

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Sep 2023 01:34:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET themify.ttf
xem.li/themes/saas/assets/css/fonts/ 0
0

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 91ms
91ms XHR
application/json 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230914&st=env

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

be8da03b73cd9fa32f351d01327986e946ec34610ca3a3b260c28a726f432988

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:17 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12106
x-xss-protection: 0

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309120101/ 154 KB
52 KB 90ms
90ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309120101/reactive_library_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

98069a9ad4e606076d4eaddbd3d6e0fe37616d88caa9362490fac1396c1e72e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:17 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53715
x-xss-protection: 0
server: cafe
etag: 10273885966556185377
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Sep 2023 01:34:17 GMT

GET
H2 200 ca-pub-6688819605898177 Show response
fundingchoicesmessages.google.com/i/ 155 KB
51 KB 195ms
89ms Script
application/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/ca-pub-6688819605898177?ers=2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

81685b6633b8914f3e4bef17a8621658219d5d35a0ae5c073eb4b5f4cacfc360

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-a4l1-Q9Bcb5nsqfnbkkszw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:17 GMT
content-security-policy: script-src 'report-sample' 'nonce-a4l1-Q9Bcb5nsqfnbkkszw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 152ms
53ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 19 Sep 2023 01:34:17 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 0A0B 13 KB
5 KB 41ms
40ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://xem.li/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 33258
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 18 Sep 2023 16:19:59 GMT
expires: Tue, 17 Sep 2024 16:19:59 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 288B 829 B
1 KB 141ms
51ms Document
text/html 2a00:1450:4001:802::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

bf648e00e0af4671490d97824e4c8299680d0646fed8f90c69b92ee1ee3f0e7a

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-LxaJw_Z23z-36ZllFlcGwA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://xem.li/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 538
content-security-policy: script-src 'report-sample' 'nonce-LxaJw_Z23z-36ZllFlcGwA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 19 Sep 2023 01:34:17 GMT
expires: Tue, 19 Sep 2023 01:34:17 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230914/r20110914/ Frame 6F51 10 KB
4 KB 40ms
40ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230914/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a011595b8a7a4aecacbb9bdd095cf4e446e368e8c897b2daf1807e6016137c1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://xem.li/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 31245
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4438
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 18 Sep 2023 16:53:32 GMT
etag: 8554266389219770021
expires: Mon, 02 Oct 2023 16:53:32 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230914/r20110914/ Frame 98EC 10 KB
4 KB 41ms
39ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230914/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a011595b8a7a4aecacbb9bdd095cf4e446e368e8c897b2daf1807e6016137c1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://xem.li/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 31245
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4438
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 18 Sep 2023 16:53:32 GMT
etag: 8554266389219770021
expires: Mon, 02 Oct 2023 16:53:32 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 AGSKWxUSTeadwHEDyV-sLW7GAz0HIkQqmFljiNMPZ0j7f2zeW4wdVTrRSNrx2uNhkjdA1wH8ctLEFtbZNw3G2Y-tJqTkxnlCcJzH8yirHDGVLW4bDzwoP6CQBJA060FIT3t9uc95aohvZw== Show response
fundingchoicesmessages.google.com/f/ 4 KB
3 KB 68ms
67ms Script
application/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUSTeadwHEDyV-sLW7GAz0HIkQqmFljiNMPZ0j7f2zeW4wdVTrRSNrx2uNhkjdA1wH8ctLEFtbZNw3G2Y-tJqTkxnlCcJzH8yirHDGVLW4bDzwoP6CQBJA060FIT3t9uc95aohvZw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjk1MDg3MjU3LDg4MTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cDovL3hlbS5saS8zY25GQyIsbnVsbCxbWzgsIkh0c0p3WEpXdkt3Il0sWzksImRlIl0sWzE4LCJbW1swXV1dIl0sWzE2LCJbMSwxLDFdIl0sWzE5LCIyIl1dXQ

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.de.HtsJwXJWvKw.es5.O/d=1/rs=AJlcJMx3w9XPMe3K1-7x5AJCAdxoza0SbA/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

934881c9bb6fb93c12028bc27a577578dc9a02b3dfb5554fb6ce7b0fc14a05b5

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-BYN_LNOB_OThbkqqSUS50A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:17 GMT
content-security-policy: script-src 'report-sample' 'nonce-BYN_LNOB_OThbkqqSUS50A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 D38i8ocviMyns63bFlxz04547CGgVcdJsS8VZS_5djY.js Show response
pagead2.googlesyndication.com/bg/ Frame 0A0B 37 KB
14 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/D38i8ocviMyns63bFlxz04547CGgVcdJsS8VZS_5djY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f7f22f2872f88cca7b3addb165c73d38e78ec21a055c749b12f15652ff97636

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 22:50:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9850
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14739
x-xss-protection: 0
last-modified: Mon, 11 Sep 2023 20:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 17 Sep 2024 22:50:07 GMT

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 05BC 169 KB
54 KB 254ms
150ms Document
text/html 2a02:2638:d::4
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=ZQj6mAAO0tkKmpWPAARxaCep4TN7-mVbKZHwaw&u=%7C3HPphDqSPZKrW6dvEIuFhr5kPMA2W9aM6ilWfY%2FRQCQ%3D%7C&c1=TEbw32HdmhlTb08vzaRE0-J3aJQULXRb6S19EAZ80X2gBTzv4Dq5xMxb2AiDpyinZYbjjDWoUakywjYenlSNcek6oZZCdZfougulzPZzzSupVQdmTJnWQvBG_Aq5lRr60D6Ypobnpz7ubBwzOgkfrb13hjFL1rzvO9FalKnmtW5g26V4qcmjJyMZTuSWBZDZRIJesZY0hpNkABRerp3rRxVS31VgnIUxfOFELXfY9tb6XfyOna9WBRRCW441AiMgjdbmSog8v-IupXDcOR9h4Q4KLl0j6O1FSqWQLouAKqPj86pPLxtExA7BmXA1zf3lmY28Cl4mrkivUmorgVeS-YATpgH3OFBI-ZU4TGzYvYp9cc1otx824PSvmiFcU5hgMC_PhnHpxYtHhMY5S3uIT3REF6cz7ujxyrSgoZiWoe6ruQmDSp4VW2ZnbRxLRxzic12avS5ToXhcDFA-ljBx21yKGlaDj0KU1vrEDR-vivNdBhpQL9ZGYro1dAxuHL5VzMPJNFz-FlieS39ocwbsxZEOt5G5t2ajiayEFKFW57q-ihfmd8BQVi5YcY8JXSFpWsgd_0O5n6vgVKvE3A1lO045VvJDNXX3KZ2RGSbCbR7Gz5oEFptrsA_B7xxRtLJyiVpM-dzfyHfj3R8gvNgXZIM0TC57GEG8&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC0KfjmPoIZdmlO4-r6gTo4pHQA8me0rFc9ZHevrEBwI23ARABIABglcKmgrAHggEXY2EtcHViLTY2ODg4MTk2MDU4OTgxNzfIAQmpAtJLWfee7bE-qAMByAMCqgTUAU_QL-2uPtIqYnnPKpdMnPG0PPEwmhYrNBZQTh9KTd4mnrcvUHDJv6ZkpPlzTNmdBB9UNx23vnSNcOVWqIJPz4Lm0pTNDS3H5Y73EZvWBnMCtBDx701BJgFBXa7OVVIn9txDy8Unl8RJVlUT0C1iQWmrLuTtymZ48Vl7u87zi1cab03TNdV7gmTvXSt-jck6vy5tuRlc1e-ilni2yLk4g-1LFA47SpvNeUtW42BUiZl5iMaI1-ZNc2cU2yqIFlEbIh06x8bGAxuqwaT1fKuiE8bmxDmRgAarn6nN2qLi9SegBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggUCIDhgBAQATICqgI6AoBASL39wTr6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0EvcAyq2NB80eD1y087MX49jnJ-A%26client%3Dca-pub-6688819605898177%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230914/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:d::4 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

74acff700e5b6f1e2c35dc17aa1456914e1c5ccbfdc7600e281408d379fcd559

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Tue, 19 Sep 2023 01:34:17 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=AnLfSjLpYqWfYmWaGrdlW2LKA0HaesHGIlN4srJM--wWf-mKWgR3g1axsS6OEuPTvsuL6kEQibgQTDChxyA17mFjRgPIF6fn7W9lmWu5ZYROGr3vpfEhgvvDGAyA-_TB059ya7EtdqDmDvz72ewGW71GK3GhrOUiNPVhN7HpI8guV4oRvUJHPpS2WQGEf7bk6tNR5S7JDNZ91D9j3Hr7XNp00ZseEjRrhYaNi0FfvRKzNv3dWM0lbhoGAQ4YYuMtOUDEXQ"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 43541295
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230914/r20110914/client/ Frame 6F51 3 KB
1 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230914/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230914/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 14:16:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40663
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 02 Oct 2023 14:16:34 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230914/r20110914/client/ Frame 6F51 20 KB
8 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230914/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230914/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

096862e95687fa095052acf06c643d97aebf5a75bdb39f85061a931076b5c12e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 14:16:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40664
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8275
x-xss-protection: 0
server: cafe
etag: 7349537481621356269
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 02 Oct 2023 14:16:33 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6F51 182 KB
57 KB 143ms
50ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230914/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

04d75f9be78718605473f6f76319f2120d63e73e3c789b2b41d78896cbe13f63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57988
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1694604874705780"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Sep 2023 01:34:18 GMT

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 7E5D 120 KB
42 KB 163ms
78ms Document
text/html 2a02:2638:d::4
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=ZQj6mAAO0toKmpWPAARxaAEgwLRb0k6AjVvt1g&u=%7C3HPphDqSPZKAvR6HsuwfysiurpZ7c2jn9ngRwGr6Vgc%3D%7C&c1=d4_i42wbpE2NRhSHxThdXdeadzG9gosNTJmLEv97WHnUtKOrKYxIg_Yv4RnZRq4P_PySyhhQairi-eDLwKj_TxsjMnoTLheSwC537KIEz7-jy69cDhuUOrsEiCpSnwSSWZs72R2DyKr_pGnTuaamLCdesaeh2Q1n_JjTwUlkOfc5bHPfyRVIVoIfu5QAtWrsogwFHn39JY0BVpcJ3m4ki1gAbgGYuQszAGpoIS_7YmPgPkdpS-mqPW5WwbqTzM-yI1W1Dg_euV3uMwv0NEyDhy6bsTQgY5Cwrwo4udskhPe6SFGULvVJMqsZWebo__t4w4GISxlma45LPPk4J5DmaIgi3JNUWYoaBQdKt5AUS8KX3-PQJKJPapEKL-Ate5RNxMXS0QKgG8mVeGRia_h3_eRUNBGIaa_RzFjbQpaCpasZHSqi7K1EZku-bJnSvkO0BVYqZRYEQlb2g9joq_EbuGtMrkG3yYWikBJTxpbCrAnvQRZCc0o3Cg52oBwxUdaJ7ApWCdfQ_Elmstd4XAuRMLeYQ3l5z6Ts1h_UJJe6C8ndJe8hR_gtHZri1QFK8TjhAxTBIXhRgEW7G_8cZIVLePZcos5rhFJ9vh-Re39-BjoZVWaXun1FOhjExNLJvBvnKmU5T1HjkxEKQJzvzNGQcrnHk2CMqWi4nROpjeaK_xg&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCLk5UmPoIZdqlO4-r6gTo4pHQA8me0rFc9ZHevrEBwI23ARABIABglcKmgrAHggEXY2EtcHViLTY2ODg4MTk2MDU4OTgxNzfIAQmpAtJLWfee7bE-qAMByAMCqgTUAU_QfZDriKDIUXG4jGjZqAB3uD9lA7L2Pp1uPeK2mZyWgqz6uPSkMz47RO6R_XkXuFPWd0Y1pIQaCBdswrrfss-8j79BO6k5hVPuJCPXdtYXO5M2fYL5WESEq4G0spYXzJTD444IEvwZI86wpGSQFPWZkcTh-Pc6PD_5XBU8vZbYVSI_aWKBXTA1o0uC3F6Wc1S5XyOA1M4A7NNuPa8F0oXA4VfZdeFBaqQPRFVMDUvGcvbp1ReQDMDvdBJsK-W4dsNqc8oTtlsH7aSwbwwa5zZgiIuTgAakj5-zoIrx7cwBoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFAiA4YAQEAEyAqoCOgKAQEi9_cE6-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_0cXMNUDl1qAaiI2kV8HRVXkWY9rQ%26client%3Dca-pub-6688819605898177%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230914/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:d::4 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

5b1642eed0f9aac493928915a41f4d38a14e17166dbade3d38d152999dcc7944

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Tue, 19 Sep 2023 01:34:17 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=t9V8uDLpYqWfYmWalsNJLeilp8vD8xcre2VZG6mSc2vVOabz3lGq__r7G0aRwvkqNJtRlBsJsqpPegmdpo9TiJERwKJQ82AU1rBVNcXGtYyqX7E2LloeFeR0CBuPH8Ux_6yWGnNTvDGVQzUrT9sRkYm2O8UVluWBc9grDMWucOA465np5makNwgvvDhVLXyvGqo-QJrfBe45IBKo1ukhi9wNpyI35hLghZTiNqHz9CeK-9ZtlgO9gBlQT7oVl-fSuhi7lw"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 14911688
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230914/r20110914/client/ Frame 98EC 3 KB
1 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230914/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230914/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 14:16:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40663
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 02 Oct 2023 14:16:34 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230914/r20110914/client/ Frame 98EC 20 KB
8 KB 41ms
39ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230914/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230914/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

096862e95687fa095052acf06c643d97aebf5a75bdb39f85061a931076b5c12e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 14:16:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40664
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8275
x-xss-protection: 0
server: cafe
etag: 7349537481621356269
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 02 Oct 2023 14:16:33 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 98EC 182 KB
57 KB 187ms
115ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230914/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

04d75f9be78718605473f6f76319f2120d63e73e3c789b2b41d78896cbe13f63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57988
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1694604874705780"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Sep 2023 01:34:18 GMT

POST
H3 204 AGSKWxWkyhy7yLZSbi68hv2OyQen_3bqGQbWcxIBr9ovphPERIWDyqwEObR7PCbiZJY2B4pqj64tvwmZluXHy79vO3-P8DGlM10-DKsKG3ba5ia0d46er5nn_vf0qG8kJRYOKQOx-nCb3A== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 141ms
60ms XHR
text/html 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWkyhy7yLZSbi68hv2OyQen_3bqGQbWcxIBr9ovphPERIWDyqwEObR7PCbiZJY2B4pqj64tvwmZluXHy79vO3-P8DGlM10-DKsKG3ba5ia0d46er5nn_vf0qG8kJRYOKQOx-nCb3A==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-T1X2xT7Z7frErmDmhQiiFg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://xem.li/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 19 Sep 2023 01:34:18 GMT
content-security-policy: script-src 'report-sample' 'nonce-T1X2xT7Z7frErmDmhQiiFg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: http://xem.li
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxUqf-49cG2wKLCoRi4-1nA2rWG_ZMjxwEv3EmZGmQZGi0bnXf-242rSF1YFqwzw-EHhxVM1sSmUxXS_K7q-U3L2yzACw_qTr_ZPAuzyz2mOOLEfI4W_SP5jWafzzdQr7kjkUBrd7g== Show response
fundingchoicesmessages.google.com/f/ 13 KB
6 KB 82ms
81ms Script
application/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUqf-49cG2wKLCoRi4-1nA2rWG_ZMjxwEv3EmZGmQZGi0bnXf-242rSF1YFqwzw-EHhxVM1sSmUxXS_K7q-U3L2yzACw_qTr_ZPAuzyz2mOOLEfI4W_SP5jWafzzdQr7kjkUBrd7g==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjk1MDg3MjU3LDk5ODAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsMTBdXSwiaHR0cDovL3hlbS5saS8zY25GQyIsbnVsbCxbWzgsIkh0c0p3WEpXdkt3Il0sWzksImRlIl0sWzE4LCJbW1swXV1dIl0sWzE2LCJbMSwxLDFdIl0sWzE5LCIyIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

bd30abcef85d1ce7c7d870dc5792255321828590d8f5cc6a42a834fe6167a96f

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-hvv8eWfQ-gsdh3kiaaC3zA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:18 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-hvv8eWfQ-gsdh3kiaaC3zA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 288B 0
0 73ms
72ms Image
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230914&jk=3622015565562956&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 0A0B 0
10 B 39ms
39ms Image
text/plain 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?oShVvg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:18 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 7E5D 2 KB
1 KB 206ms
83ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=ZQj6mAAO0toKmpWPAARxaAEgwLRb0k6AjVvt1g&u=%7C3HPphDqSPZKAvR6HsuwfysiurpZ7c2jn9ngRwGr6Vgc%3D%7C&c1=d4_i42wbpE2NRhSHxThdXdeadzG9gosNTJmLEv97WHnUtKOrKYxIg_Yv4RnZRq4P_PySyhhQairi-eDLwKj_TxsjMnoTLheSwC537KIEz7-jy69cDhuUOrsEiCpSnwSSWZs72R2DyKr_pGnTuaamLCdesaeh2Q1n_JjTwUlkOfc5bHPfyRVIVoIfu5QAtWrsogwFHn39JY0BVpcJ3m4ki1gAbgGYuQszAGpoIS_7YmPgPkdpS-mqPW5WwbqTzM-yI1W1Dg_euV3uMwv0NEyDhy6bsTQgY5Cwrwo4udskhPe6SFGULvVJMqsZWebo__t4w4GISxlma45LPPk4J5DmaIgi3JNUWYoaBQdKt5AUS8KX3-PQJKJPapEKL-Ate5RNxMXS0QKgG8mVeGRia_h3_eRUNBGIaa_RzFjbQpaCpasZHSqi7K1EZku-bJnSvkO0BVYqZRYEQlb2g9joq_EbuGtMrkG3yYWikBJTxpbCrAnvQRZCc0o3Cg52oBwxUdaJ7ApWCdfQ_Elmstd4XAuRMLeYQ3l5z6Ts1h_UJJe6C8ndJe8hR_gtHZri1QFK8TjhAxTBIXhRgEW7G_8cZIVLePZcos5rhFJ9vh-Re39-BjoZVWaXun1FOhjExNLJvBvnKmU5T1HjkxEKQJzvzNGQcrnHk2CMqWi4nROpjeaK_xg&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCLk5UmPoIZdqlO4-r6gTo4pHQA8me0rFc9ZHevrEBwI23ARABIABglcKmgrAHggEXY2EtcHViLTY2ODg4MTk2MDU4OTgxNzfIAQmpAtJLWfee7bE-qAMByAMCqgTUAU_QfZDriKDIUXG4jGjZqAB3uD9lA7L2Pp1uPeK2mZyWgqz6uPSkMz47RO6R_XkXuFPWd0Y1pIQaCBdswrrfss-8j79BO6k5hVPuJCPXdtYXO5M2fYL5WESEq4G0spYXzJTD444IEvwZI86wpGSQFPWZkcTh-Pc6PD_5XBU8vZbYVSI_aWKBXTA1o0uC3F6Wc1S5XyOA1M4A7NNuPa8F0oXA4VfZdeFBaqQPRFVMDUvGcvbp1ReQDMDvdBJsK-W4dsNqc8oTtlsH7aSwbwwa5zZgiIuTgAakj5-zoIrx7cwBoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFAiA4YAQEAEyAqoCOgKAQEi9_cE6-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_0cXMNUDl1qAaiI2kV8HRVXkWY9rQ%26client%3Dca-pub-6688819605898177%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 13 Sep 2024 01:34:18 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 7E5D 2 KB
1 KB 167ms
45ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 13 Sep 2024 01:34:18 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 7E5D 308 B
637 B 166ms
43ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Fri, 13 Sep 2024 01:34:18 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 7E5D 293 B
621 B 166ms
44ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Fri, 13 Sep 2024 01:34:18 GMT

GET
H2 200 lg.php
cat.fr3.eu.criteo.com/delivery/ Frame 7E5D 43 B
348 B 164ms
51ms Image
image/gif 178.250.7.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.fr3.eu.criteo.com/delivery/lg.php?cppv=3&cpp=X-OPRW4JN0SBYuBOprvCplOgn0_qvQqJcuG1eeC9GO5Wm9XusTnFz1U7CyennTl8PzK1ZQHScCjkfTH4EVFN5A4s6u4i-yV78dKDKjPvJE1W-IWIAa5C1hsjnduWch1iGEqvoomtB8Xs3LpnscgUGQv3RIa0PjfvtD-DlqC8PslOQ1MNCObO_8wc1-terXb3ARLJYtg1LqAUz_yshsyGT7loZKUSEL8042M-I_tIliJKv-zdmOIRBPHk5E7c-7VjQ5CPSDHWkCT-yC-j5ObzvTOUAfHXGQgGre1PdxUWvsO6WZu9AZPStklCIfSxvoZvRyExalwdGXk_9EdK85QlC1toJoj5LXNmmsUjD41xhqI2iyu3MHhAxJw2Xq72bZPK7pmzDBz0s3wc2-9ilNXX83GiKH4qd_KKnFPwv67NIE1npqEcU2fDCbvA0jpj4PbG4HvD9g

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.7.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Sep 2023 01:34:17 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1957359
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 7E5D 12 KB
6 KB 108ms
49ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 13 Sep 2024 01:34:18 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 7E5D 0
127 B 150ms
45ms Ping
text/plain 2a02:2638:3::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=t9V8uDLpYqWfYmWalsNJLeilp8vD8xcre2VZG6mSc2vVOabz3lGq__r7G0aRwvkqNJtRlBsJsqpPegmdpo9TiJERwKJQ82AU1rBVNcXGtYyqX7E2LloeFeR0CBuPH8Ux_6yWGnNTvDGVQzUrT9sRkYm2O8UVluWBc9grDMWucOA465np5makNwgvvDhVLXyvGqo-QJrfBe45IBKo1ukhi9wNpyI35hLghZTiNqHz9CeK-9ZtlgO9gBlQT7oVl-fSuhi7lw&sds=2&rev=88356&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 19 Sep 2023 01:34:17 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 7E5D 2 KB
1 KB 115ms
84ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 13 Sep 2024 01:34:18 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 7E5D 2 KB
1 KB 52ms
52ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 13 Sep 2024 01:34:18 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 05BC 2 KB
1 KB 113ms
88ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=ZQj6mAAO0tkKmpWPAARxaCep4TN7-mVbKZHwaw&u=%7C3HPphDqSPZKrW6dvEIuFhr5kPMA2W9aM6ilWfY%2FRQCQ%3D%7C&c1=TEbw32HdmhlTb08vzaRE0-J3aJQULXRb6S19EAZ80X2gBTzv4Dq5xMxb2AiDpyinZYbjjDWoUakywjYenlSNcek6oZZCdZfougulzPZzzSupVQdmTJnWQvBG_Aq5lRr60D6Ypobnpz7ubBwzOgkfrb13hjFL1rzvO9FalKnmtW5g26V4qcmjJyMZTuSWBZDZRIJesZY0hpNkABRerp3rRxVS31VgnIUxfOFELXfY9tb6XfyOna9WBRRCW441AiMgjdbmSog8v-IupXDcOR9h4Q4KLl0j6O1FSqWQLouAKqPj86pPLxtExA7BmXA1zf3lmY28Cl4mrkivUmorgVeS-YATpgH3OFBI-ZU4TGzYvYp9cc1otx824PSvmiFcU5hgMC_PhnHpxYtHhMY5S3uIT3REF6cz7ujxyrSgoZiWoe6ruQmDSp4VW2ZnbRxLRxzic12avS5ToXhcDFA-ljBx21yKGlaDj0KU1vrEDR-vivNdBhpQL9ZGYro1dAxuHL5VzMPJNFz-FlieS39ocwbsxZEOt5G5t2ajiayEFKFW57q-ihfmd8BQVi5YcY8JXSFpWsgd_0O5n6vgVKvE3A1lO045VvJDNXX3KZ2RGSbCbR7Gz5oEFptrsA_B7xxRtLJyiVpM-dzfyHfj3R8gvNgXZIM0TC57GEG8&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC0KfjmPoIZdmlO4-r6gTo4pHQA8me0rFc9ZHevrEBwI23ARABIABglcKmgrAHggEXY2EtcHViLTY2ODg4MTk2MDU4OTgxNzfIAQmpAtJLWfee7bE-qAMByAMCqgTUAU_QL-2uPtIqYnnPKpdMnPG0PPEwmhYrNBZQTh9KTd4mnrcvUHDJv6ZkpPlzTNmdBB9UNx23vnSNcOVWqIJPz4Lm0pTNDS3H5Y73EZvWBnMCtBDx701BJgFBXa7OVVIn9txDy8Unl8RJVlUT0C1iQWmrLuTtymZ48Vl7u87zi1cab03TNdV7gmTvXSt-jck6vy5tuRlc1e-ilni2yLk4g-1LFA47SpvNeUtW42BUiZl5iMaI1-ZNc2cU2yqIFlEbIh06x8bGAxuqwaT1fKuiE8bmxDmRgAarn6nN2qLi9SegBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggUCIDhgBAQATICqgI6AoBASL39wTr6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0EvcAyq2NB80eD1y087MX49jnJ-A%26client%3Dca-pub-6688819605898177%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 13 Sep 2024 01:34:18 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 05BC 2 KB
1 KB 70ms
45ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 13 Sep 2024 01:34:18 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 05BC 308 B
636 B 103ms
84ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Fri, 13 Sep 2024 01:34:18 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 05BC 293 B
621 B 103ms
84ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Fri, 13 Sep 2024 01:34:18 GMT

GET
H2 200 lg.php
cat.fr3.eu.criteo.com/delivery/ Frame 05BC 43 B
347 B 61ms
52ms Image
image/gif 178.250.7.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.fr3.eu.criteo.com/delivery/lg.php?cppv=3&cpp=suqtSrtN-RQUOohkDdd_K8QTT37Ld0CbJRy_REVYDSUY7hiWXvVAHBhl5yUvYT6WiISFqs1sGzNm5JRvNURDb-FQTGJQY_bjx3xNJUvSwah1aG_RHgjxoIKtHRzNPwYRyaR_0eClpyFc4E-VPaeFoCet99tSk-TDoMvqYHnF4ZPkpyL87qJtC_tK9kkKKY2wI_5aETg-2dSQTV1qhjgWBRxoayCdCie1ypj5Hr2BHVQvYoSIxuKKhUpPKd8qqGVGiGRyQ_r5yvZIyC7Yz-jw7AdrzKnyrFfQWRDAD8MblvZvVk_G0d7GeeSJuZ2crmrdFtdbkPiqj6nl3R4eYulTJ9W5386Bo__yMiTRznLKJaOxLuqMfTb2yfk9u4p-L0jglyx6P7k8OelvNtPGMUql3DAr-fCn6SRtresqIUuQZdVze-dmYPm4-1VhbQV0V7pzUKuyoA

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.7.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Sep 2023 01:34:17 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1980785
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame 05BC 12 KB
5 KB 51ms
50ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:18 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 286674
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4420
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=slH7mfhvtRKLBgVs%2FGKV5kfntiNPg4WAKGPft7T3dfrNWdTY0%2BU1JGZJnkEF21f7P7HoVME0WzYA5kUKM34v5l9GChJ1thHTPipJ3h0pR3CC6MCqqJCJ8g14NAT3ZqCtbuyiYWrCtcM%2FINQZ0UarZFUX"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 808e15e428b99be8-FRA
expires: Sun, 08 Sep 2024 01:34:18 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 05BC 12 KB
6 KB 103ms
96ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 13 Sep 2024 01:34:18 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 05BC 0
128 B 120ms
45ms Ping
text/plain 2a02:2638:3::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=AnLfSjLpYqWfYmWaGrdlW2LKA0HaesHGIlN4srJM--wWf-mKWgR3g1axsS6OEuPTvsuL6kEQibgQTDChxyA17mFjRgPIF6fn7W9lmWu5ZYROGr3vpfEhgvvDGAyA-_TB059ya7EtdqDmDvz72ewGW71GK3GhrOUiNPVhN7HpI8guV4oRvUJHPpS2WQGEf7bk6tNR5S7JDNZ91D9j3Hr7XNp00ZseEjRrhYaNi0FfvRKzNv3dWM0lbhoGAQ4YYuMtOUDEXQ&sds=2&rev=88356&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 19 Sep 2023 01:34:17 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 05BC 2 KB
1 KB 89ms
87ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 13 Sep 2024 01:34:18 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 05BC 2 KB
1 KB 59ms
58ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 13 Sep 2024 01:34:18 GMT

GET
H2 200 montserrat-400.css
static.criteo.net/design/googlefont/montserrat/ Frame 05BC 2 KB
803 B 45ms
44ms Stylesheet
text/css 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/montserrat/montserrat-400.css

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a81d25118c6f7d835e9ca132b995b8aca46e3575ee4ab2136ab96ac8d5e4688b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:06:54 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391ef7e-675"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 13 Sep 2024 01:34:18 GMT

GET
H2 200 montserrat-700.css
static.criteo.net/design/googlefont/montserrat/ Frame 05BC 2 KB
803 B 50ms
49ms Stylesheet
text/css 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/montserrat/montserrat-700.css

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

77a44f65bb6894c92e3c7ccab98de0fc357172221cc1dd45949ab938c0c7756a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:06:55 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391ef7f-675"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 13 Sep 2024 01:34:18 GMT

GET
H2 200 montserrat-400-latin.woff2
static.criteo.net/design/googlefont/montserrat/ Frame 05BC 12 KB
13 KB 166ms
82ms Font
application/octet-stream 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/montserrat/montserrat-400-latin.woff2

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/design/googlefont/montserrat/montserrat-400.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

5f9376c77618bf0ef43bcabf8228c9e2befde3731087b944e140a88c34066873

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://static.criteo.net/design/googlefont/montserrat/montserrat-400.css
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:06:54 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391ef7e-31a4"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 13 Sep 2024 01:34:18 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 78ms
77ms Image
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230914&jk=3622015565562956&bg=!ysmlyYbNAAbP3fMH7907ADQBe5WfON7BoO-387cuaIsjhrQNT_36ihOOEsICtRmg0RsjYSpKUXPVx5M72X1wMWz1GvkIAgAAAIVSAAAACWgBB5kC3rkNl_mGR_9mSvaORbiqgJBN_bKCcq0QyQRzriPtMes7KXqZLv11YDrTsBSbph4aTT9TPGicHEkdPmc9WJlz0n0gi4FCOEp4VT-iTd72fLR8uf217MBu1lIl49UxR49Uq2wx4VHsgBdNdhc6rPVMUYaiem2aop2PR86xVesMiUTbbFJbhhCEEmWjesk0DY3TT6Yb2oz4NqdA4TDz0ru0ToO8T6LXQASwS0IuLp1SK9rWzDc1xGBUmGpnbuZnYZ-5PhToyJ184Qv878rErVqqnVNgrMYtmef4hAwVc3A_MHUEkzXLghXomxNwZ5qwBalMk-H1j1d1oFd2PjyClUkRyML9b8k1IynLoTUZCkgGu8EsRxi0BDX94Yi_VEftFRU5BSax7KXcTeY1D__ZXDqgpxxAgxyVrwKI9QmHXihm3Ndrcdi1pJXioHlYPBwC5PDAFggOxneF1P41ou3HehZAW9xxAP8bSKHuuJxShki7K98cLR13uaA5clkxGkpQQNZaSv5wXawh1xCFByyb7B6pY-zpIIFETg6YfU4NUiBDm4XgPVkAhtI6YvW_VIrtzaD-Gna9XPtI1sMODAqup-lqROkpFODlrKJsEoeoVnaq8ZdG5ppH1p8HceMSfxUlAGnL59ai3GSSpJ3uhjDYA6tRanTd3a0hldbwxQ8lTJMA8Z3whnpYj5KTuuecMUJTxsEscl7voCl9qn6V-ypyj1QoQpS-J5PlteQP19mNNWYEeyF15r-ff8qNwistmuB7CQLutqSnawZ_3VejNLqW15mxgBif5lrDKBj1IiVlI1Uu2lLCkAdxcD8JXLlsx6cwzK8wYQxcllHHrPOGKfoDW0Jird7jcC3i43Xmg53Uwgs12dk4YBXzjp5EytTG2GQxlEe9QAUlMwcU8hLk3ayfHRBVLmKJJe-3YOTSWYc3D90woBm4fNV4TaHkqMkwi1eBBg4Y7iDfbsIyvwwW1dflKieZ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

GET
H3 200 px.gif
fundingchoicesmessages.google.com/img/ 43 B
68 B 55ms
54ms Image
image/gif 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fundingchoicesmessages.google.com/img/px.gif?ch=1&rn=6.752257551776552

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-LmT0et1NKFZcnodmRQ8vag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:19 GMT
content-security-policy: script-src 'report-sample' 'nonce-LmT0et1NKFZcnodmRQ8vag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 px.gif
fundingchoicesmessages.google.com/img/ 43 B
68 B 92ms
91ms Image
image/gif 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fundingchoicesmessages.google.com/img/px.gif?ch=2&rn=8.162174273553452

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport, script-src 'report-sample' 'nonce-LYVz3xDiIivpwum_6Uw6iw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:19 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport, script-src 'report-sample' 'nonce-LYVz3xDiIivpwum_6Uw6iw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxWkyhy7yLZSbi68hv2OyQen_3bqGQbWcxIBr9ovphPERIWDyqwEObR7PCbiZJY2B4pqj64tvwmZluXHy79vO3-P8DGlM10-DKsKG3ba5ia0d46er5nn_vf0qG8kJRYOKQOx-nCb3A== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 54ms
54ms XHR
text/html 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWkyhy7yLZSbi68hv2OyQen_3bqGQbWcxIBr9ovphPERIWDyqwEObR7PCbiZJY2B4pqj64tvwmZluXHy79vO3-P8DGlM10-DKsKG3ba5ia0d46er5nn_vf0qG8kJRYOKQOx-nCb3A==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-7QywOPiGvT0IFjSZHeIWYg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://xem.li/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 19 Sep 2023 01:34:19 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-7QywOPiGvT0IFjSZHeIWYg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: http://xem.li
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads2_ Show response
fundingchoicesmessages.google.com/f/AGSKWxXE5jgRzMQ6R9opCmqEc23CNjhhPHIGzf2aNwKSZguthR1HmT81ic2DCxoSYUpwrvjf8t-p7eqihRoFKppXivqFmxM9wtr8Idfv7l37bLS1PaRzeKAebZDbaI2_7qo9ed8PdfzHaFq4UnZZwWOkpLrWRlVNg... 54 B
109 B 58ms
58ms Script
application/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXE5jgRzMQ6R9opCmqEc23CNjhhPHIGzf2aNwKSZguthR1HmT81ic2DCxoSYUpwrvjf8t-p7eqihRoFKppXivqFmxM9wtr8Idfv7l37bLS1PaRzeKAebZDbaI2_7qo9ed8PdfzHaFq4UnZZwWOkpLrWRlVNgR4OFXBO_2tmxnx0YQ6ngIEQOz9ek8CR/_/promobuttonad./AdformVideo_/ad/top1./googleaddfooter./ads2_

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.de.HtsJwXJWvKw.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_ccpa_signal_executable/ed=1/rs=AJlcJMx3w9XPMe3K1-7x5AJCAdxoza0SbA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

785a16698de18e34b11e17b3db3b83b2745d95ef2b64dd917187a39604813519

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-b2BEVyrU9zuwcgJyXP66sA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:19 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-b2BEVyrU9zuwcgJyXP66sA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 show_companion_ad.js Show response
pagead2.googlesyndication.com/pagead/ 29 KB
11 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_companion_ad.js?fcd=true

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5bd8959eab1b4f391347226aa92d2767fcf086a68d4a96971516632921e1c03c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 00:36:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3453
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11271
x-xss-protection: 0
server: cafe
etag: 7650991853485731369
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Tue, 19 Sep 2023 01:36:46 GMT

POST
H3 204 AGSKWxWkyhy7yLZSbi68hv2OyQen_3bqGQbWcxIBr9ovphPERIWDyqwEObR7PCbiZJY2B4pqj64tvwmZluXHy79vO3-P8DGlM10-DKsKG3ba5ia0d46er5nn_vf0qG8kJRYOKQOx-nCb3A== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 57ms
56ms XHR
text/html 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWkyhy7yLZSbi68hv2OyQen_3bqGQbWcxIBr9ovphPERIWDyqwEObR7PCbiZJY2B4pqj64tvwmZluXHy79vO3-P8DGlM10-DKsKG3ba5ia0d46er5nn_vf0qG8kJRYOKQOx-nCb3A==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-QMK602dIPaju0GzQd8SA-Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://xem.li/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 19 Sep 2023 01:34:19 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-QMK602dIPaju0GzQd8SA-Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: http://xem.li
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxWkyhy7yLZSbi68hv2OyQen_3bqGQbWcxIBr9ovphPERIWDyqwEObR7PCbiZJY2B4pqj64tvwmZluXHy79vO3-P8DGlM10-DKsKG3ba5ia0d46er5nn_vf0qG8kJRYOKQOx-nCb3A== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 58ms
58ms XHR
text/html 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWkyhy7yLZSbi68hv2OyQen_3bqGQbWcxIBr9ovphPERIWDyqwEObR7PCbiZJY2B4pqj64tvwmZluXHy79vO3-P8DGlM10-DKsKG3ba5ia0d46er5nn_vf0qG8kJRYOKQOx-nCb3A==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-D_9Lm7696qyG7Vu9doHZCA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://xem.li/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 19 Sep 2023 01:34:19 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-D_9Lm7696qyG7Vu9doHZCA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: http://xem.li
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxWkyhy7yLZSbi68hv2OyQen_3bqGQbWcxIBr9ovphPERIWDyqwEObR7PCbiZJY2B4pqj64tvwmZluXHy79vO3-P8DGlM10-DKsKG3ba5ia0d46er5nn_vf0qG8kJRYOKQOx-nCb3A== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 74ms
74ms XHR
text/html 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWkyhy7yLZSbi68hv2OyQen_3bqGQbWcxIBr9ovphPERIWDyqwEObR7PCbiZJY2B4pqj64tvwmZluXHy79vO3-P8DGlM10-DKsKG3ba5ia0d46er5nn_vf0qG8kJRYOKQOx-nCb3A==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-nxGVstgxP-0GaQbPeQOwWQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://xem.li/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 19 Sep 2023 01:34:19 GMT
content-security-policy: script-src 'report-sample' 'nonce-nxGVstgxP-0GaQbPeQOwWQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: http://xem.li
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxWkyhy7yLZSbi68hv2OyQen_3bqGQbWcxIBr9ovphPERIWDyqwEObR7PCbiZJY2B4pqj64tvwmZluXHy79vO3-P8DGlM10-DKsKG3ba5ia0d46er5nn_vf0qG8kJRYOKQOx-nCb3A== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 89ms
89ms XHR
text/html 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWkyhy7yLZSbi68hv2OyQen_3bqGQbWcxIBr9ovphPERIWDyqwEObR7PCbiZJY2B4pqj64tvwmZluXHy79vO3-P8DGlM10-DKsKG3ba5ia0d46er5nn_vf0qG8kJRYOKQOx-nCb3A==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-61bzj7tVVbYw3a7IThbDbw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://xem.li/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 19 Sep 2023 01:34:19 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-61bzj7tVVbYw3a7IThbDbw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: http://xem.li
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxX2YE3B364mInq82aC2pBVd69aGUCaY_p4GvStpTRgxmBfCDghHcdz9BDAnBJr4hCx8kb3PDJumX4WJ0BFgdCjhjBLF1zYxoGOb3RiBgvQNaiHmOPHuLQmRmyTcYh9YficDzZkCug== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 88ms
88ms Script
application/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxX2YE3B364mInq82aC2pBVd69aGUCaY_p4GvStpTRgxmBfCDghHcdz9BDAnBJr4hCx8kb3PDJumX4WJ0BFgdCjhjBLF1zYxoGOb3RiBgvQNaiHmOPHuLQmRmyTcYh9YficDzZkCug==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjk1MDg3MjU5LDg3OTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsMTAsNl0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHA6Ly94ZW0ubGkvM2NuRkMiLG51bGwsW1s4LCJIdHNKd1hKV3ZLdyJdLFs5LCJkZSJdLFsxOCwiW1tbMF1dXSJdLFsxNiwiWzEsMSwxXSJdLFsxOSwiMiJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2382b2492d0a618482b6e29be392b8f6499744c731c3cdd93c5960b3a7985185

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-GWiarQpgyyvZQQET0IwPHQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://xem.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 01:34:19 GMT
content-security-policy: script-src 'report-sample' 'nonce-GWiarQpgyyvZQQET0IwPHQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxWe8ziwjZv0tekbD5waYOBL39dASnPXZPmjuXfJCYhv_c-IVhtgfVv2Mmy35hUlEWyWzffTARhLJmICFcbFvMec4AOtVP5z77OhWRhVehD73dM7IA9AgOp3pn-tjhahe8XljgvE_w== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 53ms
53ms XHR
text/html 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWe8ziwjZv0tekbD5waYOBL39dASnPXZPmjuXfJCYhv_c-IVhtgfVv2Mmy35hUlEWyWzffTARhLJmICFcbFvMec4AOtVP5z77OhWRhVehD73dM7IA9AgOp3pn-tjhahe8XljgvE_w==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-Ly8VQXjETN2G7a2UACbVjg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://xem.li/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 19 Sep 2023 01:34:19 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-Ly8VQXjETN2G7a2UACbVjg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: http://xem.li
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: xem.li
URL: https://xem.li/themes/saas/assets/css/fonts/themify.woff?-fvbane

Domain: xem.li
URL: https://xem.li/themes/saas/assets/css/fonts/themify.ttf?-fvbane

Verdicts & Comments Add Verdict or Comment

86 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
xem.li/	1969-12-31 23:59:59	Name: PHPSESSID Value: t3he95crermalq2rvm31c5o47p
.xem.li/	1970-01-21 00:13:03	Name: __gads Value: ID=9dc799361002f8b8-22f48cc0ffe30030:T=1695087257:RT=1695087257:S=ALNI_MY-hS1Sm1gfdDZk7Gf8zuW2rWllIw
.xem.li/	1970-01-21 00:13:03	Name: __gpi Value: UID=00000d93c77f3be9:T=1695087257:RT=1695087257:S=ALNI_MbCkf_fZtKzHpzDQQqgfS5gHJ-YHw
.doubleclick.net/	1970-01-20 14:51:28	Name: test_cookie Value: CheckForPermission
.xem.li/	1970-01-20 23:37:03	Name: FCNEC Value: %5B%5B%22AKsRol-pQGU9TzcrrYDoU28crvtQyCoN0wx0da50yBlSfpMlfTntl5TjWQ6Ln9fW--Gn7iIu_glnZMURqN2VyrU4fL9rmpwLZZbn8ltEPQ029c4nX8UNZYcZrtGYuWezwXe8hD9m4MBEeFn6aPdjbvF_zrWin9MGAg%3D%3D%22%5D%2Cnull%2C%5B%5D%5D

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://xem.li/3cnFC Message: Failed to load resource: the server responded with a status of 404 (Not Found)
javascript	error	URL: http://xem.li/3cnFC Message: Access to font at 'https://xem.li/themes/saas/assets/css/fonts/themify.woff?-fvbane' from origin 'http://xem.li' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://xem.li/themes/saas/assets/css/fonts/themify.woff?-fvbane Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: http://xem.li/3cnFC Message: Access to font at 'https://xem.li/themes/saas/assets/css/fonts/themify.ttf?-fvbane' from origin 'http://xem.li' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://xem.li/themes/saas/assets/css/fonts/themify.ttf?-fvbane Message: Failed to load resource: net::ERR_FAILED
other	warning	URL: https://googleads.g.doubleclick.net/pagead/html/r20230914/r20110914/zrt_lookup.html?fsb=1(Line 20) Message: Origin trial controlled feature not enabled: 'attribution-reporting'.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.eu.criteo.com
ajax.googleapis.com
cat.fr3.eu.criteo.com
cdnjs.cloudflare.com
csm.eu.criteo.net
fundingchoicesmessages.google.com
googleads.g.doubleclick.net
integrately-images.s3-us-west-2.amazonaws.com
pagead2.googlesyndication.com
partner.googleadservices.com
static.criteo.net
tpc.googlesyndication.com
www.google.com
www.googletagservices.com
xem.li
xem.li
116.118.49.216
178.250.7.9
2606:4700::6811:190e
2a00:1450:4001:800::2002
2a00:1450:4001:802::2004
2a00:1450:4001:810::2002
2a00:1450:4001:81c::2001
2a00:1450:4001:827::2002
2a00:1450:4001:82a::200a
2a00:1450:4001:82a::200e
2a00:1450:4001:82b::2002
2a02:2638:3::1a
2a02:2638:3::3
2a02:2638:d::4
52.92.165.130
04d75f9be78718605473f6f76319f2120d63e73e3c789b2b41d78896cbe13f63
08e5970dcee7ecf02ab04df2d6be02568a71594f4923491e9f3e8ae3306a853f
095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6
096862e95687fa095052acf06c643d97aebf5a75bdb39f85061a931076b5c12e
0f7f22f2872f88cca7b3addb165c73d38e78ec21a055c749b12f15652ff97636
154409993d79f4db1f5e469a67e72d61bcd2f037770b03fd2d3d9a8edb5491b4
1b7fdf293f73edaa66c8540e356b9bd9d275586ded4dd7f9b5872d7d03319169
1f7244cb694f7f667a5f3668a79844fc6159e3922363f0423d9b09872680f372
2158c4c9892b2a94859c90120a00bbce1afb24a9d7f2915f36b46819330b7a4d
2382b2492d0a618482b6e29be392b8f6499744c731c3cdd93c5960b3a7985185
2433d15cf3fc19f8f5cafb0ac8bfa2a3eea71cea8c41b3e4a7ee84252a33bb1c
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
3c19df610d2b937c34facbe5517c48054fd3695a18e69fa1ac94084aa61d5079
4136413b26b2bb4162d77c03ac4eefdf52ad9f4a080e46a14d345c5f2331ae72
456ab1a71507ed91abae14c9d08faffb373a7bc711a66e44341b7b8b7bb72ab4
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
521410e1fc44780061e09adc980275fb5ea277fd5d9e538454214ec4379ff4bc
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5b1642eed0f9aac493928915a41f4d38a14e17166dbade3d38d152999dcc7944
5bd8959eab1b4f391347226aa92d2767fcf086a68d4a96971516632921e1c03c
5c7e07dfb2d7437793e8b1ed577739a8bd55558df14aa7234714675ba53f71ee
5f9376c77618bf0ef43bcabf8228c9e2befde3731087b944e140a88c34066873
6102d725c22f9bf27ef542ceae070843153f3e0926b89820a75f29b107e33cb2
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a
74acff700e5b6f1e2c35dc17aa1456914e1c5ccbfdc7600e281408d379fcd559
74d66add22660b12e57cf4a9e1c2fe4fcc8708e052ec75b62b1e9428968fc90d
77a44f65bb6894c92e3c7ccab98de0fc357172221cc1dd45949ab938c0c7756a
785a16698de18e34b11e17b3db3b83b2745d95ef2b64dd917187a39604813519
7d11e7e384579b55d578f3aec8bf96ba7ab144a1f34e36451556019113bb2b5f
81685b6633b8914f3e4bef17a8621658219d5d35a0ae5c073eb4b5f4cacfc360
8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395
934881c9bb6fb93c12028bc27a577578dc9a02b3dfb5554fb6ce7b0fc14a05b5
960d3c7144bd7d1695869610cb719fa0d30c5ca692eb76e1497a96f0c7ee001c
98069a9ad4e606076d4eaddbd3d6e0fe37616d88caa9362490fac1396c1e72e9
a011595b8a7a4aecacbb9bdd095cf4e446e368e8c897b2daf1807e6016137c1a
a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553
a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6
a53c43f834b32309b084ea9314df8307e9c78cee2202c6e07f216ae4ae5b704d
a57b5242b9a9adc4c1ef846c365147b89c472b9cd770face331efcb965346b25
a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37
a81d25118c6f7d835e9ca132b995b8aca46e3575ee4ab2136ab96ac8d5e4688b
a898f00aabf0e5632b47a59e092c4662c8cbda0c33ea6d0d424cbced57e3ee72
af4c6683814aa527caf53bde3d021e6aafe00833b45f2dead043c87ed7864674
bd30abcef85d1ce7c7d870dc5792255321828590d8f5cc6a42a834fe6167a96f
be8da03b73cd9fa32f351d01327986e946ec34610ca3a3b260c28a726f432988
bf648e00e0af4671490d97824e4c8299680d0646fed8f90c69b92ee1ee3f0e7a
c25fe595b3c9a573a7e1a1a2ae85b60092292474b599824fb4bb8670c670e857
c6ff6d4624a5c8140cbc19107aa372a233907f8e6e4d55d002d20cae682a575f
d0e06d461fdcd36bcedbdf977452b522d0c89a06e11cd48be67a7cbdf772dd3f
d2a5b93d1bc3164be402d701741e435ff33b7f5ac4afa4950b54b2ff571544c0
db80a874ac33abe17f2f34b9bc6b462b81f15a49e9214b1074a69639c57e7431
e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e628b651c2431daea8d1fe939cace6a7fc1bead807b93c8fc83e9ade79ed0f97
e8a90594cc8c2796c488059c7ee25ce6cc9de27c7ac359ee680b50a2bf438da6
ef6ecdddf1d9d855c98a99c63bb428b65d2c0398992c66699e1180ffb7ea675c
f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1
fa9a3880a0d54a4bd990e2f63278be581b068336f34a39863e47ba65774d82d7
fc6c45fb43f51dfc76b7770b2e751e3400575327793dcd1eb257373af7857627

xem.li Open in urlscan Pro 116.118.49.216 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

90 Requests

89 %HTTPS

80 %IPv6

11 Domains

15 Subdomains

16 IPs

4 Countries

875 kBTransfer

2509 kBSize

5 Cookies

2 Outgoing links

Redirected requests

90 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

xem.li Open in urlscan Pro
116.118.49.216 Public Scan

Screenshot
Live screenshot

Full Image

90
Requests

89 %
HTTPS

80 %
IPv6

11
Domains

15
Subdomains

16
IPs

4
Countries

875 kB
Transfer

2509 kB
Size

5
Cookies

90 HTTP transactions
0 data transactions